32b1116971f803aa4ee879d7e31e17f2c330485c163ebf11e82fe97ca295869c

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe
Size 243KB
Sample260719-2gpgbses7k
SHA256 32b1116971f803aa4ee879d7e31e17f2c330485c163ebf11e82fe97ca295869c
MD5 5b3bd0dff41d3154d98177e19fd2c8a1
SHA1 58095c4d1311123ee0558755e38b505b6c1e4ee2
SHA512 def7f48b55cf13554cbdadd1e5472fac4b1c9c85a7db04d542ffe014f7cf782a8f04737e394bf73a59c21df8f8bc99c1e04f7c4794b848876a5c21b2ebf73134
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:ZXP7LQMa3lLNngoqRttA7i
TLSH
T13E345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2752	CP.exe
2972	faxsqkidxs.exe
5872	CP.exe
2292	CP.exe
5084	i_faxsqkidxs.exe
2408	khfaxspkhc.sys
1992	CP.exe
2388	ecausmkecx.exe
2984	CP.exe
760	CP.exe
2040	i_ecausmkecx.exe
3744	ecxupmkhcz.sys
4088	CP.exe
6012	wurpjhecwu.exe
5944	CP.exe
920	CP.exe
6004	i_wurpjhecwu.exe
4956	pmhbzxrmje.sys
4984	CP.exe
1184	mhezxrpjhb.exe
568	CP.exe
5132	CP.exe
5012	i_mhezxrpjhb.exe
1428	jebztrljgb.sys
5516	CP.exe
956	ebwqojhbzt.exe
6132	CP.exe
1988	CP.exe
4028	i_ebwqojhbzt.exe
4312	gbytrljgay.sys
1728	CP.exe
4700	bywqligbyt.exe
5256	CP.exe
3140	CP.exe
4344	i_bywqligbyt.exe
2720	lgeywqoigb.sys
5484	CP.exe
2680	xvtnlfayvq.exe
2812	CP.exe
3268	CP.exe
4284	i_xvtnlfayvq.exe
2268	avsnlidavt.sys
2340	CP.exe
2900	ysqnidaysq.exe
2928	CP.exe
4184	CP.exe
4148	i_ysqnidaysq.exe
3744	xvpnlfdaus.sys
3008	CP.exe
5624	sqkfcxvpnh.exe
1236	CP.exe
3920	CP.exe
1524	i_sqkfcxvpnh.exe
4112	khfzxvpnhf.sys
4040	CP.exe
2808	fcxvpnhfzx.exe
4500	CP.exe
4756	CP.exe
5916	i_fcxvpnhfzx.exe
6128	hfcxupnhfz.sys
5364	CP.exe
4320	urpjhecwus.exe
2456	CP.exe
3664	CP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtromgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfcav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkidxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwqojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwqojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqligbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfcav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqligbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnidaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtromgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkidxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2432	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5444	ipconfig.exe
2424	ipconfig.exe
5560	ipconfig.exe
2656	ipconfig.exe
5144	ipconfig.exe
3560	ipconfig.exe
4592	ipconfig.exe
476	ipconfig.exe
4768	ipconfig.exe
1164	ipconfig.exe
5384	ipconfig.exe
3104	ipconfig.exe
1228	ipconfig.exe
5668	ipconfig.exe
2152	ipconfig.exe
2700	ipconfig.exe
3400	ipconfig.exe
2044	ipconfig.exe
3716	ipconfig.exe
3248	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289740110479640"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1FE5007E-DAF3-482C-96B8-D0F175DBCD10}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	i_faxsqkidxs.exe
Token: SeDebugPrivilege	2040	i_ecausmkecx.exe
Token: SeDebugPrivilege	6004	i_wurpjhecwu.exe
Token: SeDebugPrivilege	5012	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	4028	i_ebwqojhbzt.exe
Token: SeDebugPrivilege	4344	i_bywqligbyt.exe
Token: SeDebugPrivilege	4284	i_xvtnlfayvq.exe
Token: SeDebugPrivilege	4148	i_ysqnidaysq.exe
Token: SeDebugPrivilege	1524	i_sqkfcxvpnh.exe
Token: SeDebugPrivilege	5916	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	672	i_urpjhecwus.exe
Token: SeDebugPrivilege	4068	i_hbzurmjecw.exe
Token: SeDebugPrivilege	4216	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	5048	i_dbvtromgdy.exe
Token: SeDebugPrivilege	4472	i_igaywqoidb.exe
Token: SeDebugPrivilege	4104	i_cavsnlfcav.exe
Token: SeDebugPrivilege	4800	i_xusmkhfcxu.exe
Token: SeDebugPrivilege	3912	i_upnhfzxrpm.exe
Token: SeDebugPrivilege	5288	i_zwuomhezxr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 3536	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	88
PID 3536 wrote to memory of 3540	3536	iexplore.exe	89
PID 3540 wrote to memory of 1732	3540	msedge.exe	90
PID 3540 wrote to memory of 2432	3540	msedge.exe	91
PID 3540 wrote to memory of 1840	3540	msedge.exe	92
PID 3540 wrote to memory of 1840	3540	msedge.exe	92
PID 3540 wrote to memory of 1840	3540	msedge.exe	92
PID 3540 wrote to memory of 5052	3540	msedge.exe	96
PID 3540 wrote to memory of 5024	3540	msedge.exe	95
PID 3540 wrote to memory of 5052	3540	msedge.exe	96
PID 3540 wrote to memory of 5052	3540	msedge.exe	96
PID 3540 wrote to memory of 5024	3540	msedge.exe	95
PID 3540 wrote to memory of 5024	3540	msedge.exe	95
PID 3540 wrote to memory of 2464	3540	msedge.exe	94
PID 3540 wrote to memory of 2464	3540	msedge.exe	94
PID 3540 wrote to memory of 4808	3540	msedge.exe	97
PID 3540 wrote to memory of 4808	3540	msedge.exe	97
PID 3540 wrote to memory of 4808	3540	msedge.exe	97
PID 3540 wrote to memory of 4084	3540	msedge.exe	98
PID 3540 wrote to memory of 4084	3540	msedge.exe	98
PID 3540 wrote to memory of 4084	3540	msedge.exe	98
PID 3540 wrote to memory of 2132	3540	msedge.exe	100
PID 3540 wrote to memory of 2132	3540	msedge.exe	100
PID 1012 wrote to memory of 2752	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	101
PID 3540 wrote to memory of 2956	3540	msedge.exe	104
PID 3540 wrote to memory of 2956	3540	msedge.exe	104
PID 3540 wrote to memory of 1152	3540	msedge.exe	105
PID 3540 wrote to memory of 1152	3540	msedge.exe	105
PID 2972 wrote to memory of 5872	2972	faxsqkidxs.exe	106
PID 3540 wrote to memory of 4592	3540	msedge.exe	110
PID 3540 wrote to memory of 5944	3540	msedge.exe	111
PID 3540 wrote to memory of 5944	3540	msedge.exe	111
PID 3540 wrote to memory of 5304	3540	msedge.exe	112
PID 3540 wrote to memory of 5304	3540	msedge.exe	112
PID 1012 wrote to memory of 2292	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	116
PID 1012 wrote to memory of 1992	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	120
PID 2388 wrote to memory of 2984	2388	ecausmkecx.exe	122
PID 1012 wrote to memory of 760	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	125
PID 1012 wrote to memory of 4088	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	129
PID 6012 wrote to memory of 5944	6012	wurpjhecwu.exe	131
PID 1012 wrote to memory of 920	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	134
PID 1012 wrote to memory of 4984	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	138
PID 1184 wrote to memory of 568	1184	mhezxrpjhb.exe	140
PID 1012 wrote to memory of 5132	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	143
PID 3540 wrote to memory of 5208	3540	msedge.exe	146
PID 3540 wrote to memory of 1308	3540	msedge.exe	147
PID 3540 wrote to memory of 1904	3540	msedge.exe	149
PID 1012 wrote to memory of 5516	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	151
PID 956 wrote to memory of 6132	956	ebwqojhbzt.exe	153
PID 1012 wrote to memory of 1988	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	156
PID 1012 wrote to memory of 1728	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	160
PID 4700 wrote to memory of 5256	4700	bywqligbyt.exe	162
PID 1012 wrote to memory of 3140	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	165
PID 1012 wrote to memory of 5484	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	169
PID 2680 wrote to memory of 2812	2680	xvtnlfayvq.exe	171
PID 1012 wrote to memory of 3268	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	174
PID 1012 wrote to memory of 2340	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	178
PID 2900 wrote to memory of 2928	2900	ysqnidaysq.exe	180
PID 1012 wrote to memory of 4184	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	183
PID 3540 wrote to memory of 4232	3540	msedge.exe	185
PID 3540 wrote to memory of 4232	3540	msedge.exe	185
PID 1012 wrote to memory of 3008	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	191
PID 5624 wrote to memory of 1236	5624	sqkfcxvpnh.exe	193
PID 1012 wrote to memory of 3920	1012	2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_5b3bd0dff41d3154d98177e19fd2c8a1_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc12a0c188,0x7ffc12a0c194,0x7ffc12a0c1a0
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,9488714440705816358,7402381061064609412,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,3073387914931352187,5744940347564736282,262144 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,5877680325342741420,159942402678065548,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,4097917927236803302,2024392449057086759,2097152 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13427770921497726902,5065779933830731861,2097152 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10496547620252894911,7479868800409471496,2097152 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,14737405649952536586,10379709994034643494,2097152 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,4704731877164056118,7714906061493178764,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3319529911763447631,1176982401255319501,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,11610820361956114704,6356568888300505887,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17434572603961672199,1831645719314006874,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17434572603961672199,1831645719314006874,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,3436439675772617246,5418402004258871339,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2069583689797961976,8754966312125112371,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,244542655569973881,13433175801998089785,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,1108844545533410278,12382315630484293154,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,481320369923058780,12183927054756750348,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,10383455407717616566,13433335224229751287,524288 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5852,i,17779684875650271994,643014042239193539,262144 --field-trial-handle=2244,i,9242026678719115056,17116150107347805632,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkidxs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2752
- - C:\Temp\faxsqkidxs.exe
    C:\Temp\faxsqkidxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkidxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2292
- - C:\Temp\i_faxsqkidxs.exe
    C:\Temp\i_faxsqkidxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\ecausmkecx.exe
    C:\Temp\ecausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:760
- - C:\Temp\i_ecausmkecx.exe
    C:\Temp\i_ecausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurpjhecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4088
- - C:\Temp\wurpjhecwu.exe
    C:\Temp\wurpjhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurpjhecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:920
- - C:\Temp\i_wurpjhecwu.exe
    C:\Temp\i_wurpjhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5132
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwqojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5516
- - C:\Temp\ebwqojhbzt.exe
    C:\Temp\ebwqojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwqojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\i_ebwqojhbzt.exe
    C:\Temp\i_ebwqojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqligbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1728
- - C:\Temp\bywqligbyt.exe
    C:\Temp\bywqligbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqligbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3140
- - C:\Temp\i_bywqligbyt.exe
    C:\Temp\i_bywqligbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtnlfayvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Temp\xvtnlfayvq.exe
    C:\Temp\xvtnlfayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtnlfayvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3268
- - C:\Temp\i_xvtnlfayvq.exe
    C:\Temp\i_xvtnlfayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqnidaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2340
- - C:\Temp\ysqnidaysq.exe
    C:\Temp\ysqnidaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqnidaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\i_ysqnidaysq.exe
    C:\Temp\i_ysqnidaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkfcxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\sqkfcxvpnh.exe
    C:\Temp\sqkfcxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkfcxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3920
- - C:\Temp\i_sqkfcxvpnh.exe
    C:\Temp\i_sqkfcxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4040
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhecwus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Temp\urpjhecwus.exe
    C:\Temp\urpjhecwus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhecwus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\i_urpjhecwus.exe
    C:\Temp\i_urpjhecwus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmjecw.exe ups_run
  2⤵
  PID:2188
- - C:\Temp\hbzurmjecw.exe
    C:\Temp\hbzurmjecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmjecw.exe ups_ins
  2⤵
  PID:2816
- - C:\Temp\i_hbzurmjecw.exe
    C:\Temp\i_hbzurmjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:1916
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:556
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtromgdy.exe ups_run
  2⤵
  PID:2056
- - C:\Temp\dbvtromgdy.exe
    C:\Temp\dbvtromgdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtromgdy.exe ups_ins
  2⤵
  PID:756
- - C:\Temp\i_dbvtromgdy.exe
    C:\Temp\i_dbvtromgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqoidb.exe ups_run
  2⤵
  PID:3800
- - C:\Temp\igaywqoidb.exe
    C:\Temp\igaywqoidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqoidb.exe ups_ins
  2⤵
  PID:3028
- - C:\Temp\i_igaywqoidb.exe
    C:\Temp\i_igaywqoidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlgdyv.exe ups_run
  2⤵
  PID:3764
- - C:\Temp\dbvtnlgdyv.exe
    C:\Temp\dbvtnlgdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins
  2⤵
  PID:2108
- - C:\Temp\i_dbvtnlgdyv.exe
    C:\Temp\i_dbvtnlgdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfcav.exe ups_run
  2⤵
  PID:1424
- - C:\Temp\cavsnlfcav.exe
    C:\Temp\cavsnlfcav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnlfcav.exe ups_ins
  2⤵
  PID:4464
- - C:\Temp\i_cavsnlfcav.exe
    C:\Temp\i_cavsnlfcav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkhfcxu.exe ups_run
  2⤵
  PID:1240
- - C:\Temp\xusmkhfcxu.exe
    C:\Temp\xusmkhfcxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkhfcxu.exe ups_ins
  2⤵
  PID:3848
- - C:\Temp\i_xusmkhfcxu.exe
    C:\Temp\i_xusmkhfcxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxrpm.exe ups_run
  2⤵
  PID:3600
- - C:\Temp\upnhfzxrpm.exe
    C:\Temp\upnhfzxrpm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxrpm.exe ups_ins
  2⤵
  PID:1248
- - C:\Temp\i_upnhfzxrpm.exe
    C:\Temp\i_upnhfzxrpm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomhezxr.exe ups_run
  2⤵
  PID:5608
- - C:\Temp\zwuomhezxr.exe
    C:\Temp\zwuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomhezxr.exe ups_ins
  2⤵
  PID:4392
- - C:\Temp\i_zwuomhezxr.exe
    C:\Temp\i_zwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2424

C:\Temp\khfaxspkhc.sys
C:\Temp\khfaxspkhc.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\ecxupmkhcz.sys
C:\Temp\ecxupmkhcz.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\pmhbzxrmje.sys
C:\Temp\pmhbzxrmje.sys
1⤵
- Executes dropped EXE
PID:4956

C:\Temp\jebztrljgb.sys
C:\Temp\jebztrljgb.sys
1⤵
- Executes dropped EXE
PID:1428

C:\Temp\gbytrljgay.sys
C:\Temp\gbytrljgay.sys
1⤵
- Executes dropped EXE
PID:4312

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\avsnlidavt.sys
C:\Temp\avsnlidavt.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\xvpnlfdaus.sys
C:\Temp\xvpnlfdaus.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\khfzxvpnhf.sys
C:\Temp\khfzxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\hfcxupnhfz.sys
C:\Temp\hfcxupnhfz.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\hbzurpmhfz.sys
C:\Temp\hbzurpmhfz.sys
1⤵
PID:5660

C:\Temp\jecwuomgey.sys
C:\Temp\jecwuomgey.sys
1⤵
PID:620

C:\Temp\dbwtolgebv.sys
C:\Temp\dbwtolgebv.sys
1⤵
PID:4464

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:4408

C:\Temp\ifdyvqligd.sys
C:\Temp\ifdyvqligd.sys
1⤵
PID:672

C:\Temp\cxvpnhfzxv.sys
C:\Temp\cxvpnhfzxv.sys
1⤵
PID:5904

C:\Temp\fzxvpnhfzx.sys
C:\Temp\fzxvpnhfzx.sys
1⤵
PID:2484

C:\Temp\zxupmhezxu.sys
C:\Temp\zxupmhezxu.sys
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqligbyt.exe

Path C:\Temp\bywqligbyt.exe
Size 243KB
SHA256 814290af23ad6ed0c3006c28a75fd755b34570a323c9fe6e12f11f4e11ac8168
MD5 84bd272eb9fff98a918e616492623ed9
SHA1 3fcec5243e2b6719afc194434c6025590c08c200
SHA512 a4bb9e186e41ad6753f3232c40196dc32a95c6eea85e59d3099e05f0f48b5f43a6446e6a09287ff5cbfc6f0aaae24f8a83bdcea3630e14abf1ab75ee8c7aa83e
SSDEEP 3072:eVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:OXP7LQMa3lLNngoqRttA7X
TLSH
T15E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwqojhbzt.exe

Path C:\Temp\ebwqojhbzt.exe
Size 243KB
SHA256 6c89e393ab422a8695eb7cf2fd30eff0018c8b42175b939944fef357a936f881
MD5 be62996670dc9577fbe9b12ce9c1ebc8
SHA1 a8f972909b86f7eb05d66af97ddafef3b9d66a40
SHA512 584bbdb92e2a739b9b4a6d71c559031ddd1df425b5cc7aea3d927ccbc46aa1bee244bbb77248a170407bf36b9f9e386b96f8d6d4e2634c7158521f488965796c
SSDEEP 3072:SVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:SXP7LQMa3lLNngoqRttA7P
TLSH
T174345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecausmkecx.exe

Path C:\Temp\ecausmkecx.exe
Size 243KB
SHA256 3f2a2f3ebe063539b0c8ed88e698cff839b8a935b3e0c7f8202ee2d49e1dd4dd
MD5 2b440dd47496e0d3cfa51df175d111cf
SHA1 f41b1cc2038d050653ec13539589c6c169c8f159
SHA512 e5272a9f203c1c302c452bd2bd32672c0e581dc74a79fd7c00ad16e23c60d2a61d654a710fc8b7e0f290fa841e0ec3abf11fb61f838514086062985366b8bc91
SSDEEP 3072:IVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:UXP7LQMa3lLNngoqRttA7p
TLSH
T1DD345A0172818031E7560B78046AE7A0467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupmkhcz.sys

Path C:\Temp\ecxupmkhcz.sys
Size 141KB
SHA256 24403c4159b8878ed7580c4828a6a187f46ce35a03ef60e06147577d7d640ff7
MD5 dee4facf969f8adbcdb68739bcbc89aa
SHA1 592b0baea82dd38ec80008b8ed2b378129abe864
SHA512 4bbd232d829ee627359485f1748f222e64dc40165f79681d32837c0b609031d441c146c3fb52ea00a5acc5a416f90940c311f6b69482877e552049550aa93aed
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkidxs.exe

Path C:\Temp\faxsqkidxs.exe
Size 243KB
SHA256 742f31b391aeb1d00bcf04dedea3562f4467caa5842593e455ab48cc9e3fa531
MD5 55e24bf3cebba678d18c4bed1db7b068
SHA1 c2e2fe1a9252b6b4caa0e319d3512cbe679c24ec
SHA512 499aa203ee3663ba8337cdd259089855994ee47bcc7565006abba2193a0a6ec8551acbe4c7138573afa4f1bcff9a7d8f6f3130e148c8866a3e623adfc7e6bbad
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:5XP7LQMa3lLNngoqRttA7m
TLSH
T198345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljgay.sys

Path C:\Temp\gbytrljgay.sys
Size 141KB
SHA256 e11660b31a296ea5bb7731b42f6383068a91c099b62383ca3d44ace6fd5df7a7
MD5 bbff5749a98f7d6c7a9b00d0863762d5
SHA1 1e7b8a5a7924cbe71a805cfcfe522ffa86477cd7
SHA512 faf6dd97706a67ae9409318c276b03f12f2f4a60cf86d94ecc3fcbb25d5c0cc9afcb2cfd1622eda75228bd01c5de7f0b8626739dd9825090bc041d97f34d86b0
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqligbyt.exe

Path C:\Temp\i_bywqligbyt.exe
Size 243KB
SHA256 6e96e41b5ba98d6a8c209c2e449eba6f3506dcd8c2ca1d8aa71efb95090f5d63
MD5 dd70ebf22c9d28c670dc53082f58be3a
SHA1 6e4eef19ed40de4fee99c5dea57a5ac1877605f5
SHA512 90a08f12f74517dde2ea7c5d223e5df8296dd794c8eb72972be9f6abf297be1bff916bd42d0434ea5fc4718a143e8dd031b1356feb56746ce699367a0050e24b
SSDEEP 3072:xVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:jXP7LQMa3lLNngoqRttA7U
TLSH
T143345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwqojhbzt.exe

Path C:\Temp\i_ebwqojhbzt.exe
Size 243KB
SHA256 e4a7f983a3337c21ce84872376b4381cea5cda444f05803d86cc8217e36d61dd
MD5 bd8078c99029505ccb4c3c2b96f013ef
SHA1 8b83899a387de5c2fe4d70ac9dc599085e2c5a43
SHA512 13081043308ff1405119f09bbf5daca4034009000d9932ed545aa3121c6cc596a4b6e924d14272f77da10db144ea25012493ee64f9eb8131f8421d69f654b0ae
SSDEEP 3072:RVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:DXP7LQMa3lLNngoqRttA7o
TLSH
T1BB345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecausmkecx.exe

Path C:\Temp\i_ecausmkecx.exe
Size 243KB
SHA256 8aaece97200b968ec5888e8fc41f231d0857c6df160995043270b950620d8420
MD5 04c8f3a54c573adcaa0141680ebc9972
SHA1 ae65d3ff8fd750da4d3d48cddcc8d3ef7f21dda9
SHA512 8ba2e9f13773e5f2c6bb1af48ba7902b110330f711ac80f5f83330f58e5e9ed46c3e88d4788bf03352aa15fb7a89319aca907ce6b8fba208dd8116e2350a3b73
SSDEEP 3072:AVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:sXP7LQMa3lLNngoqRttA7R
TLSH
T180345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsqkidxs.exe

Path C:\Temp\i_faxsqkidxs.exe
Size 243KB
SHA256 3ab3424c8d3d118bbad8accb866d07fc8d5de07a7e1a9f25adaf6d807b7a4efa
MD5 4be5a097ce9db28c3f37ca4993500721
SHA1 b837794f6c4160abd27c1070f61dc240b65e93d8
SHA512 21932bcedd68d88dce0c3c198acbd0b45ceae81714603959fd93d5ab751bd427dcc87784cff154f3c9eb30fd4661706e5cbe5097cf35c3a09246a6ccdc883c27
SSDEEP 3072:WYVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Ur:WkXP7LQMa3lLNngoqRttA7Ur
TLSH
T1FE345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpjhb.exe

Path C:\Temp\i_mhezxrpjhb.exe
Size 243KB
SHA256 1ea65b7e8d81c6b28c1a76a04f5901c9b07ea25f2604999c6e201c11c36c7228
MD5 e3acbe9759c356ad05705a92526467cb
SHA1 b27099f76fa3f490e6463c2af1d2775f9f0b90b2
SHA512 b9643fd06bcb8ecdc6a9ad1d87e22bece5ec3f9d8cd40469d483a292bf8cc3bac9d1bda8079c9781864bf002c8f1b83c2caf82ce29c7ca083f163b12d1655413
SSDEEP 3072:MVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:oXP7LQMa3lLNngoqRttA7V
TLSH
T16A345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wurpjhecwu.exe

Path C:\Temp\i_wurpjhecwu.exe
Size 243KB
SHA256 ea6f9160de761d672e54cd800110227e1fe0eb842d83266010b1531ceaff15b9
MD5 a1c1b04c91baf9e67f1616c5efb771fb
SHA1 cc0f22f7ece4c7c358cda70d2613ed6ec751d942
SHA512 bcc93dd318ed133a2cef6098b45e311171667d1ebb8777ced97007f204aad54835ed6a59fcef8feabd83792e03c9b51c79919a36b1fa611f893717dd1725b7d5
SSDEEP 3072:FVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:XXP7LQMa3lLNngoqRttA7A
TLSH
T199345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztrljgb.sys

Path C:\Temp\jebztrljgb.sys
Size 141KB
SHA256 25bd03a50cb393b3d33e10c6c55a77f01d8bcada733b602b84f890bf75e5045b
MD5 82997dc52e8290c5577aa07ebdfc9e0a
SHA1 579894fdeb0c01beffb060ed9c2260e739511c34
SHA512 22441c253480addae05d9ba3092be0f3ae4d918fbbb69c08cfa1decc1828570011340829c79b66dacf51baf978131715f0c58b97bb905ffa7e7d9b33e9b9d9cc
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfaxspkhc.sys

Path C:\Temp\khfaxspkhc.sys
Size 141KB
SHA256 4a3d45f7d0f351cece39ad158c0b6c7b17ff4e98cb7b000e727844704cf07446
MD5 3730ec88ffb6097e8852901fc90e7c74
SHA1 9b403d3d7b54623c1c699e123f5ae0cd135847ea
SHA512 e3254679ffd5994c521f0cf21bcaada6c97a4ed14f6a0adde33b9ed502d347e3c27ccdae808c0e3baf2d28ec42116e80ff8477c469ebb0590436628932e764b9
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.sys

Path C:\Temp\lgeywqoigb.sys
Size 141KB
SHA256 87be21b6322c7fbef14e45bd91427095bba6f4254cbf99c0c134469dd474602e
MD5 880da9090180eaeaa9bcf7590558dac7
SHA1 d4966dd0dc668b440fe8fc27e7c51c8453ab6339
SHA512 933649c06866a3348df1654a0e144eb5f815b98fe0ecbb3e20bfa3bef1f8290039da7a01e77abd7b983489de429a58ab8f32e9f343419f82bbeaec31be2d8ae4
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.exe

Path C:\Temp\mhezxrpjhb.exe
Size 243KB
SHA256 79fb2024d2de920e5759f781dff5456d283a8a1aef8d01d3c1c900cdd99e0be2
MD5 e3df654654226233242edf73cb483040
SHA1 343d5454c730093cfe5d1f9208f96e73da19796e
SHA512 e0583fcd04616348977a9de900dda263a686224f5bb1980129d865f504b57d6bd477196614eedbb432ed2d007a63f1b6625d8275fb7aa827ea0d272af1ba963b
SSDEEP 3072:JVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:bXP7LQMa3lLNngoqRttA74
TLSH
T170345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhbzxrmje.sys

Path C:\Temp\pmhbzxrmje.sys
Size 141KB
SHA256 53ad965b1cbee96b7c0ec80ff0ad85d810c556335cb4425a33bd290560aabaab
MD5 23d9e6eb8057ca68c9577916aa18a90d
SHA1 40449a13a4c7fa917e668daf6655d67628901a99
SHA512 933adcc56f01b16ad905df619386357de187bdbb4c6962aea740a5b4f9aec9a8ad32872d63a5f9b00b44388ea3d754f56309852cdb26904e6804cf860c2a0bdc
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T169E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurpjhecwu.exe

Path C:\Temp\wurpjhecwu.exe
Size 243KB
SHA256 531f9e35d93213e87dd875f696b618a8e4ed74dc397537f84919d6736ca7b492
MD5 5e41e09bda96a39991e7ed61a7813df2
SHA1 0641a44b82f41d70366b159d6e99a4537e0ba468
SHA512 d560b5e64975cea128fb89f576be2ee1ed3708b8122650e0477b80bfe845b6fe22a6a5300adcb47ca67068b8584a20aab6f0f48859a7bf08aa93ae0a562cb1e9
SSDEEP 3072:kVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:gXP7LQMa3lLNngoqRttA7Z
TLSH
T175345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 68963ac9c33472c712d808f51ae54dd254eeb7253e30167832b72cf6aab375ca
MD5 2d6899a57c40ce20a38b9a0f345a13fd
SHA1 4a66a777113b375cda9ef130a542aa2d39585a69
SHA512 a02170513ee3fade1eeb0097d920fdf0710d2761aa7d482fac52ba371bfc05eb89d0abc17a2431f4ba036a53a08f8efcbbdafbdde8758b7c31b6967c6fa7e2c6
TLSH
T1DD51CD97472379C3D77AA5B225E30C96BEBC848E05CFAFDF4811B1768A4B3946050631
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a2f00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a2f00.TMP
Size 2KB
SHA256 dbce9782ab66f14b2ecba633013c3f8af397f929a1d98a150a5531d1875182da
MD5 81252cec6b3dd0b878466f65a1a7d959
SHA1 17afff0de9ad0bcac39d26535f401a5a6b4d06c3
SHA512 b842551d6388809f2d38632aceff8937459769f630f10831a503258add80c29a0c76f3270f2b2fa62c2003113cc351d351a0951648c7bda6aab426a74af79d6f
TLSH
T1FF51CD97472379C3D77AA5B225E30C9ABEBC848E05CFAFEF4811B1768E4B3946050631
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b93ff2a4d82b61ddf6d252ebb7195bba44dee165725f101fc1c417ab1c265c36
MD5 bb3eda036bcf5deebb19aa9f301e2054
SHA1 67c8bc929d84dae603c401bbe8be3f39f4fc2715
SHA512 f40bce3c37d53a5410e49fef75c4218979d9a5f0c1ae30e065f13ff74813cb152d8be04186dde1054d2c09ec637273ff249081f69aa7c377d64b551c306bec6b
TLSH
T1DE41BDF7C2E8856E890156F0AA18AE1BCE2D0914832C3D5AC9E4AF1B93F2471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 724098f7c3be7811ccd7c61cff95ff3c1ef9e09e7dae806c9879b9f706414db6
MD5 465edc981d33030e6d9498e5f519def1
SHA1 3adf97cb1bf1319b83ca06f6130213d6b79b86e6
SHA512 f346b14f3db07a58964ec9a415c7afcf656cbc9f912a1a7dc8e7e363fb3f6c091c8afc6146a65c9962bd373702e06495f061f1ef6fd454fa6a6c3bc9fedabb49
SSDEEP 192:sxRzR9CeX/futsXyG5ZHEzoA8p9B/g6+WNCvw/YoYCYFGwIgtJ:sxRzSeX/futsXyGXHlf/5r/f83
TLSH
T15B32C7166D28A93B9CC7D21DBA65BF93D2FD5032A1D02E48A7FC960C11E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 195395aaa03cfbf2bbf61267e74eb6aaf261ed9c77a4a2f02918325968641b0d
MD5 7ad2c01baff58e0616ccfb30e32f6fe6
SHA1 2a4659d934bb6c69613d932f83610b3bdada21f3
SHA512 ef2ec6c4f6166ddddb534d24b509e77a55c7921259c5818dbcec48f8fb029725494debf50e29f57e82871fe17411a9a7762748ff7cde41dfe2a1a6379fb1c0ab
SSDEEP 192:sxRsR9CeX/futsvy15ZHEzoA8p9B/g6+WNCvw/YoDCYFGwIgDFaJ:sxRsSeX/futsvy1XHlf/5r/m8c
TLSH
T10A42C716AD289D3B9CC7E219BA657F93E2F95032A1D11E48A7FC970C11E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b2328897b7ea37b4a57d9056c91cf40f69fccb408a8e6b12a41175070614aaf1
MD5 d6ab690e9f347c801816064a0d6b28fe
SHA1 a79cd8624e0efe1bb297d6b2f0551efffa2798fc
SHA512 716c75608b3c80e41c12703bfc3200e5b0edb3fbe0d87a66d76fbc86ebb4f2766ec298bce043df9b318d3271b96e19c3bb153a2ef2ba32f120756bdcd32085c8
SSDEEP 192:sxRsR9CeX/futsvyG5ZHEzoA8p9B/g6+WNCvw/YoYCYFGwIgDF0J:sxRsSeX/futsvyGXHlf/5r/f8C
TLSH
T1E342B716AD28993B9CC7D21DBA65BF93D6F95032A1D02E48A7FC970C11E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 22dfb5620e8aae56c8f2e241a2a06a7013e31e196deec49a02714f49c8aac4b4
MD5 16ce4e3e22208c2d6abb1883b3be9079
SHA1 d662c311de932180cfc91708288e7e1f243cb5e9
SHA512 035628e7cf8ec7a132dc4f63d30fd47a499e5488b0b05272d4e3fee970ac7fd37167844732bda3778bb35fa1b655c2ea9d71b590e8604a416e2eb88042be558b
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVo5BVuw5ro9De0y:j26HRUE7MRWgs2f02u1jaL5B4wyW1
TLSH
T14FD2EB7B640DCABE4F800ADDEC197EDF6D6802CB9698CD8447FD851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5acaf2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5acaf2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e91b5881288cb10f65b10b74b802d6794c41ffae4368a33fd9f7518327546d88
MD5 c416b630bc2400861331956a1bcaa3e7
SHA1 185f7aa9fc8c5f6f13c045e416ee503f51e574bd
SHA512 c470d7108d708f6b383e526d60a20162a1ba3ffccde0f98ca41387fb05b5dd8659063283cb1881ef583219e4634a584212c8b8f15552183326219cdcff21804c
SSDEEP 768:kj+9c3iHM/TBOW3v9RONXyer1IRCzni9WG+wmAD:z9c3lPRSIqn1G+wtD
TLSH
T1B4F2BE34A4529D130DD2A3D9B20B2393BFF810A7D5C00E54DFDA6F4E06936AE230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 b6771aecd4e704a0436fc73ac64c04d6833869bbd19eb6c3150f89dce47b3876
MD5 d614cd3cc4834cead4182a3d87393da1
SHA1 c8b998557284a5ffd72dd8dac8c72ec072ba1981
SHA512 37a1cdae536a7ef91d3d90d41b957328ca824e3b7491dd9675d619db0b755dc8fbcd5efb34e6cf9247e510e8b18a3c82942ba575144ea2cd8bf743f8c87e69b3
SSDEEP 768:EF1j+9i3zwgoH/VsOW3v9HONXyer1IRCzni9WG+wmAD:J9i3SAHSIqn1G+wtD
TLSH
T1631338F594D38937D89E5787B33E6E42AABCC063B5844994BBC51E4DCC821BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 13dc898788e964f7bc8dcbc5ae9a7d9b53991796d00ac310046c31328d5a760f
MD5 29045fef28b3bbf964627104f44566d7
SHA1 46050da8c43759fda24d53cef4782870e3941942
SHA512 15288dc12a76df73740f9c8924edfd10f07ef02e73c9d9fed6411c40b8c30c8895ec5ea9b996df4bc479a98738738930b0e29d9a0b602cadf35a48a39a856fa4
SSDEEP 768:Sj+9c3sHM/TBOW3v9xONXyer1IRCzni9WG+wmAD:h9c3nPxSIqn1G+wtD
TLSH
T163F2AE34A4529D134DD2A3D9B20B6793BFF81067D5C00E54DFD96F4E069769E230B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26dca90d73f5c2f25e6f6c4e275043dbc5d5aacb3a391780f6909cfa04b18c1b
MD5 8fdfd789f9dc22b5ab4ebc2ac42f86a2
SHA1 70fd074e4d953f21202ce7be7ebdd86e5cbb341e
SHA512 d0e978fb1069572e136492ee5d25e5f4ea94a3ddc22320b12a4ef84b9ff87dff03b5b7ff466749c183814f09cf11bbe1c2b6127333faa9d860b1774c44f943a8
SSDEEP 768:hrv+4UNbdz3U7+/TBOW39ONXyer1IRCzniBQeVH1SK7:hbsbV3tnSIqnzEH1l
TLSH
T15703BF32A4A89E334DE2A3C6B14776137FF85057D6840B90DDDA2F4E069B59D130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

925c055a-f749-4976-8912-80a2d1c84893.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\925c055a-f749-4976-8912-80a2d1c84893.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3540_311551036\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/672-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1428-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2268-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2720-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4408-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4464-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4956-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5660-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6128-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6128-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download