f57a247d4ed3d752c43b794bb50ef21bbc9e869284812967238391682c889698

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe
Size 243KB
Sample260930-ptdjdavy4p
SHA256 f57a247d4ed3d752c43b794bb50ef21bbc9e869284812967238391682c889698
MD5 2f1e87400154d1b8e01aefe8a29bc2c3
SHA1 863a7e800a4e421f436a66c848f4f993ae5d702a
SHA512 9d5507e3b0faaef82541b6467b7a0de1fbc4a6144c0c92995fc2a939c9a12342badc95278ec46b53558d7f44e52d4e9ce0e7d2785f6a8b0e8a4306d3999b11d8
SSDEEP 3072:qBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:ib3TfLAUa3lLNngoqRttA7m
TLSH
T1EF34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4752	CP.exe
5064	zupmhfzxrm.exe
5520	CP.exe
3200	CP.exe
2964	i_zupmhfzxrm.exe
4616	zusmkecwuo.sys
5268	CP.exe
3472	jhbzwrpjhe.exe
2000	CP.exe
2020	CP.exe
3340	i_jhbzwrpjhe.exe
4404	ecwuomgezw.sys
1420	CP.exe
3632	rljhbztroj.exe
4108	CP.exe
2684	CP.exe
5368	i_rljhbztroj.exe
4196	geywtrljdb.sys
4760	CP.exe
2864	geywqoigby.exe
3244	CP.exe
6028	CP.exe
2100	i_geywqoigby.exe
4880	dbvtnlgdbv.sys
3048	CP.exe
3432	bvtqoigbyv.exe
2444	CP.exe
3792	CP.exe
5964	i_bvtqoigbyv.exe
5772	lgdyvqniga.sys
4776	CP.exe
3024	vtnkidavtn.exe
2632	CP.exe
4944	CP.exe
4416	i_vtnkidavtn.exe
3784	xvpnifaysq.sys
2096	CP.exe
5920	vpnlfdxvpn.exe
2344	CP.exe
5788	CP.exe
4872	i_vpnlfdxvpn.exe
4328	snkifzxvsq.sys
2504	CP.exe
2740	kifaxvpnkf.exe
5828	CP.exe
2100	CP.exe
3408	i_kifaxvpnkf.exe
3096	pmhecxuspk.sys
5808	CP.exe
3212	hfzxrpkhcx.exe
756	CP.exe
4692	CP.exe
3596	i_hfzxrpkhcx.exe
5428	smkecwusmk.sys
1488	CP.exe
3068	kecwuomkec.exe
2596	CP.exe
3852	CP.exe
3412	i_kecwuomkec.exe
2408	jecwurmkec.sys
752	CP.exe
204	ecwuomgezw.exe
2532	CP.exe
4548	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1863827526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_715557271\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_715557271\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1774567737\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1641638449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1863827526\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1774567737\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1774567737\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5112_1774567737\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwuomkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zupmhfzxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqoigbyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zupmhfzxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqoigbyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwuomkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2704	ipconfig.exe
1880	ipconfig.exe
2408	ipconfig.exe
4092	ipconfig.exe
2872	ipconfig.exe
3352	ipconfig.exe
1072	ipconfig.exe
5692	ipconfig.exe
1756	ipconfig.exe
2424	ipconfig.exe
824	ipconfig.exe
1128	ipconfig.exe
3744	ipconfig.exe
3512	ipconfig.exe
2248	ipconfig.exe
2760	ipconfig.exe
4272	ipconfig.exe
4504	ipconfig.exe
1660	ipconfig.exe
1356	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{00C47690-FCC6-4D64-BF1B-9C5ED3298BCE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe
5112	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	i_zupmhfzxrm.exe
Token: SeDebugPrivilege	3340	i_jhbzwrpjhe.exe
Token: SeDebugPrivilege	5368	i_rljhbztroj.exe
Token: SeDebugPrivilege	2100	i_geywqoigby.exe
Token: SeDebugPrivilege	5964	i_bvtqoigbyv.exe
Token: SeDebugPrivilege	4416	i_vtnkidavtn.exe
Token: SeDebugPrivilege	4872	i_vpnlfdxvpn.exe
Token: SeDebugPrivilege	3408	i_kifaxvpnkf.exe
Token: SeDebugPrivilege	3596	i_hfzxrpkhcx.exe
Token: SeDebugPrivilege	3412	i_kecwuomkec.exe
Token: SeDebugPrivilege	2860	i_ecwuomgezw.exe
Token: SeDebugPrivilege	1748	i_wtrljebwuo.exe
Token: SeDebugPrivilege	3436	i_ljdbvtolge.exe
Token: SeDebugPrivilege	1548	i_ysqoigaysq.exe
Token: SeDebugPrivilege	4384	i_ysqlfdxvpn.exe
Token: SeDebugPrivilege	5048	i_vsnkifaxvp.exe
Token: SeDebugPrivilege	3268	i_smkhcausmk.exe
Token: SeDebugPrivilege	1236	i_fzwuomkhcz.exe
Token: SeDebugPrivilege	5968	i_mjecwurpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3844	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	88
PID 3844 wrote to memory of 5112	3844	iexplore.exe	90
PID 5112 wrote to memory of 3548	5112	msedge.exe	91
PID 5112 wrote to memory of 3400	5112	msedge.exe	92
PID 5112 wrote to memory of 3240	5112	msedge.exe	94
PID 5112 wrote to memory of 3400	5112	msedge.exe	92
PID 5112 wrote to memory of 3400	5112	msedge.exe	92
PID 5112 wrote to memory of 2988	5112	msedge.exe	95
PID 5112 wrote to memory of 2988	5112	msedge.exe	95
PID 5112 wrote to memory of 4892	5112	msedge.exe	96
PID 5112 wrote to memory of 4892	5112	msedge.exe	96
PID 5112 wrote to memory of 4892	5112	msedge.exe	96
PID 5112 wrote to memory of 2184	5112	msedge.exe	97
PID 5112 wrote to memory of 2184	5112	msedge.exe	97
PID 5112 wrote to memory of 2184	5112	msedge.exe	97
PID 5112 wrote to memory of 108	5112	msedge.exe	98
PID 5112 wrote to memory of 108	5112	msedge.exe	98
PID 5112 wrote to memory of 364	5112	msedge.exe	99
PID 5112 wrote to memory of 108	5112	msedge.exe	98
PID 5112 wrote to memory of 364	5112	msedge.exe	99
PID 5112 wrote to memory of 364	5112	msedge.exe	99
PID 5112 wrote to memory of 2104	5112	msedge.exe	100
PID 5112 wrote to memory of 2104	5112	msedge.exe	100
PID 1632 wrote to memory of 4752	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	102
PID 5112 wrote to memory of 1820	5112	msedge.exe	105
PID 5112 wrote to memory of 1400	5112	msedge.exe	104
PID 5112 wrote to memory of 1820	5112	msedge.exe	105
PID 5112 wrote to memory of 1400	5112	msedge.exe	104
PID 5064 wrote to memory of 5520	5064	zupmhfzxrm.exe	107
PID 5112 wrote to memory of 3724	5112	msedge.exe	111
PID 5112 wrote to memory of 2788	5112	msedge.exe	114
PID 5112 wrote to memory of 2788	5112	msedge.exe	114
PID 5112 wrote to memory of 2532	5112	msedge.exe	115
PID 5112 wrote to memory of 2532	5112	msedge.exe	115
PID 1632 wrote to memory of 3200	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	116
PID 1632 wrote to memory of 5268	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	120
PID 3472 wrote to memory of 2000	3472	jhbzwrpjhe.exe	122
PID 1632 wrote to memory of 2020	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	125
PID 1632 wrote to memory of 1420	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	129
PID 3632 wrote to memory of 4108	3632	rljhbztroj.exe	131
PID 1632 wrote to memory of 2684	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	134
PID 1632 wrote to memory of 4760	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	138
PID 2864 wrote to memory of 3244	2864	geywqoigby.exe	140
PID 1632 wrote to memory of 6028	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	144
PID 5112 wrote to memory of 2348	5112	msedge.exe	146
PID 5112 wrote to memory of 3436	5112	msedge.exe	147
PID 5112 wrote to memory of 2004	5112	msedge.exe	148
PID 1632 wrote to memory of 3048	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	151
PID 3432 wrote to memory of 2444	3432	bvtqoigbyv.exe	153
PID 1632 wrote to memory of 3792	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	156
PID 1632 wrote to memory of 4776	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	160
PID 3024 wrote to memory of 2632	3024	vtnkidavtn.exe	162
PID 1632 wrote to memory of 4944	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	165
PID 1632 wrote to memory of 2096	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	169
PID 5920 wrote to memory of 2344	5920	vpnlfdxvpn.exe	171
PID 1632 wrote to memory of 5788	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	174
PID 1632 wrote to memory of 2504	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	178
PID 2740 wrote to memory of 5828	2740	kifaxvpnkf.exe	180
PID 1632 wrote to memory of 2100	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	183
PID 5112 wrote to memory of 4164	5112	msedge.exe	185
PID 5112 wrote to memory of 4164	5112	msedge.exe	185
PID 1632 wrote to memory of 5808	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	191
PID 3212 wrote to memory of 756	3212	hfzxrpkhcx.exe	193
PID 1632 wrote to memory of 4692	1632	2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_2f1e87400154d1b8e01aefe8a29bc2c3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffdcf79c188,0x7ffdcf79c194,0x7ffdcf79c1a0
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,4860116066376749587,17586237645373512349,262144 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,2143432501542632708,5093652833340862813,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:11
      4⤵
      System Time Discovery
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,5446934840365913851,13414882719348655508,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:13
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3324,i,10808778274694854616,10633352202768494341,2097152 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,12208749595856973214,3730687296005758464,2097152 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,4137211443181276168,785933456797725182,2097152 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,79909591714980902,10597119262636887705,2097152 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:9
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,2980765127529086209,5243888337673392581,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:14
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,12508529927533023784,2808626610297759483,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,11733462226746869326,3339799207570214572,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2312366153589999981,405338655010729724,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2312366153589999981,405338655010729724,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12203661689111625397,13980977336937690206,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10959889295698973553,4245949984635955477,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,3349273015111605616,12374699466968197762,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,9676919352767395515,8162651028734055812,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,16405390863316222843,10226493571463201751,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,9545641923658135875,7348365398891193610,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,15587682936087439712,16529790668124309454,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,12536311126403599931,10030047042822618896,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,14939193486233619123,13992758968506369163,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:14
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,14097977130156274616,12700119011507093796,262144 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,2232973807100188421,1949603237303552736,524288 --field-trial-handle=2400,i,6933859230781635268,15660728542241531038,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zupmhfzxrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4752
- - C:\Temp\zupmhfzxrm.exe
    C:\Temp\zupmhfzxrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zupmhfzxrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3200
- - C:\Temp\i_zupmhfzxrm.exe
    C:\Temp\i_zupmhfzxrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzwrpjhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5268
- - C:\Temp\jhbzwrpjhe.exe
    C:\Temp\jhbzwrpjhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzwrpjhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Temp\i_jhbzwrpjhe.exe
    C:\Temp\i_jhbzwrpjhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljhbztroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\rljhbztroj.exe
    C:\Temp\rljhbztroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljhbztroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2684
- - C:\Temp\i_rljhbztroj.exe
    C:\Temp\i_rljhbztroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4760
- - C:\Temp\geywqoigby.exe
    C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6028
- - C:\Temp\i_geywqoigby.exe
    C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtqoigbyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\bvtqoigbyv.exe
    C:\Temp\bvtqoigbyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtqoigbyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\i_bvtqoigbyv.exe
    C:\Temp\i_bvtqoigbyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnkidavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4776
- - C:\Temp\vtnkidavtn.exe
    C:\Temp\vtnkidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnkidavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\i_vtnkidavtn.exe
    C:\Temp\i_vtnkidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\vpnlfdxvpn.exe
    C:\Temp\vpnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5788
- - C:\Temp\i_vpnlfdxvpn.exe
    C:\Temp\i_vpnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaxvpnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Temp\kifaxvpnkf.exe
    C:\Temp\kifaxvpnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaxvpnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Temp\i_kifaxvpnkf.exe
    C:\Temp\i_kifaxvpnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Temp\hfzxrpkhcx.exe
    C:\Temp\hfzxrpkhcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\i_hfzxrpkhcx.exe
    C:\Temp\i_hfzxrpkhcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwuomkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1488
- - C:\Temp\kecwuomkec.exe
    C:\Temp\kecwuomkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwuomkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3852
- - C:\Temp\i_kecwuomkec.exe
    C:\Temp\i_kecwuomkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:752
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljebwuo.exe ups_run
  2⤵
  PID:4116
- - C:\Temp\wtrljebwuo.exe
    C:\Temp\wtrljebwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljebwuo.exe ups_ins
  2⤵
  PID:3720
- - C:\Temp\i_wtrljebwuo.exe
    C:\Temp\i_wtrljebwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  PID:4200
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  PID:3616
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqoigaysq.exe ups_run
  2⤵
  PID:592
- - C:\Temp\ysqoigaysq.exe
    C:\Temp\ysqoigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqoigaysq.exe ups_ins
  2⤵
  PID:4312
- - C:\Temp\i_ysqoigaysq.exe
    C:\Temp\i_ysqoigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlfdxvpn.exe ups_run
  2⤵
  PID:5364
- - C:\Temp\ysqlfdxvpn.exe
    C:\Temp\ysqlfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlfdxvpn.exe ups_ins
  2⤵
  PID:1748
- - C:\Temp\i_ysqlfdxvpn.exe
    C:\Temp\i_ysqlfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkifaxvp.exe ups_run
  2⤵
  PID:1248
- - C:\Temp\vsnkifaxvp.exe
    C:\Temp\vsnkifaxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkifaxvp.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_vsnkifaxvp.exe
    C:\Temp\i_vsnkifaxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhcausmk.exe ups_run
  2⤵
  PID:6120
- - C:\Temp\smkhcausmk.exe
    C:\Temp\smkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhcausmk.exe ups_ins
  2⤵
  PID:828
- - C:\Temp\i_smkhcausmk.exe
    C:\Temp\i_smkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzwuomkhcz.exe ups_run
  2⤵
  PID:3916
- - C:\Temp\fzwuomkhcz.exe
    C:\Temp\fzwuomkhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzwuomkhcz.exe ups_ins
  2⤵
  PID:4524
- - C:\Temp\i_fzwuomkhcz.exe
    C:\Temp\i_fzwuomkhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwurpjh.exe ups_run
  2⤵
  PID:5100
- - C:\Temp\mjecwurpjh.exe
    C:\Temp\mjecwurpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwurpjh.exe ups_ins
  2⤵
  PID:3804
- - C:\Temp\i_mjecwurpjh.exe
    C:\Temp\i_mjecwurpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebzwrojhbz.exe ups_run
  2⤵
  PID:1128
- - C:\Temp\ebzwrojhbz.exe
    C:\Temp\ebzwrojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebzwrojhbz.exe ups_ins
  2⤵
  PID:1612
- - C:\Temp\i_ebzwrojhbz.exe
    C:\Temp\i_ebzwrojhbz.exe ups_ins
    3⤵
    PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:824

C:\Temp\zusmkecwuo.sys
C:\Temp\zusmkecwuo.sys
1⤵
- Executes dropped EXE
PID:4616

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\geywtrljdb.sys
C:\Temp\geywtrljdb.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\dbvtnlgdbv.sys
C:\Temp\dbvtnlgdbv.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\lgdyvqniga.sys
C:\Temp\lgdyvqniga.sys
1⤵
- Executes dropped EXE
PID:5772

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
- Executes dropped EXE
PID:3784

C:\Temp\snkifzxvsq.sys
C:\Temp\snkifzxvsq.sys
1⤵
- Executes dropped EXE
PID:4328

C:\Temp\pmhecxuspk.sys
C:\Temp\pmhecxuspk.sys
1⤵
- Executes dropped EXE
PID:3096

C:\Temp\smkecwusmk.sys
C:\Temp\smkecwusmk.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\jecwurmkec.sys
C:\Temp\jecwurmkec.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\wurljgbywu.sys
C:\Temp\wurljgbywu.sys
1⤵
PID:1232

C:\Temp\lgdbwtolgd.sys
C:\Temp\lgdbwtolgd.sys
1⤵
PID:2452

C:\Temp\idaytqolfd.sys
C:\Temp\idaytqolfd.sys
1⤵
PID:264

C:\Temp\daysqkidav.sys
C:\Temp\daysqkidav.sys
1⤵
PID:3112

C:\Temp\snkifaxvpn.sys
C:\Temp\snkifaxvpn.sys
1⤵
PID:4328

C:\Temp\xvpnhfzxvp.sys
C:\Temp\xvpnhfzxvp.sys
1⤵
PID:2972

C:\Temp\mkeczxupmk.sys
C:\Temp\mkeczxupmk.sys
1⤵
PID:3784

C:\Temp\rmjebzurmk.sys
C:\Temp\rmjebzurmk.sys
1⤵
PID:3540

C:\Temp\ebwtromgez.sys
C:\Temp\ebwtromgez.sys
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqoigbyv.exe

Path C:\Temp\bvtqoigbyv.exe
Size 243KB
SHA256 cf4362a57c8dc23ddce5e0dc3aaca2eb57823178f1fdf60e8df6462c0517312e
MD5 dad5d19e6c8a0a0135b7cfd6ea5954c8
SHA1 42514e75336d62b036dd005a9b717ef37cded2af
SHA512 3a4431fdee56724d631d552517fac56b4ebd7392c10e979d7fb2764501af78bfbfb207a10dc9ba1ddb4f4558ae84745c5baaf0b253fbfc459d6f680c18527e53
SSDEEP 3072:KUBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7kq:fb3TfLAUa3lLNngoqRttA7Z
TLSH
T1D334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdbv.sys

Path C:\Temp\dbvtnlgdbv.sys
Size 141KB
SHA256 7b6ae88bfc5f9e8197737218c964de54c6d2b628040482df7cd1e6a9c67aa837
MD5 b0e1dbb4b49276bea6c701c890ab0b8e
SHA1 831769e8f81125dcac7db211206efa7bdb646a79
SHA512 f493d8bcfc87dd438c15b28c403c8abe2b71021822eb16bd3cb356dd3aa602bac0e48aaebf2e381fd682a0051f2418b7e9fbd264d748ffe6fbfa96acd201a769
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.sys

Path C:\Temp\ecwuomgezw.sys
Size 141KB
SHA256 556552e4a19250bde7b2b01836fb9a19001931e6d0a39450b2e0b20936b0aac5
MD5 7a01132f67677b35b5636a3e78f97fc5
SHA1 7b53dc9d9c1a88e5f7beedcbfdd52210957067ea
SHA512 884629e7cd460ea575e073d625f39d362e86554319fb3c7f2275adeb162a618010459924e3f1bb13836b1dcbcb6013f2ac120c2bf8bebfdf23c4dbd53ad9245f
SSDEEP 3072:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkbW:Ba3lLNngoqRt
TLSH
T1CBE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 243KB
SHA256 12d3c59f1eb0d8c4724920e7c338181d533e9a5328c1f7f699132b8526047ff0
MD5 17986ccf32c4e9c731cadcdf809a0cb1
SHA1 d99320f82fe1e48d9a13551f1ab023607922afd3
SHA512 e92dc01fbf6b202fb4c30a59f7b1858ddd649bcf2a86f07e8ea2f09cd43215b40ed651f5a6ad49b30e262eaea918f9f76c9fdaba2affa38f6c2c14eab2e02814
SSDEEP 3072:3Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:xb3TfLAUa3lLNngoqRttA7D
TLSH
T10F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtrljdb.sys

Path C:\Temp\geywtrljdb.sys
Size 141KB
SHA256 ff6d501f8573b2ed192cb7dfd8e1c81f79c3aadbe483aa2a6cced8669ffb23f0
MD5 f68bb7878a50d768a32c77abf88b6adf
SHA1 ddb0c71c9ad1207cd2013e32c0827e12529dd821
SHA512 33a16690929d17a4b11aa2302deae86ed229cf0ac761082f274ed32eb001ed22792842765494309e6befb6eccf13cd5b57cd71eb6ed64830e04e6adb0af71070
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtqoigbyv.exe

Path C:\Temp\i_bvtqoigbyv.exe
Size 243KB
SHA256 3366fcc7e07f70d26b6b255c2bcdd9012e0d25caac9e9f0ada74f9240c94f182
MD5 6fbf4d3d399531b1f9833c9f13e6048a
SHA1 478ec389e3121c602d7f369e5a5e0a2fe90e52c8
SHA512 3512a590ee96bbd041ec0134c2a1b74c921aa3758843135e55bf9f54470390da0fdd005c726e7a2e5dd968e4a13284197e84a87c07a0414295d597e53ed0f976
SSDEEP 3072:eBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:eb3TfLAUa3lLNngoqRttA7W
TLSH
T1B334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 243KB
SHA256 3d2dcba3f3b9e634e1d6995a18f082486ae725f8dede68fc57fd30e2b208651b
MD5 b2af57fff366a9cf8b09c9d8a1e4f1ae
SHA1 24636a32a1840ed19a6302dbfee841cea6ca4607
SHA512 464fe38d223599cbf4d01b6d9fca1a0c787eaeaea5652428b20111fe8cae7dcfab390ed51efb923486a7a74e10db13d92f7847d0fdaa51f5cb020bcf844a9457
SSDEEP 3072:1Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:fb3TfLAUa3lLNngoqRttA7Z
TLSH
T10434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzwrpjhe.exe

Path C:\Temp\i_jhbzwrpjhe.exe
Size 243KB
SHA256 46ce5ed8888f5fcc33cbb5cf7fecdbcf657bb332d198f63a06f5b73fcf7c0027
MD5 41712c4838906e49e29028e81f67f29b
SHA1 de447e3043c23b753988c0c06fd6c7278fcf2d5a
SHA512 92e0b2c53a7675cb3fb023f0bb94d84cba4bee4f10bf4048ef83d4cddd1348ecc4b4fed428739d37afc74dbf2480e4c32db75c1bffd21b62685e450c3e4fca13
SSDEEP 3072:QBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:Ab3TfLAUa3lLNngoqRttA7Q
TLSH
T16334490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljhbztroj.exe

Path C:\Temp\i_rljhbztroj.exe
Size 243KB
SHA256 25fceac81e25fba482cf78833f82fb1c02255497717ffa684e32895a0ad0d09d
MD5 19ca0d9d348bf3d0d00ed7b40fc33a96
SHA1 d3bda8ee5b5aeb498ccf3db885a3016ef125b4a9
SHA512 a16b3fe6f474861bd09f78bf2924898061dcddb22a22056aedf9061fd1d63411a7b15aac06a7d6502c9f77faf19967f15b304c391f4d6c4d22cfe8cc876c4805
SSDEEP 3072:VBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:/b3TfLAUa3lLNngoqRttA79
TLSH
T1A734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnkidavtn.exe

Path C:\Temp\i_vtnkidavtn.exe
Size 243KB
SHA256 26b3c7b20f2f4c085f8c8b3179502476480f1d05c405f48f20f833c2ff1ae7fc
MD5 f713dc9c06587428414099869080936f
SHA1 a858b2c13f10a7a69a2987fb0dc92e5b2b068fa5
SHA512 9f1b08b23478440f6faf7c6d8d978acd8527aafa9273f164ad98ac4d88faa63e218a21cba8d09478bb3b6e892e0dc739520fea973ea1fe6b99f245447b6bfce2
SSDEEP 3072:HBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:hb3TfLAUa3lLNngoqRttA7j
TLSH
T14F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zupmhfzxrm.exe

Path C:\Temp\i_zupmhfzxrm.exe
Size 243KB
SHA256 8f9a8f0eadb9949c0d2ee9f130b9d0d1c90cd2a4b7c38518b7a62d58ac3ba46d
MD5 8f1eabb8afa7cdebde92b3e65f48964e
SHA1 578ba7392a4f7d7bf65517530028ef5dc895c190
SHA512 65c4668e90d3b88fc6b67977a5d55707c72708241fa218897dae6692a9c461a49008b660efddecd65d3a24ad28c29dff537cab6fba18b767f3707bb2395bca91
SSDEEP 3072:xBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:zb3TfLAUa3lLNngoqRttA7V
TLSH
T15D344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwrpjhe.exe

Path C:\Temp\jhbzwrpjhe.exe
Size 243KB
SHA256 cff61112e7f33eec4fac883a2b65b874437ddcce277bf38f1a74eef0270b0420
MD5 f4a8dd7f24414f4e7d3ec9b1bd35bec9
SHA1 b5405ec677d59e8c4cb4b0cfad6dda56f0f38091
SHA512 63bd14432cb232fae41ffc917044e844ddd299d6f8f0362b5b808891736123ca5b2cc2bc90ceb4358b1a75d6eb526359a24dc283165d82d43b558304730a9ff2
SSDEEP 3072:TBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:lb3TfLAUa3lLNngoqRttA7z
TLSH
T16234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqniga.sys

Path C:\Temp\lgdyvqniga.sys
Size 141KB
SHA256 1f43703204afb82485858aa156dcdbe444eceecbe888468b5e80475b35ff07af
MD5 fa61e476acd24fb9805a041c2995fe54
SHA1 0c04d077f8275c8660b15cd02f052219a44d0802
SHA512 9539941fcf47ad7a09b5dad000b297fc0959bb898d8a70961453524c6fe6c7391b55ec4c64e6ffa5da90c439d42a0a33e2152de2ad88e58240cd9c90b08f2baa
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlth:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljhbztroj.exe

Path C:\Temp\rljhbztroj.exe
Size 243KB
SHA256 216cb6986adf10f644e38b144d0877592c0f0b81b59236ea37af02a6579c95bf
MD5 38155d7013d61fae805768da6dfa9031
SHA1 bc0e9863de83738dbba738034f0dec588b01a46f
SHA512 a800ebd514cb35ae71020b0bc16996e15cbe398bd87d3e14e49f53fa40f53a9e412ba497025fffb3b8d23bc11ce41dd41fa74e838488e06a5b9590b957591c54
SSDEEP 3072:aBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:yb3TfLAUa3lLNngoqRttA7C
TLSH
T1AC34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnkidavtn.exe

Path C:\Temp\vtnkidavtn.exe
Size 243KB
SHA256 f62988b3228b238dc0921e96bf400b215de0c89a7fe74d6211eb35452217d69a
MD5 c98ab1b83f9a3a23a410f9f0462396af
SHA1 1cd5be01fdc681ad86b35b1a05d1d3e239d4eefc
SHA512 172a73a9af282c7efcbf163e9b34270b0e7738b69befafd38bd259728124742546311d50b58f0286c108b7e19dda03bee2d9275b37efa1f7d6101239aef1bf8c
SSDEEP 3072:WBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:2b3TfLAUa3lLNngoqRttA7G
TLSH
T19234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.sys

Path C:\Temp\xvpnifaysq.sys
Size 141KB
SHA256 674ad298056024411f0f46c32b7bd3a819a58b814d107759d633e124140196b6
MD5 21e4aa224b6b0d1bd01bf11f48c24f0e
SHA1 3edb3af983765317b8d3007bf5e6b77ef02d6d3d
SHA512 d8a5d8c1373ae261debd3ab475593243783893098007d34abc7aed1ce8ab96407c7a58b03faca808d5a7b78c2aa24bbe1b3b804ec49a2bc9a4f7e25bef6e843b
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zupmhfzxrm.exe

Path C:\Temp\zupmhfzxrm.exe
Size 243KB
SHA256 d00fa8d4e7e12290fb5f4c53e7982d8060353f1befe4e201567000ab5e2dbfca
MD5 fa25bc104dd8dc47374094f7704a28c3
SHA1 3f9a29c7173e468248f841d87a14499f01c6f974
SHA512 524bc245ff55d6ff68944cc75d39aad3216ee4f8f1a812d0c8f6ab3bdaf3b7391d5a6877d474f8e41e9390d757dc3a88869452902da1a6debf57df6cc5e3ed97
SSDEEP 3072:YBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:ob3TfLAUa3lLNngoqRttA7I
TLSH
T164344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwuo.sys

Path C:\Temp\zusmkecwuo.sys
Size 141KB
SHA256 02f6d6def08b6c43266fc91b088af4b9e3df212a6f53cbaedaa133c36c825dea
MD5 ca0d8c5ac057a7e7303ab1f5063861e7
SHA1 c4fb54b7ecc01b8b849c0dadca2810c7e4333818
SHA512 22c8b32bff43ab15aefe1abd8d34ac65b291246dae231855cfe0985ddd229983b133e641fd6750a02580096190044777a88e702c35acba4ed07d5b42de7fee7d
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c6ba92b7ecf07d3ec366fd814dcef326d9e1166c59707ca5314c43f7b809b8fb
MD5 b54af06d396e708ee14b874cc687e195
SHA1 3fbb93a8f41fc4b6f3b882449c7388f2a5554366
SHA512 bd13a8123ab672f34b5f86bbc36188ff706e1f9611eb21073cc1da511f6afdd0b845d2b8dec7c9a40ca3d1d8f292b08ef1f3948a2c6c484d9f1e33bb9feb21a2
TLSH
T15161FB95859080E0CBA85C33D2F6118B3F7455B35983FE2204F7F57A9B4AF205BE9448
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596047.TMP
Size 3KB
SHA256 df49a051e093ba1ae1bb0c3dd07e1a36e1a2701f9c809571013ca8d33f8fe825
MD5 125cdc6511cc637d5eb2e6fb9ba19cc1
SHA1 3443229cf4cd948885b5d3514b0d8a175514e422
SHA512 a10e6508f385a039d71b196d56e0bc5fc00a4ce8c1e42c0fcffb8a40df509757d6b06d9e77705cd3efc85d5f66e7df1a11366ab7c2ca82407490bcbf578de894
TLSH
T19061FB95869080E0CBB85C33D2F5118F3F7556B35983FE2204F7F57A9B4AB205BE9448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 72c1ed3c5e7668db0ce0ac2ed07f23196c737f7edc8d40ad9decf72d664fc203
MD5 16574b208873bab3bbe72f8e5804b82e
SHA1 306b62c2f8726d28c77015e6d4635275cb85ea1a
SHA512 299c08e85480f891d38724c8566637ac5377c3d74f3cbb5df67ec65280f009b59c02f2553be87e8518ebbb2593920e37f4ba687f5233d9fe685046c5b06e1d73
TLSH
T1F951AFF3C3E8866E890156F0AB186E2BCE2D0914832C3D5AC9E49F5B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f2aefb3fdcca7612418af4a71bf536679dc3038a5f5ebc804ae538d65eb56acb
MD5 4e09b5235292224909f8def385a50220
SHA1 84157f6260ee843c97347bb5569a26b9a55c6414
SHA512 12399218d912a48fc49ed7c1613d02aa67799e72e1aecc7296f3a83a84d0c70d960bd05e04472ffb522b5161863c1ab868800de536952cc36dbe3f70b6b888ea
SSDEEP 192:sxRkRACj/f61spwfZQJSzoA8p9S/g6+WNCtr/YlacRXGZIgDn3J:sxRkFj/f61syBefI/50/V1
TLSH
T12F42B655BE68A97F8CD7D619FB657B53D2F91032A0D11E4CA6FC8A1C04EA6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4a49922d1af13686e16e01e3a03e399c03c4d1c3e29c9c4740dd7bb53fb3b0d7
MD5 e748489dfa44833993be6c2fb2771347
SHA1 3d86df1ed9849b661ff0ff8abde4850d93a0b820
SHA512 23ab4abd3438addeba80f867a45fa49031b7d4f5f3a84300108a0362388aff916408c89840061470072afff3840f4d35fb0764dc5753812a3e5cb7c9ade5e856
SSDEEP 192:sxRkRACj/f61sbwfZQJSzoA8p9S/g6+WNCtr/YlacnXGZIgDl3J:sxRkFj/f61sUBefI/50/x7
TLSH
T17A42C655BE68A97F8CC7D619FB657B53D2F91032A0911E48A7FC8A1C04EA6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 39b03c9249cad7a0e37b58b1bc4a744e419f9e7e39db34bb544dea850fa2c2ed
MD5 20936261eed71978d42fb078e3abe3f6
SHA1 2537dc18efdf83fd1a75695cc004d0b3cb094a9b
SHA512 ca0f6747b18a391d0639ed8cf46525469cdc293f6b3771f6786aefb623467be7d55c02279632daa979978d1b1643f137794e573a54e46f1ba07e2be70ba62d17
SSDEEP 192:sxRrRACj/f61sDwfZQJSzoA8p9S/g6+WNCtr/YlacRXGZIgV3J:sxRrFj/f61s8BefI/50/V/
TLSH
T19D32C655BE68A97F8CD7D61DFB257B53D2F91032A0D51E48A6FC8A1C04EA6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 09be47f16484100603063b51155916414590d62f45453aeef24345d467e5b5fc
MD5 ec984c9d13681c97bcfd91d450e09f22
SHA1 8f7c9325103c73cd2b6e5bd7b0e12ef1c725d2f8
SHA512 776c36be0fa736d97a567584395d8c4e5af75d540f7e535b8b34e6b2a26cb091a28801add28040df88a56f6e38460e332bceec4f7e271a987bca7dfe45d4a1b4
SSDEEP 768:ksRdfG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVT+2+gxroe2Ji3:ksRdfmEb0JWgSwffTu1jaKT+rgKe2QHX
TLSH
T145D2D87B680CCB7E4F804ADDD8197A9B6DAC02CB9698CD8047FE885D02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce0d0c9c-3e7b-479a-9530-473bc24676e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ce0d0c9c-3e7b-479a-9530-473bc24676e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 16edc0d017c2f2a88ca198e560ea5662b7e1e339287aadf9fe2b825052fb3ba1
MD5 961d842ad9cd4e0aa5084544e767f3af
SHA1 195cbadeb8f1d2b023c0db7166cb6d34e89cc1b3
SHA512 2f8324fbc9f264d2e5745f359603dea80373a9bbc3311281c2b57bdc691a8325c77e851cfd26fb106139cd95e65d22e4c0e75be3df68940f825135fb8b8c403e
SSDEEP 768:o/UxvxjgC+yR3plMYSFajUTut+nqMwQi5BgK5/CwYcZfQJ:1Zj3+G3plhcVmBg8/d9QJ
TLSH
T16803BF31A8B59DB34CFA9144B68667D7EFF425A3C4850CAC89EE5E0E0687A9D130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8ddad73b866f3592327a25c98d597b40d88ea17a1858c2f1a9fcbdfdcad5d0ec
MD5 40000ab61f363c917f0fa7c1e3d5d0da
SHA1 f17f7677487a2cb40f87215e6b1f4b0ca13e635d
SHA512 f89954b0d00c86461da6dfe0c9e5d8103b5504113ea1974c1ca9e4633146b723adfd302176a78db7ca6b4cdb84225a1c2ac9c9f5af0f7c93654e4bf3051a562e
SSDEEP 768:O/UxvxjgC+Ft3xJESFajU6nqMwQi5BgK5/CwYclQA8Dea:DZj3+Ft3xmhVmBg8/dyA8Sa
TLSH
T14E03C036ECF49D778CFA8250774A638BEFF451A3C584099885ED2E0E06D79AC5307C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5258d046413bd323b4159f79746dd7a3ca69dfff25155ede82c202f8f0de9963
MD5 8ce97e74aaa0b7a6422a69aebc27cbc5
SHA1 f90e4c8f15baf15a3678ae1e649d47f0448b012c
SHA512 fbbed04a64787134e089d57c4f81fc816183f462a54f2a1f60c5c0852ed8f845449f90cedb79f7800b3d890a383c1e51187d463072f69b7f647ad1d2d5773337
SSDEEP 768:PBR3pmXYSFajUTutSnqMwQi5BgK5/CwYcZf2s/93:Pv3pmU8VmBg8/d92s13
TLSH
T1A3F2AD31E8B58DB75CFE9144F2867787AFF421A3D8990958C4EE9A0E0587A9E130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 680f12e1f7aded7e1a24962f75a204895e31dffe2c94a0d4d4cb922311cd18d8
MD5 011f9e2e99be4ad014284398722a5729
SHA1 d008ebecbf2e636ffdb295a6963f6263f54e6af7
SHA512 31a1ea8c83365f4dbcade5d57b2fa13abfce5b48c9e6844c8400e4197fce4de23b985840eea31df72df8ad4340e118d0a3cae803bfbe572599d54d7d6eb50b61
SSDEEP 768:bFQyR3pZwg8qYglajUTutqwnqMwQi5BgK5/CwYcZf2s/93:uG3pUzIwVmBg8/d92s13
TLSH
T1D21328F198E3897BD8AE4783A37D6E469EBCD163B4884484B7C95D4DCC825BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f810e52f600ffd2456ca8b939512e108a2fd8ea3ac6e60268c8272c611e8d3ff
MD5 eb5ed5c9f42de2fe3bc5a7147a0b8b3c
SHA1 d4098db7ce630f2ecf3b99836bcfa6045038dd5a
SHA512 6ce6ccdfd86a4d6ea2091a75a37a2b890135cb59a012a25eafac3b654fb74e5c53104b9bcda8a3ecc04ff775d776853b9da56e786406a3ad1cd0f5a52a6fb8d6
SSDEEP 768:YBR3plXYSFajUTutSnqMwQi5BgK5/CwYcZf2s/93:Yv3plU8VmBg8/d92s13
TLSH
T171F2AD31ECB58DB75CFE8144F6867787AFF421A3D8990958C4EE9A0E0587A9E130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

9532a1f9-b7f2-4974-9c80-93be9f5acfbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9532a1f9-b7f2-4974-9c80-93be9f5acfbf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5112_1123244510\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1232-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2972-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3096-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3096-356-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3412-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-256-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4328-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4328-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5428-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download