cc6910b49dffcfc22f94775b97fc9a1125d442daa9000f3f74c03bab5031158f

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe
Size 243KB
Sample260815-pltwdswepc
SHA256 cc6910b49dffcfc22f94775b97fc9a1125d442daa9000f3f74c03bab5031158f
MD5 4f36d20e3c6e5902baa402af50d1041f
SHA1 55bf3665341faa9058fadc46a3fb1ef73d0346b1
SHA512 be8b265ef98284880b4ba7a97ecca2f2604301a1a25305727926c206b95acf2024d81979d1d6c01626ecc049b88a4178cefaa0380cc5a7cd508983e3db17d5bc
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:KvMsLaOa3lLNngoqRttA7p
TLSH
T138345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6120	CP.exe
5276	czusmhfaus.exe
3392	CP.exe
2484	CP.exe
872	i_czusmhfaus.exe
3120	czuspkhcau.sys
5516	CP.exe
1188	urpjhezwur.exe
4216	CP.exe
5884	CP.exe
1816	i_urpjhezwur.exe
5232	rpmgecwurm.sys
4088	CP.exe
2380	mgezwrmjhb.exe
1548	CP.exe
4852	CP.exe
5088	i_mgezwrmjhb.exe
2872	gebwtrljdb.sys
2832	CP.exe
1780	jhbzwqomge.exe
1132	CP.exe
3120	CP.exe
3932	i_jhbzwqomge.exe
4000	gbytrljdbv.sys
6052	CP.exe
480	aytqljdbvt.exe
476	CP.exe
4768	CP.exe
5240	i_aytqljdbvt.exe
296	ytqligdyvt.sys
3572	CP.exe
4028	tnigaysqli.exe
5700	CP.exe
5804	CP.exe
6016	i_tnigaysqli.exe
5996	gdyvsnlfdx.sys
2332	CP.exe
4824	idavsnlfdy.exe
2028	CP.exe
3672	CP.exe
5472	i_idavsnlfdy.exe
1752	xvsnkicaxs.sys
3516	CP.exe
3404	vpnlfcxusq.exe
1056	CP.exe
1512	CP.exe
4332	i_vpnlfcxusq.exe
4540	usmkhcausm.sys
3084	CP.exe
5392	nkfcxvpnhc.exe
1176	CP.exe
5684	CP.exe
5088	i_nkfcxvpnhc.exe
872	mkecwurpnh.sys
3036	CP.exe
5376	fcwurmjhfz.exe
1708	CP.exe
1104	CP.exe
2288	i_fcwurmjhfz.exe
1352	smkecwupmh.sys
1692	CP.exe
1720	rmjhbzurmj.exe
4376	CP.exe
5536	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_597415733\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_419143015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_419143015\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnligdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczuspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwurmjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnligdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvqnlfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwurmjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczuspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvqnlfdav.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4648	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5092	ipconfig.exe
2744	ipconfig.exe
5536	ipconfig.exe
796	ipconfig.exe
2852	ipconfig.exe
784	ipconfig.exe
6056	ipconfig.exe
108	ipconfig.exe
3616	ipconfig.exe
3364	ipconfig.exe
2656	ipconfig.exe
5012	ipconfig.exe
3724	ipconfig.exe
1688	ipconfig.exe
5832	ipconfig.exe
4748	ipconfig.exe
1932	ipconfig.exe
2908	ipconfig.exe
5932	ipconfig.exe
5756	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312706837374612"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{557C719A-BCB8-49EE-9E9A-BBC1CB31E178}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	i_czusmhfaus.exe
Token: SeDebugPrivilege	1816	i_urpjhezwur.exe
Token: SeDebugPrivilege	5088	i_mgezwrmjhb.exe
Token: SeDebugPrivilege	3932	i_jhbzwqomge.exe
Token: SeDebugPrivilege	5240	i_aytqljdbvt.exe
Token: SeDebugPrivilege	6016	i_tnigaysqli.exe
Token: SeDebugPrivilege	5472	i_idavsnlfdy.exe
Token: SeDebugPrivilege	4332	i_vpnlfcxusq.exe
Token: SeDebugPrivilege	5088	i_nkfcxvpnhc.exe
Token: SeDebugPrivilege	2288	i_fcwurmjhfz.exe
Token: SeDebugPrivilege	2892	i_rmjhbzurmj.exe
Token: SeDebugPrivilege	5092	i_jebwtrljeb.exe
Token: SeDebugPrivilege	3336	i_bwtolgdywt.exe
Token: SeDebugPrivilege	4668	i_vtnligdyvq.exe
Token: SeDebugPrivilege	4052	i_dbvqnlfdav.exe
Token: SeDebugPrivilege	1428	i_ysqnifdxvs.exe
Token: SeDebugPrivilege	3044	i_nhfaxspkif.exe
Token: SeDebugPrivilege	3208	i_keczuspkhf.exe
Token: SeDebugPrivilege	2576	i_mkhczxupmh.exe
Token: SeDebugPrivilege	1672	i_pjhbzurmje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 4172	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	88
PID 4172 wrote to memory of 2472	4172	iexplore.exe	89
PID 2472 wrote to memory of 2756	2472	msedge.exe	90
PID 2472 wrote to memory of 484	2472	msedge.exe	91
PID 2472 wrote to memory of 4648	2472	msedge.exe	92
PID 2472 wrote to memory of 484	2472	msedge.exe	91
PID 2472 wrote to memory of 484	2472	msedge.exe	91
PID 2472 wrote to memory of 2100	2472	msedge.exe	93
PID 2472 wrote to memory of 2100	2472	msedge.exe	93
PID 2472 wrote to memory of 6056	2472	msedge.exe	96
PID 2472 wrote to memory of 6056	2472	msedge.exe	96
PID 2472 wrote to memory of 2672	2472	msedge.exe	97
PID 2472 wrote to memory of 6056	2472	msedge.exe	96
PID 2472 wrote to memory of 2672	2472	msedge.exe	97
PID 2472 wrote to memory of 2672	2472	msedge.exe	97
PID 2472 wrote to memory of 2804	2472	msedge.exe	98
PID 2472 wrote to memory of 2804	2472	msedge.exe	98
PID 2472 wrote to memory of 2804	2472	msedge.exe	98
PID 2472 wrote to memory of 4068	2472	msedge.exe	99
PID 2472 wrote to memory of 4068	2472	msedge.exe	99
PID 2472 wrote to memory of 4068	2472	msedge.exe	99
PID 2472 wrote to memory of 2896	2472	msedge.exe	100
PID 2472 wrote to memory of 2896	2472	msedge.exe	100
PID 2392 wrote to memory of 6120	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	102
PID 2472 wrote to memory of 1444	2472	msedge.exe	103
PID 2472 wrote to memory of 1444	2472	msedge.exe	103
PID 2472 wrote to memory of 1844	2472	msedge.exe	104
PID 2472 wrote to memory of 1844	2472	msedge.exe	104
PID 5276 wrote to memory of 3392	5276	czusmhfaus.exe	107
PID 2472 wrote to memory of 4596	2472	msedge.exe	111
PID 2472 wrote to memory of 4556	2472	msedge.exe	112
PID 2472 wrote to memory of 4556	2472	msedge.exe	112
PID 2472 wrote to memory of 2332	2472	msedge.exe	115
PID 2472 wrote to memory of 2332	2472	msedge.exe	115
PID 2392 wrote to memory of 2484	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	116
PID 2392 wrote to memory of 5516	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	120
PID 1188 wrote to memory of 4216	1188	urpjhezwur.exe	122
PID 2392 wrote to memory of 5884	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	125
PID 2392 wrote to memory of 4088	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	129
PID 2380 wrote to memory of 1548	2380	mgezwrmjhb.exe	131
PID 2392 wrote to memory of 4852	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	134
PID 2392 wrote to memory of 2832	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	138
PID 1780 wrote to memory of 1132	1780	jhbzwqomge.exe	140
PID 2392 wrote to memory of 3120	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	143
PID 2472 wrote to memory of 4968	2472	msedge.exe	146
PID 2472 wrote to memory of 2996	2472	msedge.exe	147
PID 2472 wrote to memory of 3288	2472	msedge.exe	148
PID 2392 wrote to memory of 6052	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	151
PID 480 wrote to memory of 476	480	aytqljdbvt.exe	153
PID 2392 wrote to memory of 4768	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	156
PID 2392 wrote to memory of 3572	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	160
PID 4028 wrote to memory of 5700	4028	tnigaysqli.exe	162
PID 2392 wrote to memory of 5804	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	165
PID 2392 wrote to memory of 2332	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	169
PID 4824 wrote to memory of 2028	4824	idavsnlfdy.exe	171
PID 2392 wrote to memory of 3672	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	174
PID 2392 wrote to memory of 3516	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	178
PID 3404 wrote to memory of 1056	3404	vpnlfcxusq.exe	180
PID 2392 wrote to memory of 1512	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	183
PID 2472 wrote to memory of 6048	2472	msedge.exe	185
PID 2472 wrote to memory of 6048	2472	msedge.exe	185
PID 2392 wrote to memory of 3084	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	191
PID 5392 wrote to memory of 1176	5392	nkfcxvpnhc.exe	193
PID 2392 wrote to memory of 5684	2392	2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_4f36d20e3c6e5902baa402af50d1041f_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc7bdcc188,0x7ffc7bdcc194,0x7ffc7bdcc1a0
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,2832053258006310928,6508217547243205504,262144 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,1806603934210149709,11834156829111751891,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,14108542573914054950,9120775578157739374,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:13
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,14993992337574300063,44934237368333577,2097152 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13769426243990504849,4140028815696163652,2097152 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,13352347332917464977,3632030575825153270,2097152 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,8759030733233182136,15845783489442594479,2097152 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:9
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,8476874113760851143,10970434965923412321,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,13885017918396238623,7083249064192922339,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,8419352781701704091,10968614856263924699,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15376729652861206396,10868885556027369945,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15376729652861206396,10868885556027369945,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,4071570331298965803,8023219647256243737,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8442408250381212097,10769000917088049146,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,2204527478355290406,4952996612100544747,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,2602981197384298287,13689051870940482091,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,12043428660835433410,10164668027054050697,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,56490315617720641,17650062754382684133,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,15786865622572538384,5447958627262573339,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5344,i,15180136586469985336,3076535911331848734,262144 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,7432262477778676193,17601219849006460058,524288 --field-trial-handle=2232,i,16304771338477413604,14787318063577376049,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:5816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmhfaus.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120
- - C:\Temp\czusmhfaus.exe
    C:\Temp\czusmhfaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmhfaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Temp\i_czusmhfaus.exe
    C:\Temp\i_czusmhfaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhezwur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5516
- - C:\Temp\urpjhezwur.exe
    C:\Temp\urpjhezwur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhezwur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\i_urpjhezwur.exe
    C:\Temp\i_urpjhezwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrmjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4088
- - C:\Temp\mgezwrmjhb.exe
    C:\Temp\mgezwrmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrmjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Temp\i_mgezwrmjhb.exe
    C:\Temp\i_mgezwrmjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzwqomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\jhbzwqomge.exe
    C:\Temp\jhbzwqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzwqomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3120
- - C:\Temp\i_jhbzwqomge.exe
    C:\Temp\i_jhbzwqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\aytqljdbvt.exe
    C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_aytqljdbvt.exe
    C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnigaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3572
- - C:\Temp\tnigaysqli.exe
    C:\Temp\tnigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnigaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5804
- - C:\Temp\i_tnigaysqli.exe
    C:\Temp\i_tnigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavsnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2332
- - C:\Temp\idavsnlfdy.exe
    C:\Temp\idavsnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavsnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3672
- - C:\Temp\i_idavsnlfdy.exe
    C:\Temp\i_idavsnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfcxusq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3516
- - C:\Temp\vpnlfcxusq.exe
    C:\Temp\vpnlfcxusq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfcxusq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\i_vpnlfcxusq.exe
    C:\Temp\i_vpnlfcxusq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3084
- - C:\Temp\nkfcxvpnhc.exe
    C:\Temp\nkfcxvpnhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5684
- - C:\Temp\i_nkfcxvpnhc.exe
    C:\Temp\i_nkfcxvpnhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcwurmjhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\fcwurmjhfz.exe
    C:\Temp\fcwurmjhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcwurmjhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1104
- - C:\Temp\i_fcwurmjhfz.exe
    C:\Temp\i_fcwurmjhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhbzurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Temp\rmjhbzurmj.exe
    C:\Temp\rmjhbzurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhbzurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5536
- - C:\Temp\i_rmjhbzurmj.exe
    C:\Temp\i_rmjhbzurmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtrljeb.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\jebwtrljeb.exe
    C:\Temp\jebwtrljeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtrljeb.exe ups_ins
  2⤵
  PID:616
- - C:\Temp\i_jebwtrljeb.exe
    C:\Temp\i_jebwtrljeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtolgdywt.exe ups_run
  2⤵
  PID:2084
- - C:\Temp\bwtolgdywt.exe
    C:\Temp\bwtolgdywt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtolgdywt.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_bwtolgdywt.exe
    C:\Temp\i_bwtolgdywt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnligdyvq.exe ups_run
  2⤵
  PID:3988
- - C:\Temp\vtnligdyvq.exe
    C:\Temp\vtnligdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnligdyvq.exe ups_ins
  2⤵
  PID:1948
- - C:\Temp\i_vtnligdyvq.exe
    C:\Temp\i_vtnligdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvqnlfdav.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\dbvqnlfdav.exe
    C:\Temp\dbvqnlfdav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvqnlfdav.exe ups_ins
  2⤵
  PID:4732
- - C:\Temp\i_dbvqnlfdav.exe
    C:\Temp\i_dbvqnlfdav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqnifdxvs.exe ups_run
  2⤵
  PID:4036
- - C:\Temp\ysqnifdxvs.exe
    C:\Temp\ysqnifdxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:52
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqnifdxvs.exe ups_ins
  2⤵
  PID:2252
- - C:\Temp\i_ysqnifdxvs.exe
    C:\Temp\i_ysqnifdxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxspkif.exe ups_run
  2⤵
  PID:4592
- - C:\Temp\nhfaxspkif.exe
    C:\Temp\nhfaxspkif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxspkif.exe ups_ins
  2⤵
  PID:1352
- - C:\Temp\i_nhfaxspkif.exe
    C:\Temp\i_nhfaxspkif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczuspkhf.exe ups_run
  2⤵
  PID:2892
- - C:\Temp\keczuspkhf.exe
    C:\Temp\keczuspkhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczuspkhf.exe ups_ins
  2⤵
  PID:6004
- - C:\Temp\i_keczuspkhf.exe
    C:\Temp\i_keczuspkhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczxupmh.exe ups_run
  2⤵
  PID:1480
- - C:\Temp\mkhczxupmh.exe
    C:\Temp\mkhczxupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczxupmh.exe ups_ins
  2⤵
  PID:5080
- - C:\Temp\i_mkhczxupmh.exe
    C:\Temp\i_mkhczxupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmje.exe ups_run
  2⤵
  PID:5964
- - C:\Temp\pjhbzurmje.exe
    C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmje.exe ups_ins
  2⤵
  PID:4600
- - C:\Temp\i_pjhbzurmje.exe
    C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2576

C:\Temp\czuspkhcau.sys
C:\Temp\czuspkhcau.sys
1⤵
- Executes dropped EXE
PID:3120

C:\Temp\rpmgecwurm.sys
C:\Temp\rpmgecwurm.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Temp\gebwtrljdb.sys
C:\Temp\gebwtrljdb.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:4000

C:\Temp\ytqligdyvt.sys
C:\Temp\ytqligdyvt.sys
1⤵
- Executes dropped EXE
PID:296

C:\Temp\gdyvsnlfdx.sys
C:\Temp\gdyvsnlfdx.sys
1⤵
- Executes dropped EXE
PID:5996

C:\Temp\xvsnkicaxs.sys
C:\Temp\xvsnkicaxs.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\usmkhcausm.sys
C:\Temp\usmkhcausm.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\mkecwurpnh.sys
C:\Temp\mkecwurpnh.sys
1⤵
- Executes dropped EXE
PID:872

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
- Executes dropped EXE
PID:1352

C:\Temp\gecwuomjeb.sys
C:\Temp\gecwuomjeb.sys
1⤵
PID:4908

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
PID:2700

C:\Temp\bwtolgdbyw.sys
C:\Temp\bwtolgdbyw.sys
1⤵
PID:1600

C:\Temp\ayvqnlfdyv.sys
C:\Temp\ayvqnlfdyv.sys
1⤵
PID:1064

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
PID:1140

C:\Temp\smkhfdxvsm.sys
C:\Temp\smkhfdxvsm.sys
1⤵
PID:1060

C:\Temp\pmkfcxvpnh.sys
C:\Temp\pmkfcxvpnh.sys
1⤵
PID:5252

C:\Temp\pjhfcxuomh.sys
C:\Temp\pjhfcxuomh.sys
1⤵
PID:2584

C:\Temp\mjebwuomje.sys
C:\Temp\mjebwuomje.sys
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqljdbvt.exe

Path C:\Temp\aytqljdbvt.exe
Size 243KB
SHA256 7a0e24c2e5759d3c9e9fdf38e3150aadb20758899ff86843ae842cd687fc5c2c
MD5 65dd359e2e9cb8ce489209710e7b2ffb
SHA1 c00df4949511f16d6ccb04623d0e4d026653eb9c
SHA512 4038d8b4c2105142f4713c691ca657da0829a5ae040090e30eb5d3544ede4eeaf0573e41b076859b2f4a219f0e7e8a709ca7349b6bbc0501549bc2cca9c46444
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:ivMsLaOa3lLNngoqRttA7V
TLSH
T14C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmhfaus.exe

Path C:\Temp\czusmhfaus.exe
Size 243KB
SHA256 90bcb098e76ea37c5150635e460de6c727466e507d4fb9bad7b9e69554e3c8df
MD5 33f59ee27ec0d5b4fa82b6fafddbbb7b
SHA1 3660b4bdf1eda45588b416db1813f4a1fba5fb70
SHA512 2445e36e29924d1b5fb5e86c70059034920b42f527ddfc2ea2ff28824155740359ef0da570b1713a3aa49f60d8f740210378eccb9276e339997f9ebb56173666
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:qvMsLaOa3lLNngoqRttA75
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czuspkhcau.sys

Path C:\Temp\czuspkhcau.sys
Size 141KB
SHA256 e916725b62c59a815221f40def2c826d0530b197f2f5320b5d58d97e7ef7413f
MD5 74a6c596fb247387ef9d95bc250dfee7
SHA1 0dd5dc197f69fb3421b1531f911403c934e4b592
SHA512 dceff07703205fb6b0d3447de8eba71818f08c6353e70187f726f7854440e1c7b9159dcac863f44a8935d7489978c2fbf6d4de4233720bbca7921644dfe0f5aa
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T139E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 20a07081debbd141b80879a25bc077a97a0a8522b0c7f1179feab3d13c237c42
MD5 3d6860c3f7c50589e8ab47fff47ced14
SHA1 80787d46b8c2062e45ef0cfdcb1b6a38be18d56b
SHA512 3c00e4f3ff2033eab8d3590c821ed0824300aa1e2a23ac4d075a4c7ea22578386788b276e16f70d55bb7efcc75a499182c0ecb65d81cc2db7de827824f08d401
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvsnlfdx.sys

Path C:\Temp\gdyvsnlfdx.sys
Size 141KB
SHA256 152bb7018400cadf4adf5a893f66c037cfbccd943397eae6f487c895aa09f361
MD5 c9272575905060b4abc15adc81446bea
SHA1 e4e1c1be698e74b553da533505983a0048f37976
SHA512 3bc074ddbbd793b0135f6d84f11974ea3ecabae1a7aa1a70d040d74a6b114ecfffa1715192a3f2941fb2eccd8c530488a6658bc41925aede0eb8fe2a98faa4bc
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebwtrljdb.sys

Path C:\Temp\gebwtrljdb.sys
Size 141KB
SHA256 8c183589ed65eaa8494fe2205ee1efc74d31a3c7160d818c877aff9a581f160e
MD5 d3cc297097ca23ed39e0e6fe82c78d2b
SHA1 04291f5a17f93ef95036e1f55a3956ebb87f53cf
SHA512 60d5ba0665ffbe6d49fd2d5cabb35d971de2289fb24137ef421026ea289d3a8469453b477c1066c971353b45b0f0442a6107651038d0ff2cca515d2f28cec59d
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE38D12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqljdbvt.exe

Path C:\Temp\i_aytqljdbvt.exe
Size 243KB
SHA256 a37356932466e9b8976c7ea65133dc7449c1523a3eebbd8581e6156e50449d7b
MD5 c2006a00228b664c8906771854709091
SHA1 a6d8e82ea6b8ba0fcab2748e51a72bdb8b39d0c9
SHA512 88343eb9e0e19db8066a014296abc5602a25bd3ad555f60c6a8b74d5225ab3f5fb252b7b1d29fd473c883bb76e746c4066fa28b135d08fc506f821b6e0567824
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:9vMsLaOa3lLNngoqRttA7A
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czusmhfaus.exe

Path C:\Temp\i_czusmhfaus.exe
Size 243KB
SHA256 ca6086c3f805ed916b4899c9a3e81252756cb2ade048792faa21f86f1322fecd
MD5 60603e463585e0c7b9dc2b9da27d95f8
SHA1 2e51c2af0fe13341312c9205426bac3b25450e39
SHA512 f9aaa83a8f9aef467da1ba6d46ed2bc78e5d08f3122eb4ac9f14d31b46b42b594466bdadc4539c9be01cab2055382dc274bc66d79c044ee278a80a33578097c5
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:NvMsLaOa3lLNngoqRttA7Y
TLSH
T1AC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzwqomge.exe

Path C:\Temp\i_jhbzwqomge.exe
Size 243KB
SHA256 84e65cf8ca32e71975e1d6e57ed2193f7aeda01199c7d4d1e56adaf97f94e155
MD5 fff20e13032f1a899899819a5ac1210d
SHA1 2b160e8571e2a15005570a8bb510c13eab18646e
SHA512 317e88e002837820feeeb0884fdf0150924afe3ca722b4995773a3c7ab1dcf48e1d44f661fa53cb4c04d1419bf5723aa993f21e9225def342dd1c4a58b769558
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:uvMsLaOa3lLNngoqRttA7h
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgezwrmjhb.exe

Path C:\Temp\i_mgezwrmjhb.exe
Size 243KB
SHA256 49bd2f867e79eac03f2d660e6b8b14c6e8635bcd376f871bc4a0e034d272a523
MD5 007ab31d3d0c3317e841584bc32360fd
SHA1 99c960f56b61b51a938f72de17a8758ab6e7344e
SHA512 c16194e37508845f84c115cd31d5412b5d6e139c6214204ebbbe825aec0ad1357829fa23451a2c1dcc2015db59d102c6b43da328b9a2e0411114687e98501a83
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:TvMsLaOa3lLNngoqRttA7i
TLSH
T1A7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnigaysqli.exe

Path C:\Temp\i_tnigaysqli.exe
Size 243KB
SHA256 73a081907fc1ca93adee7b8a5f85cc5b3dff807ed89ea9d8de4cf70abd51077d
MD5 f64ca93ec517041019170ddc375ded9b
SHA1 b03a9cfbd42be524b49d1933a33f452166fbe3a8
SHA512 fcb21a20123103dca7eea5d23c2a8ca9ae1f8a15ff4d27483a35c604286b060fa982fa325c5ee8be1d2810787df82047ebf97a124d2e971aa58e360bf3c44923
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:dvMsLaOa3lLNngoqRttA7k
TLSH
T143345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhezwur.exe

Path C:\Temp\i_urpjhezwur.exe
Size 243KB
SHA256 9114e6c923d38736d1792d59db88db313f199fa9d594ec6413a088b224521fe5
MD5 4cb67522f9c6bf6a0a177f81775e999f
SHA1 8769b7236072d43e87559e0ac73cc95466a7749f
SHA512 ebc40bf5361913e3032a5b7885a5b58b4fcd34b5bc35c2c6cf65de43219ea0de1abfd1920c69cbf895781adc140256cae246645514e33d2aece90702771da1b6
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:EvMsLaOa3lLNngoqRttA7z
TLSH
T195345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwqomge.exe

Path C:\Temp\jhbzwqomge.exe
Size 243KB
SHA256 9376b33dab1677493a99931aec4b4499ecfe38278261bc46ac9cc4aab069223a
MD5 6a8d2f6ba701d16d513218e582066747
SHA1 6286ad6e210a746ad3c0e7597a7fca07f3f4268a
SHA512 e2a23c711031156753bcf8d32075461f19dd1dc138ac4385d40b017495b8e22f9ada53d6c767e05af74a6dac97b68c1cc06957f72a6ed49e080d1006d1c903c8
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:kvMsLaOa3lLNngoqRttA7r
TLSH
T13F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrmjhb.exe

Path C:\Temp\mgezwrmjhb.exe
Size 243KB
SHA256 536389772238f9be4e2dea0a8e9fea469adbf3f43bc7f8acf70ce17a12241e76
MD5 fce1acb351156879c7161a36797338ec
SHA1 d0bc37c651652681e4a1d199dc9293521489eb1e
SHA512 72090c8fb4480bb1bf0eb135a396382933eebfb077f34984cac9de4a9718c5eb402b792f3f8a754371298050a7752121cfa8b487db13c2934de6772dbad76b0f
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:BvMsLaOa3lLNngoqRttA7U
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmgecwurm.sys

Path C:\Temp\rpmgecwurm.sys
Size 141KB
SHA256 2beb9d1b6cc810235690128584b28dcc943ede779bea1bae252074942c7e6c8b
MD5 0afebbd9abab792590bdf09aed8c398f
SHA1 3fb476be30bd0a711c9a51aceac2e687eab963ea
SHA512 10d2e18a4107b219d649648cf2694ec5e2faa8a73c1ab6bfed06fb77b85fab69365a0b80f844fd425039b915aab2a2d25c329e48e99029879678d71a2c831c9a
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnigaysqli.exe

Path C:\Temp\tnigaysqli.exe
Size 243KB
SHA256 d27beac8a7ed08882e9cb0ed2a7ca6dfb6c7264324bfef712a54506e6b1d4332
MD5 f75907d233b2585686a96c33cf278d0a
SHA1 55f0c85d2c152af58b13d0d601564d711f23e92d
SHA512 633fe0b9bd945be9122c6bbde3f98188b406cd26bbcd40e3bb781b5aad2c56c35d7642cf2eec0369b6d64cd461681ced721f3278661876df887085708db2587a
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:mvMsLaOa3lLNngoqRttA7p
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhezwur.exe

Path C:\Temp\urpjhezwur.exe
Size 243KB
SHA256 d02923ea147f40e852874e8d4ee17b8bf9e22bf9c1d3e480a6873db5906bad1a
MD5 605afef2f9f34d8fb165c975d1cf87d2
SHA1 171c3abb12ce7cd45a706151219aa958aa8a2620
SHA512 2ce3730bc3161e7905319a8913e0e48ae57388767965008faa099961dc616ae4af6fec73245befb68b83694c7bc0f36774c37cb1fd0c4fab8486a7970ac5aa0c
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:HvMsLaOa3lLNngoqRttA72
TLSH
T1AE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqligdyvt.sys

Path C:\Temp\ytqligdyvt.sys
Size 141KB
SHA256 f2e3b3064f02e993c390f87c9857f2d001df45404a1acaa84bfaf3c88a9086c7
MD5 ad248eb0e548a35baa948562e4fdc028
SHA1 52e3ce1f73637f599962ee96223a741f92f3a3c0
SHA512 3bde06679eb08ea12e0c99f4eacf7e01949043885fc572b2636d32c6b4e6008a6044555a2a41b4aea506a34cd9d91f6fb2bcf2668deeba224bfc777a51d64484
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 947e8176a0e9c6f0935a9d56a409bfaf6b48cc38ddf41d0370bf4cd07f2e4e4d
MD5 0f0db4b9b38b1ea73cc0e29ada024e77
SHA1 d3ae325e7fd0fe35e1b1f0824b2ebe4586992f76
SHA512 8d0872a14227d5136fa91561db11771a1ac94b159078e34177228eb67c1ac22877d22af357218107c87c81a25a5ba8db1310c12daf47b69d56948a3e0f45a5df
TLSH
T15761A67D43214DC1DFFB49B21EC184853EFFC88522A32EE152D14DB0B8A6F2454E809B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4c2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4c2d.TMP
Size 3KB
SHA256 a3f6ec6aef2c496f5e33fee3a3670ba74ae5a15afbde5134b085a023b4d88a64
MD5 e2117c342f95e1e34a5e89f422de83ce
SHA1 e2d7fccfed2e39645f238a8795eeaa0616da71f8
SHA512 9d009ff4fab71db4fc45fafdea0f92c904e4f5a0d358fed633d867f589dc2e9bb740eb5460f90861549be60a5a61ee71be0b7cc5fcb343743a127124c0a4f7e4
TLSH
T11961B77D53214DC1DFFB49B21ED184853EFFC88A22A32EE146D54DB0B8A6F2454E809B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36380e933940080ff7064a96d8e43c06fd014b728fb57cc27ff6da631141ed60
MD5 140fe2d7550cd0060099b0ceb8a9f790
SHA1 0fbd507a5e06705c437c909f1c1812bcb98e74ae
SHA512 f6df77d3799039e01b7a4ee7ee2e84f6dc17cd4be160a7b3a88b0b9e16553016fa387df11b9e3b22f2dfc5be5a6ab27b5f6cac911d6acf0250469c1e7ba5da91
TLSH
T11B41BFF783F4852EDA0156F0AA146E2BDE2D0515432C7C5A89E4AE2B93F3471D041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 291e366679c2704de98a7ac7c25883c2f2fe82b57d42f15afd5e90d6a4bb386b
MD5 e6c6567a2d73445948e808972ac9a24e
SHA1 0928036da8aa5c8665869b7fc0bd820ac8f45711
SHA512 e32af40eaaecfe8b0e2c449213433415752913cf0aa2f361e5a9361971be49bbdbb28e99a8e1ebd07d9e3a242f53ff6c4344ae4438762d053eafa25bc9bd8b19
SSDEEP 192:sxRAfLR/dCPf/fiLs8Iw8bNgBOczoA8p9AG/g6+WNCA6kC/Yly7ZAFiY4+Gt/r/I:sxRE2X/fSs8Iw8069/5K/tfrro/
TLSH
T12042B7566D68A93B4CC7E219FB257F63D7F85032A1951E48EAFC8A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 31cf8ed019c941e688ed027aaf0096cdf9e8cda80a5cdc9555707754e79df99e
MD5 ba394b97994e79dbb142b59d8d334355
SHA1 0e90e0591c7aff5c3bb4e2147b6bfed70c46de89
SHA512 ee162d3cd056837e0c1ec5a5e6d103d7f6fbd28aea18956daf7e52e786875f400281827cefc683fd4314d469a4710602875c91a1532ec084aa26eac5b7b6eaa6
SSDEEP 192:sxRAMLR/dCPf/fiLsPeywXZoINHBOczoA8p9AG/g6+WNCA6kC/YlyYZA7iY4+Gth:sxRb2X/fSsGywpo669/5K/gfrros
TLSH
T14F42C856A9686D3B5CC7E219FB657F63E7F8503290911E44AAFC8B1C05E76CD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 50e6e5f00f5875ff2097d884998ccc527ee24161cf4d10452bc603ddb40553d8
MD5 ec82e39dd94eeb187616d5511358f79f
SHA1 8ab3056eb22f83d7ae51fc39a3035e048a4437d4
SHA512 85ba0821e38c4638ecf1cb62d9bdab91312ab28a4e9a0ab81a53a5a46d2a556a83953b37c8f2ba5b4364994f390e44a1607db73f5c0d855cc1a8d6950cede72a
SSDEEP 192:sxRAMLR/dCPf/fiLsPeIwXZoINHBOczoA8p9AG/g6+WNCA6kC/Yly7ZAFiY4+GtL:sxRb2X/fSsGIwpo669/5K/tfrroC
TLSH
T1DB42C856A968693B5CC7E21DFB657F63D7F81032A0911E48AAFC8B1C04E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7756aa0b1f970b969a428d952c3dae93fdd0f65438af9027959e2217c3dc9382
MD5 7e2ae1dbe8d3ec59b583cb1ecd044ae0
SHA1 fdc5dff4452d95b7fd093132029d8f8b1987059c
SHA512 729316865329be17f5abec9c7f8c9baa395bf3ffbcce751150383e027db182957694a1ff8ca0c42104f12b2c822b9b6e5fdf69c7a37a706e237a752cd884a253
SSDEEP 768:dofAij7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUvN131Groi1Q:dofAiVE7AxWgg+fJJu1ja3vNl19i1Q
TLSH
T133D2D97B640CCA7E4F804ADDEC19BA9F6DA802CB9698C94047FD991C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a09d207-a2ec-4143-8574-d73da835883e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9a09d207-a2ec-4143-8574-d73da835883e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8b7bf36e82d845664d5e871f85e4e416fdc3ac89784ec9d28f8e2ade1777ee04
MD5 c06f2f95b342275e5f936dccd5b8d9f1
SHA1 630735a8b6904c8f95b9f2c52899ad7f27da7d61
SHA512 e8b64e709e6ecd19fa9e16adf3c460e73be7b02830d8cce0c620aca2e37d5e1c99aa373dd6b8091ac1f67b852fe5392fffe9f1cc5b846c10ba7a6613a2fc2aea
SSDEEP 384:n4ZcIA38NHEIl6O7NU+e2zRfY9bYmA9dJVQPlLJQXmIkdP9IimIMWEfMbc+HgPOy:GA3nKdiJNoyNHXmTWTbc+HgPi9Pft6
TLSH
T1B1F2BF70ACE55A67EDFA9F88A50A6B16AEF80173D1C81584DADCAB0D02C715D0367C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fb9fc7993b18507684b7c0937632c52768c9effe999439ccc04bb6508b29a8fd
MD5 9d75bd8611b31a93e276b0721b28fba0
SHA1 1f92b7d315106e22a8ba7b7513e205f792723b2b
SHA512 95ede53897166d4a6ba1fb351fa3d90ec72cbac02b908c880d41563ac4c6834b35d11f66a45553bc24976778f1f0411199e41776f368591bfddc94bcfaa944b0
SSDEEP 768:arv+4UNbdM3j8IiJN1NHXmTWTbc+/KfeVH1SvyZ:absb+3HKDeWn1SfEH1dZ
TLSH
T14103CF319CE98A37ADF69788748B7B573EF8116385C40A84C9D96B4E428718D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 53b3c26e9729752b01c6ec4a3c35ffae9ac36dbe7649aedb32da5b4e8f9170f4
MD5 f4bec2e97ea52ababe3884550e7cff12
SHA1 1fdfcf4a48116853fccab5de54564cb3c45c0aca
SHA512 e96a595837ffbac3cff1cf79f2410dee3248e18f4f6045b5e498c31e5283e870130e270710b48125ed370004600b7ff83569663a15036321136218a2aeb023aa
SSDEEP 768:orv+4UNbdf3UDIdiJNouNHXmTWTbc+HgPi9Pftug:obsbl3vKheWn1APstug
TLSH
T1C713BF30E8A9AA77DDF69ED8A10B7A077FF8016394C40694DAD96B4D02CB05D135BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b2bae515f54a9991e7cc9c417e309e3ca9d570bd9cee9099b3b99e2f84c06f53
MD5 e68f798aed300034a349014cfd4e9b3a
SHA1 ce7c01a66f9b5c35b02fbafc3b7c61e6ee99f308
SHA512 278bb2e91be1f593047663897bb9f13f3af84aa7bbebfeaaf8aa1acf40ef300280ed54018605ab3df6dd4003b621d119d372ff54a34cd2d03bb1a5cd1d978f79
SSDEEP 768:3rv+4UNbdM36fviJNo5NHXmTWTbc+egeVH1SvyZ:3bsb+34K4eWn1bEH1dZ
TLSH
T1EE03BF319CB99A379EE79E98B04BBA177FF8116385C40684CCD96B4D028B48D035BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e2b74a39e427f2ebffb301f1189d926c093574eb3f4aba65e9cd154b261f91ad
MD5 a30815f223bf5c58269a24473bff0342
SHA1 96cc294d173735061728324ee1b7ce5c135d8a39
SHA512 c748b03966cca00e571499e7bd2910b2f0af9535c171e4bfc206fd80c0ebc92a995e2349abaa601ee99a8e09cab8d11d9427bc782c47fdd8750670c9c83ca29c
SSDEEP 768:sFQW3CwgwR4cNo+NHXmTWTbc+HgPi9Pft6:fW3FReWn1APst6
TLSH
T1A91318F198D79637E9AE5B87573D6E059EBCC163B1881484BBC85D0CCD8217FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dd2d7b8812c07f968345861b0a35e569f7e1098e27e92317dc3e104ebd5470f2
MD5 4d288b20e0b2f506ebf8db4ce6b105b5
SHA1 59668747eae1aaf2f82569d2039d5d6ba7bacc2e
SHA512 921e8340594954bc9790bc73e719ce81303be04f397ff80e8e27059529bcedf63fabc958bf6411feb4e8fb5be1df172e69e6d592b449ebd50760387b53bf440f
SSDEEP 384:nWZcIA38NHVIl6O7NU+e2zRfY9bYmA9dJVQPlLJQXmIkdP9IimIMWEfMbc+HgPOy:EA3IKdiJNoyNHXmTWTbc+HgPi9Pft6
TLSH
T1C6F2BF70ACE55A67EDFA9F88A50A6B16AFF80173D1C81584DADCAB0D02C715D0367C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_223649660\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/296-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/872-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1060-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1064-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1064-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1140-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1352-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2584-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3120-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4000-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4908-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5232-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5252-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download