3450a2cd4baee5ce0bc4e18e1a4e39219412f1131da245acb345f47404576872

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe
Size 243KB
Sample260817-pqletabl9w
SHA256 3450a2cd4baee5ce0bc4e18e1a4e39219412f1131da245acb345f47404576872
MD5 d986cd39679dcbe5160e457fa672fb4a
SHA1 f0475dc932047261580ea1f7446a398440ecee56
SHA512 d7dce812a09fb49c5688b21adbb6f718baed9f01fe408617bb76d3630385f85612f07999e0c4e463a72c6845ff1f378b858f86d6a7f7341cb893f4059ea807dd
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:9vMsLaOa3lLNngoqRttA7Q
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4952	CP.exe
4204	rmgbywrojg.exe
6968	CP.exe
2380	CP.exe
3952	i_rmgbywrojg.exe
6680	gbytqljdby.sys
5612	CP.exe
7072	vqoigaytql.exe
6396	CP.exe
7084	CP.exe
1472	i_vqoigaytql.exe
1816	vtnlfdxvqn.sys
2764	CP.exe
5308	nkidavpnlf.exe
6820	CP.exe
2680	CP.exe
2572	i_nkidavpnlf.exe
4720	icavsqkida.sys
4568	CP.exe
4248	uspnifzxus.exe
5432	CP.exe
5884	CP.exe
5452	i_uspnifzxus.exe
1888	kicaxspkic.sys
5948	CP.exe
3008	dxupnhfaxs.exe
7136	CP.exe
2832	CP.exe
1804	i_dxupnhfaxs.exe
2060	upnhfzxrpm.sys
5372	CP.exe
1732	upmhfczxrp.exe
3340	CP.exe
6268	CP.exe
4008	i_upmhfczxrp.exe
4208	jhbzurmkhc.sys
2000	CP.exe
2396	jhezwrpjhb.exe
3232	CP.exe
5532	CP.exe
4472	i_jhezwrpjhb.exe
952	hezwurpjhb.sys
1556	CP.exe
6456	ywqomjhbzw.exe
1824	CP.exe
6424	CP.exe
5420	i_ywqomjhbzw.exe
3496	ojgeywtrlj.sys
4104	CP.exe
1436	mgeywqojgb.exe
3820	CP.exe
4768	CP.exe
5092	i_mgeywqojgb.exe
6828	tqoigbytrl.sys
6432	CP.exe
2348	oidbvtolgd.exe
3620	CP.exe
3664	CP.exe
5516	i_oidbvtolgd.exe
4452	bytqkidavs.sys
5840	CP.exe
812	vtnlfdyvqn.exe
3716	CP.exe
5508	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
2896	msedge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_1429955855\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_396312053\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_396312053\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_1100112295\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_2052066705\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_1429955855\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_396312053\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_396312053\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_1100112295\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2896_2052066705\data.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkidavpnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxupnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhfzxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fayvsnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmgbywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhfzxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmgbywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnifzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromjhbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromjhbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxupnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfdxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnifzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkidavpnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfdxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaysnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaysnljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1676	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6156	ipconfig.exe
3980	ipconfig.exe
2584	ipconfig.exe
4980	ipconfig.exe
3860	ipconfig.exe
4988	ipconfig.exe
5844	ipconfig.exe
6744	ipconfig.exe
1664	ipconfig.exe
5056	ipconfig.exe
5216	ipconfig.exe
7012	ipconfig.exe
3208	ipconfig.exe
6220	ipconfig.exe
4160	ipconfig.exe
2280	ipconfig.exe
3740	ipconfig.exe
1784	ipconfig.exe
2196	ipconfig.exe
2664	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314436082220302"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C389728F-CD0F-4CE4-8379-E8F2EC85590A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6608	msedge.exe
6608	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2896	msedge.exe
2896	msedge.exe
2896	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	i_rmgbywrojg.exe
Token: SeDebugPrivilege	1472	i_vqoigaytql.exe
Token: SeDebugPrivilege	2572	i_nkidavpnlf.exe
Token: SeDebugPrivilege	5452	i_uspnifzxus.exe
Token: SeDebugPrivilege	1804	i_dxupnhfaxs.exe
Token: SeDebugPrivilege	4008	i_upmhfczxrp.exe
Token: SeDebugPrivilege	4472	i_jhezwrpjhb.exe
Token: SeDebugPrivilege	5420	i_ywqomjhbzw.exe
Token: SeDebugPrivilege	5092	i_mgeywqojgb.exe
Token: SeDebugPrivilege	5516	i_oidbvtolgd.exe
Token: SeDebugPrivilege	1804	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	556	i_pnifaxsqkf.exe
Token: SeDebugPrivilege	6584	i_ausmkfdxsp.exe
Token: SeDebugPrivilege	2740	i_cxusmkhczx.exe
Token: SeDebugPrivilege	2004	i_omhfzxromh.exe
Token: SeDebugPrivilege	5316	i_zwromjhbyw.exe
Token: SeDebugPrivilege	2548	i_geywqojgby.exe
Token: SeDebugPrivilege	5144	i_eywtoljgby.exe
Token: SeDebugPrivilege	6532	i_ligaysnljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 7112 wrote to memory of 4216	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	91
PID 4216 wrote to memory of 2896	4216	iexplore.exe	92
PID 2896 wrote to memory of 4500	2896	msedge.exe	93
PID 2896 wrote to memory of 2696	2896	msedge.exe	94
PID 2896 wrote to memory of 1676	2896	msedge.exe	96
PID 2896 wrote to memory of 2696	2896	msedge.exe	94
PID 2896 wrote to memory of 2696	2896	msedge.exe	94
PID 2896 wrote to memory of 236	2896	msedge.exe	97
PID 2896 wrote to memory of 236	2896	msedge.exe	97
PID 2896 wrote to memory of 7004	2896	msedge.exe	98
PID 2896 wrote to memory of 4808	2896	msedge.exe	99
PID 2896 wrote to memory of 7004	2896	msedge.exe	98
PID 2896 wrote to memory of 7004	2896	msedge.exe	98
PID 2896 wrote to memory of 4808	2896	msedge.exe	99
PID 2896 wrote to memory of 4808	2896	msedge.exe	99
PID 7112 wrote to memory of 4952	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	100
PID 4204 wrote to memory of 6968	4204	rmgbywrojg.exe	103
PID 2896 wrote to memory of 6612	2896	msedge.exe	106
PID 2896 wrote to memory of 6612	2896	msedge.exe	106
PID 2896 wrote to memory of 1272	2896	msedge.exe	107
PID 2896 wrote to memory of 1272	2896	msedge.exe	107
PID 2896 wrote to memory of 6600	2896	msedge.exe	109
PID 7112 wrote to memory of 2380	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	112
PID 7112 wrote to memory of 5612	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	116
PID 7072 wrote to memory of 6396	7072	vqoigaytql.exe	118
PID 7112 wrote to memory of 7084	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	121
PID 7112 wrote to memory of 2764	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	125
PID 5308 wrote to memory of 6820	5308	nkidavpnlf.exe	127
PID 7112 wrote to memory of 2680	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	130
PID 7112 wrote to memory of 4568	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	134
PID 4248 wrote to memory of 5432	4248	uspnifzxus.exe	136
PID 7112 wrote to memory of 5884	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	139
PID 2896 wrote to memory of 4448	2896	msedge.exe	142
PID 2896 wrote to memory of 5812	2896	msedge.exe	143
PID 2896 wrote to memory of 6864	2896	msedge.exe	144
PID 7112 wrote to memory of 5948	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	147
PID 3008 wrote to memory of 7136	3008	dxupnhfaxs.exe	149
PID 7112 wrote to memory of 2832	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	152
PID 7112 wrote to memory of 5372	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	156
PID 1732 wrote to memory of 3340	1732	upmhfczxrp.exe	158
PID 7112 wrote to memory of 6268	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	161
PID 7112 wrote to memory of 2000	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	165
PID 2396 wrote to memory of 3232	2396	jhezwrpjhb.exe	167
PID 7112 wrote to memory of 5532	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	170
PID 7112 wrote to memory of 1556	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	174
PID 6456 wrote to memory of 1824	6456	ywqomjhbzw.exe	176
PID 7112 wrote to memory of 6424	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	179
PID 2896 wrote to memory of 4772	2896	msedge.exe	181
PID 2896 wrote to memory of 4772	2896	msedge.exe	181
PID 7112 wrote to memory of 4104	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	186
PID 1436 wrote to memory of 3820	1436	mgeywqojgb.exe	188
PID 7112 wrote to memory of 4768	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	191
PID 7112 wrote to memory of 6432	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	195
PID 2348 wrote to memory of 3620	2348	oidbvtolgd.exe	197
PID 7112 wrote to memory of 3664	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	200
PID 2896 wrote to memory of 5332	2896	msedge.exe	202
PID 2896 wrote to memory of 5332	2896	msedge.exe	202
PID 7112 wrote to memory of 5840	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	205
PID 812 wrote to memory of 3716	812	vtnlfdyvqn.exe	207
PID 7112 wrote to memory of 5508	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	210
PID 7112 wrote to memory of 6852	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	214
PID 5788 wrote to memory of 5052	5788	pnifaxsqkf.exe	216
PID 7112 wrote to memory of 5296	7112	2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe	219
PID 2896 wrote to memory of 2480	2896	msedge.exe	223

C:\Users\Admin\AppData\Local\Temp\2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d986cd39679dcbe5160e457fa672fb4a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbbb94c188,0x7ffbbb94c194,0x7ffbbb94c1a0
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,11039117886132895952,14695655083866797130,262144 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,5950094729670262899,7302841988630573064,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
      4⤵
      System Time Discovery
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,15880045381518372488,2498602679622433849,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,7074327766641840424,7972540192014065543,2097152 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:7004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,5713170944490055506,7170070003461461076,2097152 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7825402955867363265,2194896951092429094,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,819010886910444348,16122150568883304749,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10726418468932462798,11104163195896373876,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,10726418468932462798,11104163195896373876,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,7986841807759094520,17836248716825034119,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,17402603796707788672,6750219819186336701,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,7954899665192524084,11599216503637423585,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:6864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,1103793822099763810,15021002806189185779,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1358566629115732237,7451264452091854024,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,3239709923452346460,5324672611923279270,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,7228464568164168902,11832999801905437459,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6680,i,2920927016192111112,9015099937082753196,262144 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3116,i,6028381008566488337,15145478670778560104,524288 --field-trial-handle=2320,i,4317595903949276588,9283681600318183087,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmgbywrojg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4952
- - C:\Temp\rmgbywrojg.exe
    C:\Temp\rmgbywrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmgbywrojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2380
- - C:\Temp\i_rmgbywrojg.exe
    C:\Temp\i_rmgbywrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5612
- - C:\Temp\vqoigaytql.exe
    C:\Temp\vqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7084
- - C:\Temp\i_vqoigaytql.exe
    C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkidavpnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\nkidavpnlf.exe
    C:\Temp\nkidavpnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkidavpnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\i_nkidavpnlf.exe
    C:\Temp\i_nkidavpnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspnifzxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\uspnifzxus.exe
    C:\Temp\uspnifzxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspnifzxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\i_uspnifzxus.exe
    C:\Temp\i_uspnifzxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxupnhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\dxupnhfaxs.exe
    C:\Temp\dxupnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:7136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxupnhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\i_dxupnhfaxs.exe
    C:\Temp\i_dxupnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfczxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5372
- - C:\Temp\upmhfczxrp.exe
    C:\Temp\upmhfczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfczxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6268
- - C:\Temp\i_upmhfczxrp.exe
    C:\Temp\i_upmhfczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\jhezwrpjhb.exe
    C:\Temp\jhezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5532
- - C:\Temp\i_jhezwrpjhb.exe
    C:\Temp\i_jhezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqomjhbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1556
- - C:\Temp\ywqomjhbzw.exe
    C:\Temp\ywqomjhbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqomjhbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6424
- - C:\Temp\i_ywqomjhbzw.exe
    C:\Temp\i_ywqomjhbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidbvtolgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6432
- - C:\Temp\oidbvtolgd.exe
    C:\Temp\oidbvtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidbvtolgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\i_oidbvtolgd.exe
    C:\Temp\i_oidbvtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5840
- - C:\Temp\vtnlfdyvqn.exe
    C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5508
- - C:\Temp\i_vtnlfdyvqn.exe
    C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqkf.exe ups_run
  2⤵
  PID:6852
- - C:\Temp\pnifaxsqkf.exe
    C:\Temp\pnifaxsqkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqkf.exe ups_ins
  2⤵
  PID:5296
- - C:\Temp\i_pnifaxsqkf.exe
    C:\Temp\i_pnifaxsqkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfdxsp.exe ups_run
  2⤵
  PID:3400
- - C:\Temp\ausmkfdxsp.exe
    C:\Temp\ausmkfdxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfdxsp.exe ups_ins
  2⤵
  PID:5896
- - C:\Temp\i_ausmkfdxsp.exe
    C:\Temp\i_ausmkfdxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxusmkhczx.exe ups_run
  2⤵
  PID:2156
- - C:\Temp\cxusmkhczx.exe
    C:\Temp\cxusmkhczx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxusmkhczx.exe ups_ins
  2⤵
  PID:6596
- - C:\Temp\i_cxusmkhczx.exe
    C:\Temp\i_cxusmkhczx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhfzxromh.exe ups_run
  2⤵
  PID:3756
- - C:\Temp\omhfzxromh.exe
    C:\Temp\omhfzxromh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhfzxromh.exe ups_ins
  2⤵
  PID:2572
- - C:\Temp\i_omhfzxromh.exe
    C:\Temp\i_omhfzxromh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwromjhbyw.exe ups_run
  2⤵
  PID:6664
- - C:\Temp\zwromjhbyw.exe
    C:\Temp\zwromjhbyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwromjhbyw.exe ups_ins
  2⤵
  PID:1428
- - C:\Temp\i_zwromjhbyw.exe
    C:\Temp\i_zwromjhbyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgby.exe ups_run
  2⤵
  PID:4584
- - C:\Temp\geywqojgby.exe
    C:\Temp\geywqojgby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgby.exe ups_ins
  2⤵
  PID:2936
- - C:\Temp\i_geywqojgby.exe
    C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtoljgby.exe ups_run
  2⤵
  PID:4132
- - C:\Temp\eywtoljgby.exe
    C:\Temp\eywtoljgby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtoljgby.exe ups_ins
  2⤵
  PID:6260
- - C:\Temp\i_eywtoljgby.exe
    C:\Temp\i_eywtoljgby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligaysnljd.exe ups_run
  2⤵
  PID:2636
- - C:\Temp\ligaysnljd.exe
    C:\Temp\ligaysnljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligaysnljd.exe ups_ins
  2⤵
  PID:2036
- - C:\Temp\i_ligaysnljd.exe
    C:\Temp\i_ligaysnljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fayvsnkica.exe ups_run
  2⤵
  PID:936
- - C:\Temp\fayvsnkica.exe
    C:\Temp\fayvsnkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fayvsnkica.exe ups_ins
  2⤵
  PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1732

C:\Temp\gbytqljdby.sys
C:\Temp\gbytqljdby.sys
1⤵
- Executes dropped EXE
PID:6680

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:1816

C:\Temp\icavsqkida.sys
C:\Temp\icavsqkida.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\kicaxspkic.sys
C:\Temp\kicaxspkic.sys
1⤵
- Executes dropped EXE
PID:1888

C:\Temp\upnhfzxrpm.sys
C:\Temp\upnhfzxrpm.sys
1⤵
- Executes dropped EXE
PID:2060

C:\Temp\jhbzurmkhc.sys
C:\Temp\jhbzurmkhc.sys
1⤵
- Executes dropped EXE
PID:4208

C:\Temp\hezwurpjhb.sys
C:\Temp\hezwurpjhb.sys
1⤵
- Executes dropped EXE
PID:952

C:\Temp\ojgeywtrlj.sys
C:\Temp\ojgeywtrlj.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Temp\tqoigbytrl.sys
C:\Temp\tqoigbytrl.sys
1⤵
- Executes dropped EXE
PID:6828

C:\Temp\bytqkidavs.sys
C:\Temp\bytqkidavs.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\vtnlfdavsq.sys
C:\Temp\vtnlfdavsq.sys
1⤵
PID:4744

C:\Temp\icausqkica.sys
C:\Temp\icausqkica.sys
1⤵
PID:3348

C:\Temp\kfcxvpnhfc.sys
C:\Temp\kfcxvpnhfc.sys
1⤵
PID:1772

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
PID:4164

C:\Temp\mgezwromjh.sys
C:\Temp\mgezwromjh.sys
1⤵
PID:6864

C:\Temp\ojhbzwrojg.sys
C:\Temp\ojhbzwrojg.sys
1⤵
PID:1548

C:\Temp\bytrljdbyw.sys
C:\Temp\bytrljdbyw.sys
1⤵
PID:4368

C:\Temp\qolfdyvqoi.sys
C:\Temp\qolfdyvqoi.sys
1⤵
PID:1792

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupnhfaxs.exe

Path C:\Temp\dxupnhfaxs.exe
Size 243KB
SHA256 4dd4007d300047a85198a625035a8a4fe72297a523d1f559a9bf38cef2c251cd
MD5 555d4b83cbd399c7d8884f6fa6bc6f87
SHA1 7d54f4c1875b1a890513a5cba6923648987f47b6
SHA512 fc12ce25ecb52d3d7b448f51703b2b6fd0261f9c0a3e35a716e45ecfa597a0add7f4308f89637217a4034432f89521f5cb113b670d3b34d5650ea7238356eb90
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:5vMsLaOa3lLNngoqRttA7g
TLSH
T153345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqljdby.sys

Path C:\Temp\gbytqljdby.sys
Size 141KB
SHA256 9ac9312279d23fc1d14859fb6ca6be1568aa018e426a592004f0cca4f392c752
MD5 dbf3f5f66f52d8394f2a398f918897c2
SHA1 6d94e423afc95dd5f3f9dfd0b02d4a68e491c6c3
SHA512 013c545b4ca187ab4ad4f44c651c9047a99730363c804a4f75415ae90960fefe877d25dcd5a4789ab51f6557e4b6bc3c2302865e1e172da7eb0ba550a2a1d67e
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxupnhfaxs.exe

Path C:\Temp\i_dxupnhfaxs.exe
Size 243KB
SHA256 32922769c670f2d879e78b148fc7bb034b17763ff7f52e779adb4c05d9d610cc
MD5 a21930bff5cfb39b83f4414c99529a5f
SHA1 b1ad1bc6729e6b696361f8a5b351c1b716d82f7f
SHA512 179b0e9631edc7453bda3570fda9ef6a989a84b5aa8ad1edd42f640cf1443eaaa33458e7a796a14a51ed75a4595e319574ba1e5d12243c0fc484ab8bbb2fde35
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:7vMsLaOa3lLNngoqRttA7W
TLSH
T127345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkidavpnlf.exe

Path C:\Temp\i_nkidavpnlf.exe
Size 243KB
SHA256 b6750d7ba3065e628baad1d374423be9cadecf9b663b019fdc6580c136cce92a
MD5 2dc62224f55fd63cc764984dcbdd8d03
SHA1 206006625e94b55885f7b84d4b738165b3d869e2
SHA512 9a7a2f0877d66758f59a2ff4d45eba8da24c4059e4035258f1db5dd3fa139a924c88ad62d9aa3b9cfd101e4e3f7abc48daa1293eb3353f66a679d9275f6c24df
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:TvMsLaOa3lLNngoqRttA7+
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmgbywrojg.exe

Path C:\Temp\i_rmgbywrojg.exe
Size 243KB
SHA256 5d52f934d92f75c404d94ba6df1cc7f54498fa63e99e2d87c3e0824e7faf833b
MD5 31ede8261e043889b91ce563081ee393
SHA1 95e37d6bc5fe546b9e91187b329d0bc303a83307
SHA512 f0319384a202e41da079249aa77d5036d36bdaba7591c0eaec34385596ff662edd6bdf148d2b6199276c04456a651c6dea594c969ecb1f0968ee3b86cb2f0b56
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:hvMsLaOa3lLNngoqRttA7Q
TLSH
T19C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhfczxrp.exe

Path C:\Temp\i_upmhfczxrp.exe
Size 243KB
SHA256 48871ab02846a9143847b25bc8cac4acaeeed7b0f73eeb4a68e9d71599a16586
MD5 7a35a8b43e6c06f1e746746dcc53b976
SHA1 4e748c3c3c7297a690eed48f1f95afb1e37b6d53
SHA512 20e1f4790a9bb6190d8ad2028ef8fc56a98375f51e86c0dc8a966fbc9480e527723619335be66f27ef9f48f0885406ceada4898503c97a524e2ea2ae5dc4a49d
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:/vMsLaOa3lLNngoqRttA7u
TLSH
T17A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspnifzxus.exe

Path C:\Temp\i_uspnifzxus.exe
Size 243KB
SHA256 9a77d8308e398556c8d5a353002403cfc3b66656d57140d06c064bf1b0638ee2
MD5 35350d02292bef255571f5b581d06086
SHA1 1eb68632287a9480f9a31ddb67578b8868fd4ace
SHA512 88ec1e472b9c5f932d1ed1cbcd3c984b6caccfd1c0f9f958136a1fb9592e8b7db6e40f54381b76ad9d5296f7e74a79b7d99fe181c4659577cb9102a425e3800c
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:uvMsLaOa3lLNngoqRttA7t
TLSH
T1C5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigaytql.exe

Path C:\Temp\i_vqoigaytql.exe
Size 243KB
SHA256 520e5bc1e78e976d4d64f1fb07097cfeda6009fec39e1897a608cf7a8158a36f
MD5 253583103335b13cdcfb329d3818edfb
SHA1 456fad5f2ca3f182604b1ec4744e27653c87b46e
SHA512 af061b26d5a83d94ce6e58ba84606db5b97881eccfd856eb647b5d05fb02d871b76fa317bde5c020a6c9596a58dc64018704e8a736d72d531bb95212c44c1492
SSDEEP 3072:aHCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7MH:aivMsLaOa3lLNngoqRttA7MH
TLSH
T1A9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsqkida.sys

Path C:\Temp\icavsqkida.sys
Size 141KB
SHA256 98a638d355d496ffd6a60afe1532bff5e9e237fa13d7a942a26987428d180dbf
MD5 bce85985379c991cbc07dff212915b3f
SHA1 b6730cd5c160b55757db7038e04d36034f1b3715
SHA512 bea7b542d40ccab9357e88c8e96350064bf07de8a312e15fa776e2e2925091f500ee56821a3ce27e9c7d73311251e5cc933711c7add4a7f8785024d8ed57a0b8
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T185E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkhc.sys

Path C:\Temp\jhbzurmkhc.sys
Size 141KB
SHA256 fb4afe1f4f3de40d44949e4e9c8a284fa3a60d2e8f307874d3d70ff70569ec9b
MD5 27a8f9fe7f6b525a9e17810ff4b8cf61
SHA1 e5823d0b2c8e880b52d078d8c6a30a437593c5f0
SHA512 ebe19f1061980c5fa5013277ac6496629bbddb51b0e9f454087c9c9d76d46f7b914fe6cfedcff3e50e61b6e1de227a0efdb3ec127b6f68245f6a8f7e98aa08ce
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T198E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwrpjhb.exe

Path C:\Temp\jhezwrpjhb.exe
Size 243KB
SHA256 e83ea1ad93a692520b0dd5f857e510a4f16926b60faa94ebc51a39336bc7d950
MD5 329a5e2652b94f6f8897e2c608b60e91
SHA1 20c1984ca28efac6bc57733bf50de44fcbdfa69c
SHA512 b7a6e72ca393fbd17e47df711752ce95d1c6cf154495f32df80a3d21d9b43973c2a4a7b3eb0e2edf2ca9feeebca3df0a49ff086f9588cab567e18dc4ae0085e3
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:7vMsLaOa3lLNngoqRttA7a
TLSH
T15F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspkic.sys

Path C:\Temp\kicaxspkic.sys
Size 141KB
SHA256 a7bc691457953c5a84ebd03e686be3ee303685fb129c3ce6c1c5d5ea9d9962ac
MD5 e23f6c68b246bdd47f3d93b4a04327f7
SHA1 dfb0883c6e716fe16c7c5d0ad9cfc075eea4e889
SHA512 332cf45e40160085575338719b46ca54b56d10c2861000fa89445de4a39f6d5fe7bc9f7d96c9bba55f24ee0ddafa728435daa28ddc27e6c38dd857c66fd85cad
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidavpnlf.exe

Path C:\Temp\nkidavpnlf.exe
Size 243KB
SHA256 ccd95f40787855ccc1558905337ee6e47223ed4fd1ade369e568d28296d29032
MD5 1f88fb282a1f12a790ecf01b8bb4c897
SHA1 b8cdd1b86dbfc7fa7f0b13cebaa81bde721ce5a8
SHA512 37282a35061ff48476c229047f9d211fe52220101f869bb598b41fe2307ce570e5cc3208cf2f0b08f11fd0fec91c4babd62ff1e24adae1a27c45e427d28ddc49
SSDEEP 3072:w6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7iC:wlvMsLaOa3lLNngoqRttA7iC
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgbywrojg.exe

Path C:\Temp\rmgbywrojg.exe
Size 243KB
SHA256 4e977f5a4a2a53acd15625dba7a20ee39b78f10fa1cac3771bdc06a038bc7250
MD5 c199629a687e27136beacced2b780842
SHA1 b48b25be8e5c1380702c6e6a6a5386fd203e138c
SHA512 f2f9791be3ad1c390bf2da1be5c7bbcc8cd1667999d57b86d988022cb0a923d2f49681e0d32c319f5334193e2277ac41c2b71293b6e83ba16a92cb2c5071e753
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:UvMsLaOa3lLNngoqRttA7/
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfczxrp.exe

Path C:\Temp\upmhfczxrp.exe
Size 243KB
SHA256 2232ecb0ce7e67dfa7167e1bd8f73470a4cf43f8303bead24beff27eaf942243
MD5 d5cadb112680d4d895e20b11c47c8ded
SHA1 dae787509b417a443062f5d5a217d2a47ae55f35
SHA512 fa94cdedee98d2851fcea16359ff43038fab7bf893e360f18e2300273092ecd1a847f27ff997dd6c05c5173c66dcf0d49a118231252732a4c23a8c7c1255a259
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:FvMsLaOa3lLNngoqRttA7A
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxrpm.sys

Path C:\Temp\upnhfzxrpm.sys
Size 141KB
SHA256 e846eca74a5ce05c7fac9cc9ccf7661bddaaee8cec732c88ad7cebb5ab51df3f
MD5 47693437e0ad1cf61e240dbca5510cab
SHA1 f098c865446d82a8f1877d60547680c64e35646b
SHA512 8e4aed4189e901463b846a09aaf2c06c84c92c3d60d5c3a0e6eab642af2a3cdb01c8ffb004fa423f769ce82faaed97b25d33afeea1f225a4f88de99570234ebd
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T199E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspnifzxus.exe

Path C:\Temp\uspnifzxus.exe
Size 243KB
SHA256 5c3807ad230080eb25aeb1768f8f661f687b39fee66f4e420740a53a5122f359
MD5 c4718e945a157d0dcdd92ee118adea22
SHA1 c863615d4b59dc31f23b6d0d87547228e6eecd6d
SHA512 eda6a5881816251c377e50e4d8e2a1f606fdb320194b42f9fe4c23dbddb06e172e19d34efa7573971a9cd3a3a131e8c054713f90d8741026e4ea769ef719e9b9
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:mvMsLaOa3lLNngoqRttA71
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytql.exe

Path C:\Temp\vqoigaytql.exe
Size 243KB
SHA256 4b1b4bee429f327b02dfd317f6a60790a5db287c72d789cab0135e5bc49064d2
MD5 f43cce993f88412731ef67a25496c5a4
SHA1 464f2d30df7591c493a8d59a1856fe2d4118a488
SHA512 699992fd94d3be6a00d727145951c18c8fde1f1626a4182cef9e60da160262dda3ad3caf2d142051979d77377f70293097d86d79e57fea8cb9f685a618cec7b7
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:YvMsLaOa3lLNngoqRttA7f
TLSH
T147345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvqn.sys

Path C:\Temp\vtnlfdxvqn.sys
Size 141KB
SHA256 5276a89ddc38f033d68f7c6294c30fe81c6969405aeab96395286fa0bd9560a9
MD5 d3c7927de5f04e955b8d7c0824fe2673
SHA1 4b207b25b09354505b5074acf7f040392d2a79bc
SHA512 bc36126fa6d89b7adbf94d8a8b7cc0d0fed1e00bd4c6b7beea50a83e0e73b86f9df1f3edaba02615d8b4e907cec01cb2383434e198955c841daeb1de8217fc5a
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

7edbb3b2-986b-4a5a-8ce6-f3580fd45f64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7edbb3b2-986b-4a5a-8ce6-f3580fd45f64.tmp
Size 16KB
SHA256 9126248b7847bdead030a4737d6eb41fe933dd9e05ab221275b7be6bccf15949
MD5 ae6d564cff6dc955cbd3ba757dd4fa30
SHA1 ca28363e95f309c6473876214b667f78071f1c3e
SHA512 219c639ad1bfd8805ad570857e5f57a0da58489c70efa95841af0867616c4a9372629e5b1e47a0fe5ec3943456317574c980e362a4b04e49b95be605106a853d
SSDEEP 384:sxRxb8h/f1s0f5N/RIink/5F/WASsGQbjl:sd4h/fXfbW1/55WASsGQ1
TLSH
T1DC72D7156A249E778CDBD309FA967F93D3F8117391955E44AAFCCA0C00EAAED211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ae9a505bd00519f0309b9d37fd960557a1e7d223b469f2165031e8e40e09087f
MD5 10233541a4bf9c37e704d146c79f00b2
SHA1 6e7b91859b30f06e914c1887f8794cf81176709d
SHA512 633fd1d8cc79faa4136369d10abf3a8d8150869551b559c7825de86a465417800becbff0f2696fce455a54d04a4a53bed6f526d43b0c94ab2a4790f7704966ba
TLSH
T1BFE02B69C922FC2759FC5B1C60580647E740135B3B41894B3B3C822C4FF5637468AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 65566388f16662f81b3e1ce11e816f8abbbc705c6cda0aaef66e93c3c07dcf41
MD5 a1f3ea7c6102c154b4816ae4420a14b4
SHA1 24eefa629d0cd788dd5bb27b0bbe25803571c5ba
SHA512 65e055bc7c12915e8ecac476ce30f335564002b9957489872af92328ca22ceefef6340715740c3083ae5b22a28b696a56af53b7d45ae7093b392a98ccfe76d40
TLSH
T16E41A0F783F4856ECA1195F0AA187E2FCF1D0515432C7D9AC9E4AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

adab7b83-68ed-45fd-bc92-b0ba53fd2717.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\adab7b83-68ed-45fd-bc92-b0ba53fd2717.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2b24f76a89b2313045e8995f3d600401282a77668d68cb48d8e0af4eabb7f191
MD5 01ca6851ef21a7e46a2f5b2b8b24542c
SHA1 c7f3f104bcfd32527237f82cc5d55c4240f4bf57
SHA512 b02cfe64a7d21d01c2bf93ab6128b5ac0bbb6b30c8c1a53cec78370959fae2cb67c441d49d4fea518dc10ac66a596a02fe6fbf9b48c66691f4f130ae0d07f78a
SSDEEP 384:sxRxbqYh/f1skfvN/RIink/5F/WA7sGQbpS:sdWYh/fzflW1/55WA7sGQA
TLSH
T1AF72F815A9249E378CDBE319FA967F93D3F8117391955E44AAFCCA0C00EA6DD211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6bfec28e0e230fab781d15e38f5660866c008a08e857c07acff345388b723cb1
MD5 49ab788ff4cf3e3d6a5d3ed95ec0f50a
SHA1 b1786552a2c8677a52e54cc594524a0915af0d7a
SHA512 b9f812fa3dab0cd50d64100ae009d8ee791ce8ee184f9e64ba8a46e3037788af2f83002f9a37d7bdd8f7136e920c60e985e2d62d273b9ee863b775bd9d019895
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOobbDwzro840:Ob4YZnE7yTWg1NfwBu1jatobHwAD0
TLSH
T1CFE2FB3B680CCB7E4F804ADDEC29BD8B6DA801CF5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 d8509ca28e6a4f528c794a8fe03e6b376fcb92c7440e04b657f839bd5d4021cc
MD5 3e82d321f71eb0438fcf1c753eeafadc
SHA1 9eb9635963875554abc21e362aa902d59c4dd4ca
SHA512 74a3d0f7e74584159ba85887ba59b68740c1c0ca82fe685c51b89472c5d3e8c37bc0f3bf42a5f3bb17667e4473a068018cfaf94efeb7876109f111b93c2ecf38
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9l2n6b3xdZ4d0z/TB75oX3UxH:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRI
TLSH
T10AB25B11713F4280387EB90C81B8982F96C2B4637519F56F7BA805A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2d7559ee394b81a0760cbccf522d28af5fb414afffed22da8a659df8cb0411ba
MD5 2fe720a01a67601a0fb4f02993701eb9
SHA1 fa85ec392a492d45f4ef29a8e2473952f9ac16c2
SHA512 83ebd9ef08ef2ec7726614587f0eb10092459d7256169f220ff516f6a0cded76dea5ef8105eaf6e25057fc68d73105de7dd52b7622dbdf7f75390cbacdd8e5ba
SSDEEP 384:nJiF1tNn/s3n9Sn8Ng+8TUNTUlIRiPvuTusRESVfbzGjwTDG1LJqOObjI9G6w7KJ:gF1j+9SX+wgUu71tGCaBJq29MI
TLSH
T1B1C24A36EC55CEB7ECE64F98B34E7A5AEEE0116385AC5AC4EAD95D0C00D729D0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9f76fa37f719ba4c88480c8189da7181724c912c9a2036b4e2079d63994d539c
MD5 17863e46b38b468d4b3a1da0c5d82435
SHA1 19ebde5d608ca827d073047ad3e0cd2259210a11
SHA512 4d44fe6fd6d49ca824fd11211100165cff6bdf8c918e053d879cc0dac3920de07819c4216103a199385a1005d6feccdaa229ebddc79f4276ee3bac53459ec566
SSDEEP 384:nkiFiZcI58NLb8TUNTUlIR6PvuT7XnESVfbzGjwTDGGL2kekOOPrXLpe8C/py48s:/FQ5QbwgwuPDtGCaJ1kOi9P6ys
TLSH
T18AD25C31D8A4CAA7ECFB9FD5A74A7646DEE41163D89C9AC8E5D88D0C00D719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1b7b31afa0aa341f01637774abb90fbe08e9738573def1f409289c02fde82d19
MD5 9a1da51070e8b066b1c2c5d714238fe3
SHA1 3f6a5a24594da44449b2258f54afd84d5feedd74
SHA512 5c5fd9f3f1cf19ad6a517f64829ee77241870434daacc29664bae7359e9a7baf235fc76c74c74df4a65d4a64b1f4421e20a9ee7bd5151a196a2123e7555a077b
SSDEEP 384:nliF1tNn/s3n9Sn8Ngb8TUNTUlIRiPvuTBOnESVfbzGjwTDGGL2kkkOObjI9G6wk:sF1j+9SXbwgUucDtGCaJ9k29MI
TLSH
T1BDD25B32E855CEA7ECE78FD8B34E769ADEE01263889C9AD8E9D55D0C00D729D0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 31af0275ec2239d6ea27d99fb8ec53b30f36aadb91efd62fd9dbc68b35bc6d54
MD5 ccf34d072f8c83fc66aefb4597d4a94c
SHA1 58cfa537b65f13acab80cea7106b5173c768d82c
SHA512 701f1bfdf3957a26deb9121ee130dd19b4329bb4f9fab3fdae23ffd305a36819f538eee2b7234837ceff2fd4f88b75a6bdfe0dc30a5e92ff6a5b5a7aabd45c88
SSDEEP 384:nLiFiZcI58NLb8TUNTUlIR6PvuT7XnESVfbzGjwTDGGL2kekOOPrXLpe8C/py48s:mFQ5QbwgwuPDtGCaJ1kOi9P6ys
TLSH
T160D25C31D8A4CAA7ECF79FD5A74A7646DEE41163D89C9AC8E5D88D0C00D719D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 83dd756747e55dee2565d37830ff87158684db7189c56de030f1f3bdf9925d02
MD5 5d66b4dec3a3adc7a36a7549100be430
SHA1 88636694881693c89dce408eea979c56019cfc7a
SHA512 45947252100b19b62152dc31850c5401ad317c04861195e6ec7a166b7c99239595e5375e434622215dbfbdd3df0ddaf3dd792b71d0d7551e0c5087cafbd6a968
SSDEEP 384:n6iFiZcIy8NLb8TUNTUlIR6PvuT7EnESVfbzGjwTDGGL2DGkOOPrXLpe8C/py48s:xFQyQbwgwuMDtGCaJqkOi9P6ys
TLSH
T18DF2C3F198E78973E8AE8B97637D2E419AFCD163B4884984B7C44D0CCC961BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 694f1fc2e2c68a2e6d5bd13477b88c65da42e0b778aa23ef48209f170de25b59
MD5 8105d7f4ce2779eb0d3af403826177a7
SHA1 6c988b7421bcb4684a3bfb13ea7b107801d42309
SHA512 d91a69fa5a13d5f7b7ce40b9afd73568fc6993b849f175a8b38f4999f8cdb1d5fde72093d1db81e6d73c20da4569135f31e9a8ade260f028aff8dcd0bf80e9e4
SSDEEP 384:nLiF1tNn/s3n9Sn8NLb8TUNTUlIRpPvuT7XnESVfbzGjwTDGGL2kkkE8LEEIzWI:mF1j+9SQbwgnuPDtGCaJ9k4
TLSH
T1C0B24B32E855CE67ECE78FD8A74A7686DEE0116388DC9AD8E9D85D4C00DB2DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f7edb8e54884795a399cf363b08025af7a10f0a9e9c48c87854a53534b72072a
MD5 6afaf2c6a06041dbc126d4d845923690
SHA1 abca841a40f03e80b0fe881dcc99787623e80af6
SHA512 5e79322c7342aa79d04b2b260bd0d2aefd014a02f582524bf394b2d2864d1c03d374236e83a6fda7af77ba775e7dc37e002340410b733c52d8ef4197226e3449
TLSH
T1E8512DE04C3C1AD1D4FD0E3EB09739FC95EC9626F89434386859EA989A7A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1792-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1792-423-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1816-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1888-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1888-214-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3348-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3496-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3496-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4452-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-201-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6116-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6680-146-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6828-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6864-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download