5c336997c86e5a2a16737c0546f2d249483ed13baf5a521b274ebaa3eaea6f53

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 16:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe
Size 243KB
Sample260816-t741psem71
SHA256 5c336997c86e5a2a16737c0546f2d249483ed13baf5a521b274ebaa3eaea6f53
MD5 d811de7af42daafbb859d312b284ec08
SHA1 a6e20bf74cce003308d20294f6a07c5fac4b7dd6
SHA512 4d243e5f5b35aa561440efc2a465932918db421fb1cd50f8313aef457146a509e7af954213fedb0af8a8141cca0db1659d94df3c181a30111978c26503b7becd
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:xvMsLaOa3lLNngoqRttA74
TLSH
T11E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6548	CP.exe
6480	omgbzwqljd.exe
2128	CP.exe
6600	CP.exe
4184	i_omgbzwqljd.exe
2332	ebwtrljdbv.sys
4428	CP.exe
2156	wtoigbvtgd.exe
6940	CP.exe
4112	CP.exe
1100	i_wtoigbvtgd.exe
7016	igdbvqoigd.sys
6460	CP.exe
2348	jdbvtnlfdy.exe
2580	CP.exe
2676	CP.exe
4432	i_jdbvtnlfdy.exe
3900	davsnlidav.sys
6340	CP.exe
592	davsnlfdxv.exe
5336	CP.exe
3260	CP.exe
4840	i_davsnlfdxv.exe
6052	caysqkican.sys
4364	CP.exe
3952	mkfcaxsqki.exe
2100	CP.exe
2576	CP.exe
7144	i_mkfcaxsqki.exe
6880	auspkicaus.sys
6864	CP.exe
6808	spnhfdxvmc.exe
6872	CP.exe
6648	CP.exe
6068	i_spnhfdxvmc.exe
1504	kecwusmkec.sys
6732	CP.exe
6560	jhecwurpnh.exe
5152	CP.exe
5296	CP.exe
1624	i_jhecwurpnh.exe
3696	romhezxrpj.sys
4184	CP.exe
4688	mkecwuomhe.exe
1928	CP.exe
1488	CP.exe
4532	i_mkecwuomhe.exe
1684	trpjhezwrp.sys
6024	CP.exe
3812	jgbztrmgeb.exe
7016	CP.exe
1120	CP.exe
5748	i_jgbztrmgeb.exe
4432	qomgeywrom.sys
4740	CP.exe
2896	omgbztqojg.exe
5420	CP.exe
5056	CP.exe
4736	i_omgbztqojg.exe
2052	dbvtnljdbv.sys
6156	CP.exe
6052	aytqoigdyw.exe
1088	CP.exe
6476	CP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwurpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoigbvtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfdxvmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfdxvmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbztqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbzwqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrmgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrmgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbztqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbzwqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoigbvtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwurpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlfdy.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1508	ipconfig.exe
1964	ipconfig.exe
4384	ipconfig.exe
3264	ipconfig.exe
2404	ipconfig.exe
6892	ipconfig.exe
4424	ipconfig.exe
6196	ipconfig.exe
6416	ipconfig.exe
5980	ipconfig.exe
1116	ipconfig.exe
3176	ipconfig.exe
1904	ipconfig.exe
5184	ipconfig.exe
6884	ipconfig.exe
6500	ipconfig.exe
2668	ipconfig.exe
1868	ipconfig.exe
1496	ipconfig.exe
6708	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313721802236191"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{C3956DF7-9839-45F9-A29D-0ADF486EF9E0}	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	i_omgbzwqljd.exe
Token: SeDebugPrivilege	1100	i_wtoigbvtgd.exe
Token: SeDebugPrivilege	4432	i_jdbvtnlfdy.exe
Token: SeDebugPrivilege	4840	i_davsnlfdxv.exe
Token: SeDebugPrivilege	7144	i_mkfcaxsqki.exe
Token: SeDebugPrivilege	6068	i_spnhfdxvmc.exe
Token: SeDebugPrivilege	1624	i_jhecwurpnh.exe
Token: SeDebugPrivilege	4532	i_mkecwuomhe.exe
Token: SeDebugPrivilege	5748	i_jgbztrmgeb.exe
Token: SeDebugPrivilege	4736	i_omgbztqojg.exe
Token: SeDebugPrivilege	2900	i_aytqoigdyw.exe
Token: SeDebugPrivilege	2112	i_tnkigaysql.exe
Token: SeDebugPrivilege	2200	i_pnifdxvpnh.exe
Token: SeDebugPrivilege	5452	i_usqkicausq.exe
Token: SeDebugPrivilege	3364	i_smkecxupmh.exe
Token: SeDebugPrivilege	1304	i_smkecwuomh.exe
Token: SeDebugPrivilege	3700	i_ojhbztrpjh.exe
Token: SeDebugPrivilege	3280	i_eywromgeyw.exe
Token: SeDebugPrivilege	3668	i_gbywqoljdb.exe
Token: SeDebugPrivilege	6780	i_lidbytqlid.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6116 wrote to memory of 5660	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	90
PID 5660 wrote to memory of 6080	5660	iexplore.exe	91
PID 6080 wrote to memory of 4880	6080	msedge.exe	92
PID 6080 wrote to memory of 4912	6080	msedge.exe	95
PID 6080 wrote to memory of 7028	6080	msedge.exe	96
PID 6080 wrote to memory of 7028	6080	msedge.exe	96
PID 6080 wrote to memory of 4924	6080	msedge.exe	93
PID 6080 wrote to memory of 4924	6080	msedge.exe	93
PID 6080 wrote to memory of 4924	6080	msedge.exe	93
PID 6080 wrote to memory of 6572	6080	msedge.exe	98
PID 6080 wrote to memory of 2860	6080	msedge.exe	97
PID 6080 wrote to memory of 6572	6080	msedge.exe	98
PID 6080 wrote to memory of 6572	6080	msedge.exe	98
PID 6080 wrote to memory of 2860	6080	msedge.exe	97
PID 6080 wrote to memory of 2860	6080	msedge.exe	97
PID 6116 wrote to memory of 6548	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	99
PID 6480 wrote to memory of 2128	6480	omgbzwqljd.exe	102
PID 6080 wrote to memory of 3704	6080	msedge.exe	105
PID 6080 wrote to memory of 2868	6080	msedge.exe	106
PID 6080 wrote to memory of 3704	6080	msedge.exe	105
PID 6080 wrote to memory of 2868	6080	msedge.exe	106
PID 6080 wrote to memory of 5644	6080	msedge.exe	108
PID 6116 wrote to memory of 6600	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	111
PID 6116 wrote to memory of 4428	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	115
PID 2156 wrote to memory of 6940	2156	wtoigbvtgd.exe	117
PID 6116 wrote to memory of 4112	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	120
PID 6116 wrote to memory of 6460	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	124
PID 2348 wrote to memory of 2580	2348	jdbvtnlfdy.exe	126
PID 6116 wrote to memory of 2676	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	129
PID 6116 wrote to memory of 6340	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	133
PID 592 wrote to memory of 5336	592	davsnlfdxv.exe	135
PID 6116 wrote to memory of 3260	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	138
PID 6080 wrote to memory of 5800	6080	msedge.exe	141
PID 6080 wrote to memory of 3460	6080	msedge.exe	142
PID 6080 wrote to memory of 5892	6080	msedge.exe	143
PID 6116 wrote to memory of 4364	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	146
PID 3952 wrote to memory of 2100	3952	mkfcaxsqki.exe	148
PID 6116 wrote to memory of 2576	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	151
PID 6116 wrote to memory of 6864	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	155
PID 6808 wrote to memory of 6872	6808	spnhfdxvmc.exe	157
PID 6116 wrote to memory of 6648	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	160
PID 6116 wrote to memory of 6732	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	164
PID 6560 wrote to memory of 5152	6560	jhecwurpnh.exe	166
PID 6116 wrote to memory of 5296	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	169
PID 6116 wrote to memory of 4184	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	173
PID 4688 wrote to memory of 1928	4688	mkecwuomhe.exe	175
PID 6116 wrote to memory of 1488	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	178
PID 6080 wrote to memory of 2172	6080	msedge.exe	180
PID 6080 wrote to memory of 2172	6080	msedge.exe	180
PID 6116 wrote to memory of 6024	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	184
PID 3812 wrote to memory of 7016	3812	jgbztrmgeb.exe	186
PID 6116 wrote to memory of 1120	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	189
PID 6116 wrote to memory of 4740	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	193
PID 2896 wrote to memory of 5420	2896	omgbztqojg.exe	195
PID 6116 wrote to memory of 5056	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	198
PID 6080 wrote to memory of 5376	6080	msedge.exe	200
PID 6080 wrote to memory of 5376	6080	msedge.exe	200
PID 6116 wrote to memory of 6156	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	203
PID 6052 wrote to memory of 1088	6052	aytqoigdyw.exe	205
PID 6116 wrote to memory of 6476	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	208
PID 6116 wrote to memory of 4288	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	212
PID 6164 wrote to memory of 6180	6164	tnkigaysql.exe	214
PID 6116 wrote to memory of 6072	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	217
PID 6116 wrote to memory of 6768	6116	2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_d811de7af42daafbb859d312b284ec08_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6116
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffbb43cc188,0x7ffbb43cc194,0x7ffbb43cc1a0
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6841061136688438985,3305767865666312630,262144 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17298128880205298055,1713944327120782016,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,11191062092813716637,11094044134767241005,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:13
      4⤵
      PID:7028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,4026384979825311913,1711941748014810927,2097152 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,7582561441988558308,8465452112909787522,2097152 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,10939850857222429523,3470345407027997359,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,1003683392343056157,18430605395597010305,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,17214348553103985706,11464125313991683091,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,17214348553103985706,11464125313991683091,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,4752045087851656130,10547442239638837497,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,8311606964920270653,9766530944524642999,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8807152811798377570,1642604115123478654,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2760,i,111879806542618872,6172320202741130099,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:14
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,12593110627199212874,16565993392981753574,524288 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5980,i,11113917812351479366,14699392232796842624,262144 --field-trial-handle=2308,i,14015996946992696996,12686165862272345344,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:10
      4⤵
      PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgbzwqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6548
- - C:\Temp\omgbzwqljd.exe
    C:\Temp\omgbzwqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgbzwqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6600
- - C:\Temp\i_omgbzwqljd.exe
    C:\Temp\i_omgbzwqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoigbvtgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\wtoigbvtgd.exe
    C:\Temp\wtoigbvtgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoigbvtgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\i_wtoigbvtgd.exe
    C:\Temp\i_wtoigbvtgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6460
- - C:\Temp\jdbvtnlfdy.exe
    C:\Temp\jdbvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\i_jdbvtnlfdy.exe
    C:\Temp\i_jdbvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6340
- - C:\Temp\davsnlfdxv.exe
    C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3260
- - C:\Temp\i_davsnlfdxv.exe
    C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Temp\mkfcaxsqki.exe
    C:\Temp\mkfcaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2576
- - C:\Temp\i_mkfcaxsqki.exe
    C:\Temp\i_mkfcaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfdxvmc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6864
- - C:\Temp\spnhfdxvmc.exe
    C:\Temp\spnhfdxvmc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfdxvmc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6648
- - C:\Temp\i_spnhfdxvmc.exe
    C:\Temp\i_spnhfdxvmc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhecwurpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6732
- - C:\Temp\jhecwurpnh.exe
    C:\Temp\jhecwurpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhecwurpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5296
- - C:\Temp\i_jhecwurpnh.exe
    C:\Temp\i_jhecwurpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\mkecwuomhe.exe
    C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1488
- - C:\Temp\i_mkecwuomhe.exe
    C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrmgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6024
- - C:\Temp\jgbztrmgeb.exe
    C:\Temp\jgbztrmgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:7016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrmgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1120
- - C:\Temp\i_jgbztrmgeb.exe
    C:\Temp\i_jgbztrmgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgbztqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\omgbztqojg.exe
    C:\Temp\omgbztqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgbztqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\i_omgbztqojg.exe
    C:\Temp\i_omgbztqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqoigdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6156
- - C:\Temp\aytqoigdyw.exe
    C:\Temp\aytqoigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqoigdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6476
- - C:\Temp\i_aytqoigdyw.exe
    C:\Temp\i_aytqoigdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnkigaysql.exe ups_run
  2⤵
  PID:4288
- - C:\Temp\tnkigaysql.exe
    C:\Temp\tnkigaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnkigaysql.exe ups_ins
  2⤵
  PID:6072
- - C:\Temp\i_tnkigaysql.exe
    C:\Temp\i_tnkigaysql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifdxvpnh.exe ups_run
  2⤵
  PID:6768
- - C:\Temp\pnifdxvpnh.exe
    C:\Temp\pnifdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifdxvpnh.exe ups_ins
  2⤵
  PID:6016
- - C:\Temp\i_pnifdxvpnh.exe
    C:\Temp\i_pnifdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkicausq.exe ups_run
  2⤵
  PID:2800
- - C:\Temp\usqkicausq.exe
    C:\Temp\usqkicausq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkicausq.exe ups_ins
  2⤵
  PID:1272
- - C:\Temp\i_usqkicausq.exe
    C:\Temp\i_usqkicausq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupmh.exe ups_run
  2⤵
  PID:3856
- - C:\Temp\smkecxupmh.exe
    C:\Temp\smkecxupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupmh.exe ups_ins
  2⤵
  PID:4144
- - C:\Temp\i_smkecxupmh.exe
    C:\Temp\i_smkecxupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwuomh.exe ups_run
  2⤵
  PID:4412
- - C:\Temp\smkecwuomh.exe
    C:\Temp\smkecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwuomh.exe ups_ins
  2⤵
  PID:6008
- - C:\Temp\i_smkecwuomh.exe
    C:\Temp\i_smkecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrpjh.exe ups_run
  2⤵
  PID:6332
- - C:\Temp\ojhbztrpjh.exe
    C:\Temp\ojhbztrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrpjh.exe ups_ins
  2⤵
  PID:6204
- - C:\Temp\i_ojhbztrpjh.exe
    C:\Temp\i_ojhbztrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywromgeyw.exe ups_run
  2⤵
  PID:3656
- - C:\Temp\eywromgeyw.exe
    C:\Temp\eywromgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywromgeyw.exe ups_ins
  2⤵
  PID:6012
- - C:\Temp\i_eywromgeyw.exe
    C:\Temp\i_eywromgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbywqoljdb.exe ups_run
  2⤵
  PID:2816
- - C:\Temp\gbywqoljdb.exe
    C:\Temp\gbywqoljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbywqoljdb.exe ups_ins
  2⤵
  PID:2644
- - C:\Temp\i_gbywqoljdb.exe
    C:\Temp\i_gbywqoljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbytqlid.exe ups_run
  2⤵
  PID:800
- - C:\Temp\lidbytqlid.exe
    C:\Temp\lidbytqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbytqlid.exe ups_ins
  2⤵
  PID:5672
- - C:\Temp\i_lidbytqlid.exe
    C:\Temp\i_lidbytqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6780

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2800

C:\Temp\ebwtrljdbv.sys
C:\Temp\ebwtrljdbv.sys
1⤵
- Executes dropped EXE
PID:2332

C:\Temp\igdbvqoigd.sys
C:\Temp\igdbvqoigd.sys
1⤵
- Executes dropped EXE
PID:7016

C:\Temp\davsnlidav.sys
C:\Temp\davsnlidav.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Temp\caysqkican.sys
C:\Temp\caysqkican.sys
1⤵
- Executes dropped EXE
PID:6052

C:\Temp\auspkicaus.sys
C:\Temp\auspkicaus.sys
1⤵
- Executes dropped EXE
PID:6880

C:\Temp\kecwusmkec.sys
C:\Temp\kecwusmkec.sys
1⤵
- Executes dropped EXE
PID:1504

C:\Temp\romhezxrpj.sys
C:\Temp\romhezxrpj.sys
1⤵
- Executes dropped EXE
PID:3696

C:\Temp\trpjhezwrp.sys
C:\Temp\trpjhezwrp.sys
1⤵
- Executes dropped EXE
PID:1684

C:\Temp\qomgeywrom.sys
C:\Temp\qomgeywrom.sys
1⤵
- Executes dropped EXE
PID:4432

C:\Temp\dbvtnljdbv.sys
C:\Temp\dbvtnljdbv.sys
1⤵
- Executes dropped EXE
PID:2052

C:\Temp\tnligayvqn.sys
C:\Temp\tnligayvqn.sys
1⤵
PID:3196

C:\Temp\avsqkidavs.sys
C:\Temp\avsqkidavs.sys
1⤵
PID:6356

C:\Temp\xsqkicaxsq.sys
C:\Temp\xsqkicaxsq.sys
1⤵
PID:5460

C:\Temp\axrmkecxup.sys
C:\Temp\axrmkecxup.sys
1⤵
PID:3560

C:\Temp\rpjhfzxupm.sys
C:\Temp\rpjhfzxupm.sys
1⤵
PID:2728

C:\Temp\zurpjhbzuo.sys
C:\Temp\zurpjhbzuo.sys
1⤵
PID:6188

C:\Temp\bztrljhbzt.sys
C:\Temp\bztrljhbzt.sys
1⤵
PID:5412

C:\Temp\ebwtoljdby.sys
C:\Temp\ebwtoljdby.sys
1⤵
PID:1680

C:\Temp\igayvqlidb.sys
C:\Temp\igayvqlidb.sys
1⤵
PID:3312

C:\Temp\vtnlfdbvtn.sys
C:\Temp\vtnlfdbvtn.sys
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auspkicaus.sys

Path C:\Temp\auspkicaus.sys
Size 141KB
SHA256 e1b434d7c80aa15a861770906fcf7acf287cab8b2cf9c9318859e8322a8dd997
MD5 6849e644bd320a69ef80b56188306a94
SHA1 fe3243b745589d7a6e77c576861e9e0ce5f9827b
SHA512 d77e53f5f671f83e541756aacb9f87d3c09e66b99c993ec974c4206f4ba35031507649d8e511bb3d13ebb62b0d108c0411358e2ac7f2c76155751ef9846d01b3
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysqkican.sys

Path C:\Temp\caysqkican.sys
Size 141KB
SHA256 8aec2e10fd37bacf080b9f24b7e7e3ca0a6b85f48aff70f568243063c70c488e
MD5 95ab8e1c2028e2d838d2e21ef3a0b9dc
SHA1 2f2361624b98a1aa3e3bcbc7d66d34e4c29d6672
SHA512 0c6cc7c0376b61fa87f5e3207bf1cade3438d90f8a080ed7b48f52b187503acf25409f19baaef86821735126cbd7268df1b68df10168b628caca8dfbf79447f3
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlfdxv.exe

Path C:\Temp\davsnlfdxv.exe
Size 243KB
SHA256 7b05003dab006a4f76d151343e596df52ae525b62f8386c2e93fa45102c19707
MD5 49c715ea3beccb4188a23ded243e7252
SHA1 b2687259253d8c7f89fce0db200532b09e56077a
SHA512 f035dd7f82f88e321b99b39c1006606f69621db506816072ae740cff99163d35ea86ae30a852ed662230877ebb6e1cd4388fd6295a5cb4241ab7fd71ff705d07
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:CvMsLaOa3lLNngoqRttA7N
TLSH
T166345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlidav.sys

Path C:\Temp\davsnlidav.sys
Size 141KB
SHA256 1383ec16f6a8f768acc5a25fdce3d4e23cd40f69afc543f806a45eaa05540dcc
MD5 b0128f6830b0dcac01b5657f0d5b418d
SHA1 84465619a7c2f438b36f27e417546306fd6b891b
SHA512 7f3952a69e6c4e4f73ff850ea98cb9193bfbdc5e85dd1c53f977e761e981f38cddecbe45b290387924c1d714e1c6bce0ed868a1803b9ed234d3742c5473050f5
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtrljdbv.sys

Path C:\Temp\ebwtrljdbv.sys
Size 141KB
SHA256 0d6ddc2315c3d438f33df9bbb8a6757fe3628042989deb598fbb581acee27ea3
MD5 c5adf5d63c04990384705e02cb7280ea
SHA1 efc4b5d8a37245d5525fc9de51ce4057043c0377
SHA512 efd23e7abce2af81ad2c201b08ed0e537bae0267a0c2e1ca014968b1b9c65bf3f495cc76c10095ccc93be7907a490d92711cd2c6bf01b3cc3fbd9901712cb390
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsnlfdxv.exe

Path C:\Temp\i_davsnlfdxv.exe
Size 243KB
SHA256 6a11c6c259c0f2a69f86acd6dca2107fb6037f30b0aea8cceee633d016593192
MD5 bcc94e0c6235f544e027db20e40eeaf3
SHA1 32f62930afb0029aaa4df68f30334e53b4244bb3
SHA512 68d7c6a95a069eb59fcc0b5d8c1651a8cfe69f36acc16c159b60ff9b8323647d06cc263bc3f730849c21e13560412cb8858b2e960f7592fe2fdbf0f52b515835
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:gvMsLaOa3lLNngoqRttA7X
TLSH
T105345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtnlfdy.exe

Path C:\Temp\i_jdbvtnlfdy.exe
Size 243KB
SHA256 59cf513811dc7aa3946b644024254327f7201e7aee0dff24331244a0904c3cc1
MD5 5e41665ce349a3277c8f217066e1b291
SHA1 871bce9d2ca70b6275ef46f3d62798671d16e0f9
SHA512 a9d58f9ec8bf44927608c934c1329d65cb045b22c6943555aff61a8628d30f2f914772bb71be54e3f4f79712c986ceed15e2179c0919dbe87b16441e40f569c2
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:9vMsLaOa3lLNngoqRttA7g
TLSH
T1D8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhecwurpnh.exe

Path C:\Temp\i_jhecwurpnh.exe
Size 243KB
SHA256 41940c0b759306523da3f1a6baccd63f02d6589b75f9301d8abb961aca487744
MD5 ad229203b3a0a08d013218805717bcd5
SHA1 d33532ebe961db03fc12e8efee0957f380f56227
SHA512 17475469755ebadfc0e391756eead6a4f0a18fc21e8d8e3d8093f3235fafff8d00561b1d625c73737adc171fca651ee16ebbee14345a3af0b2ee11d315e3e3bb
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:tvMsLaOa3lLNngoqRttA7o
TLSH
T1EA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcaxsqki.exe

Path C:\Temp\i_mkfcaxsqki.exe
Size 243KB
SHA256 775ada122f511a547078161a2faa981890231c30efa6ebea3410a1a268f74d90
MD5 523514b3e84cdd401a90ff1ee5b92f66
SHA1 1f74d57e55da86c0e3b0a832af9c232b49cec3ab
SHA512 82da014017afe7fcdc51ddb593ad4fd64ec947d60f26b3dfd30cfa2f0de1353206de72426e0129fc6cd8aadcaa80f87ffb99a8362fbb11067255a3b132828f01
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:YvMsLaOa3lLNngoqRttA7j
TLSH
T1F4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgbzwqljd.exe

Path C:\Temp\i_omgbzwqljd.exe
Size 243KB
SHA256 685062871bad3143afa6c0269ee8366489187b800b8dc320622887676e541e02
MD5 07a7a790952c7bbf14842273eae7855e
SHA1 04c4d23094fb899bd47ed7a3da3766c0cdc1944b
SHA512 0d04a7cd6cbda809f7fcf2228d029fd3ddd31621e338beeb3143cc34aa306697473a169421b20f2b6a65c08fde834019e609158af44098c27034afdab7654aa8
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:JvMsLaOa3lLNngoqRttA7k
TLSH
T18E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfdxvmc.exe

Path C:\Temp\i_spnhfdxvmc.exe
Size 243KB
SHA256 bac32799b55e840d02f064685b82b3c6624c783dac82f61b4af303f9e324ae6e
MD5 68abab4a8f0ef00808de37bc41e787c6
SHA1 6693a6f787fa19d492b82dd0830e9b05db9366ab
SHA512 978f98714f622cb529b6d0d408c46a0d0390ad8880721c70fd0dffa7a7ef551aa1dba008227a6cd59b68f10456f8293d53f23a5cf58c9f25b983e41a15a98d68
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:SvMsLaOa3lLNngoqRttA7h
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoigbvtgd.exe

Path C:\Temp\i_wtoigbvtgd.exe
Size 243KB
SHA256 566175188140597a74d54a8251136e6206f1a3ec6c1118ed5304bc35ed22ca78
MD5 90a6472e288fd1bf857fe184dd9f1700
SHA1 ae7db3ce0369f3c998872f316e19651be6608926
SHA512 76a3c250a8539165289f40c8fe01396ef640b9ad97b3386e7a75a0e812d8036a5e8b81674e4e19b632a2033c53c91d8c15e3c2261dff1c2bfd03a9372744e903
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:jvMsLaOa3lLNngoqRttA7m
TLSH
T137345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdbvqoigd.sys

Path C:\Temp\igdbvqoigd.sys
Size 141KB
SHA256 47afc40299ac8fc1203ab4f07fb921d648e4de2dda7d275ad53a428a728751c0
MD5 99c87ddbceeed9ec7b27a4ec6e7a4456
SHA1 eb74f55f6d7c4d75a603b6fda8788c5d6ecd3474
SHA512 20915c360aa064a5ac095922e8094da9ab8621bb7e89f09bb8b11459536f18b7171b974d9cdea6fa3925b73002df8c942b56272032bd6bc95696598000d79ea6
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtnlfdy.exe

Path C:\Temp\jdbvtnlfdy.exe
Size 243KB
SHA256 d2cd11df6e69db9d2203f7b7d71d621434ccffac7afaa3798b1d1fe0aef189a6
MD5 e4c1faf869be5aa124f79640fa547351
SHA1 268caf538dcdb18ea45a3d93b9d30a1a62bcbc53
SHA512 8aa9f452646c653218251597cb2ff47b50779d29d53d27adca212884d362e0b3958f3b5acfeaebc41aa21dfba7a93375fda5d70affe3a3a27766d6316f507ca2
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:bvMsLaOa3lLNngoqRttA7O
TLSH
T111345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhecwurpnh.exe

Path C:\Temp\jhecwurpnh.exe
Size 243KB
SHA256 cb4ec08d074b7b9bc120b8c88e650848aec5419b15c0eaa236bd6188afb39eb4
MD5 1c94f108b883c4bb25afd8f8172e62f8
SHA1 60a3a5c990b7a127829b26b92d01318571b3bb78
SHA512 6f5a26ebdc0bce8398f617b8c6ba812b351f4b0a68670cad868711cd8d786b684b0d16ec455e208e36f4ea1908e7551a3c0fd559b71e6afeffbf2b6cf0c2f9cd
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:tvMsLaOa3lLNngoqRttA7A
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkec.sys

Path C:\Temp\kecwusmkec.sys
Size 141KB
SHA256 fcdc89bd8ab74db86db91c30555f77ae7fccb3f9585d959ea8c6a02de56c6465
MD5 20f280e93922dbd42613476e708cb05c
SHA1 e8002351319524f5fcf3061841fa011831acfa82
SHA512 089559c55de5b29596cdea34d6f39211aa032f73b38d8a6621df198c4dcc035e81fe54c133684bc0e7a241db6704861e30cffa7ec51b6bed8994e847c2476bab
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E37D12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcaxsqki.exe

Path C:\Temp\mkfcaxsqki.exe
Size 243KB
SHA256 90aa3d63b63587a4d34ea97821d020e833490e06462cb20794ef2d43b06a4b44
MD5 b1bc4a4c1ab2e17835e5a55d1780a7f6
SHA1 a5c573b8efddc33be8081889e1b70f5e5ac5fdb8
SHA512 c80ac29b5720d9802d4fceca0f53f3145308f49f26f7da5c2fcbc870397feb709e7f795b67fd02bc7a182614baca293d3763efa7de96b527def8fd1172232c1e
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:JvMsLaOa3lLNngoqRttA7Y
TLSH
T1F4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgbzwqljd.exe

Path C:\Temp\omgbzwqljd.exe
Size 243KB
SHA256 df55bbcdab5205e757d9afff4e6c15a24a512884fb5fc2bfbffb625d4f67e6bc
MD5 295d66df7fee4459cba0764a799b07aa
SHA1 a55c67e634db9418eafadbdec8609a1351b37a37
SHA512 895357539358565736535ee63602cac8f1d9e8fe676533de9caca7007c54eba68e75ed3ab6a4392254c881bbee7ea855b78f6f0d599e1c9de35534e6ba4a243c
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:uvMsLaOa3lLNngoqRttA7l
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfdxvmc.exe

Path C:\Temp\spnhfdxvmc.exe
Size 243KB
SHA256 d42b047c683d72dd263e25530f441cd2cce5d804040653a1e2b86387c26e4c12
MD5 f0c5dc1cc367508706d357c40ec434ec
SHA1 5f19420fd56a24105bfea61c2cbcb967e55df54b
SHA512 d675c2d32bbea51924df0dddfcb2a84d23c2cdbd3bd2fc9d1fe5f34824c0c26e9e58299f5170face85bebbca17cf7229dd33a43f34d01aacffbe245748bff6f9
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:5vMsLaOa3lLNngoqRttA74
TLSH
T1BE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoigbvtgd.exe

Path C:\Temp\wtoigbvtgd.exe
Size 243KB
SHA256 eae9dd9e7528abf1295640c581a1a3677b5409dca38507546932f55fbb8dd9f2
MD5 19bb35a5d59d8669e4478332023ba56a
SHA1 a7183cecbdc4fc72889273a888fca3581255caed
SHA512 32e21fd9d32247c09abcc6ec8f179ced69eb05aa3765f39268d7167c5d1557fdb48a54d9c0b3ce3bf70e63c2dca2d2ca7efadcc386e6d60823d4b86268fe3af6
SSDEEP 3072:WCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:5vMsLaOa3lLNngoqRttA7I
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

906b74b1-9dad-44fc-ac74-0527a66832e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\906b74b1-9dad-44fc-ac74-0527a66832e2.tmp
Size 15KB
SHA256 ccf6fe59fab86ac7d32256513d15bcc41b8ac6e77fc8c2806cc8cd2b039ab670
MD5 1ba75a84e85850440ae6ff10bd9a4cc3
SHA1 6c692c0c864b4efda5e4a990ec037b5e6dcc1838
SHA512 0ff8aa9104840a2edd0da82fd0d8e10d1275c6b12e1d47054d2d4e1a40c08294a8e00d33b06863eb6a74bde902c54ec50a49183aad2a10e7d561b81ccff4e763
SSDEEP 384:sxRn/8T/fUsW6AqN/RI49k/5x/WLbsGQV9jv:sLUT/fO6ZWV/5FWLbsGQVp
TLSH
T18F72E9156A289D3B8CDBD209FA957F93D3F9157391905E44AAFCCA0C04E67EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b443a1ba13a5e7a938ab33f5d34abd3f0f7c955a73646dbda834172687e5e018
MD5 dafed15f3db3ba32680885383e726607
SHA1 b7bcf8ac2a3c2f08fe2da3af0a4665c7892db369
SHA512 51c257c0fb78b42f21de2bf52aa83cef8bc184accd04234075f5b6aea5e7ff74cf2d61fa675644cc75a16b16ea4a1e6fd16c223efa929a6a2da29e6534fe64a7
TLSH
T125E02B69C861BC2719FC5B286198064BE751235B3B51894F7F3D812D4FB06374686C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 44cc56017db187fb7f843df8e0d42e49e2f6a74444483458025a0f644c92bfd3
MD5 3ffbf864bf21c1d00a954655f601f2c1
SHA1 351ee3e46bb5b5dfc9669934ccd3a93b4e89ccbe
SHA512 ad3cf9348777b961f9f7d6eb232743b19e6763ada2a62e8cd3d92bc387dcecdf5fe08cccdfe813dda791f72d05029303187259b169b02e04885b2557fcb42019
TLSH
T17C41A0F783F4856EDA1195F0AA187E2FCE1D0515432C7DAAC9E0AE1793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f75aff6270dd2f40e0fc9b0a73322e3ae1fafcbfffee1af000530f1dcb01b725
MD5 e400d98c2ce2d3ec64883bccfc1df88e
SHA1 17bb22720ffccb9d0748841788c2adb1c4f833e5
SHA512 501b174f8d2683621d48c5cdb78e2cc484e83c84ad50b64573f32858d64268d26ad66df362e1422225f74be4533098ed435d61b1f0adfa97e7016f374fa01a32
SSDEEP 384:sxRn/qXT/fUsu6ABN/RI49k/5x/WL8rsGQV9ZC:sLCXT/fG6GWV/5FWL8rsGQVa
TLSH
T19972D819A9649D3B9CDBE219FA857B93D3F9156391905E44AAFC8E0C00E67DD210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d88ad81a5d8e793f00c102fad75ff4aa68a5b047ef3aee72df8099279cdd203
MD5 4061d0fb983db26ff08db8d3c4101ec8
SHA1 58fbe1e27096d5d155c9f443670858a3e3aff385
SHA512 3ca83018397bf029c5d15a95ddbb1d24a16771784ff2a08311754fb25d78b85054fb99714d968c5ea2821cb01b21d6e0fe19da1a98bca59c97243c298aba0a96
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroD4H:Ob4YZnE7yTWg1NfwBu1ja0obHwAEH
TLSH
T126E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 59d94708b4d84bb339d121c0dfa52a015d361c6d3fef322e6cc45f17178d4d8a
MD5 8628c01ff1d5f25279151f8764c09848
SHA1 848f46a66518afbe1607d781141737b67683c692
SHA512 b64a7e37bf4c22689932693f9fc0bce68bfa162f1f0cea4402b8330161e58b7d87b2c7409e6755737aa4ba1b118b53bf0a615c34cd061b1494621d47570f91f4
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sfR:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRT
TLSH
T18AB26E11713F46803C3EB90C8178986F92C2B4637519E52F7B6846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ba5e3b85221b38ce6167904b93229d38a5b5c2b7ffba049d5d189e2cd6466316
MD5 695679dfeb6d6b38f78d6626fce0b826
SHA1 f8455c7200920c55fdfb5759abf2b2f55da15858
SHA512 c9570a553568aa568c4e4a209099677a089abf9f6f77bb912197e27464870915b9bb3d4c7d1b3e176c23aaa00af2f82b9c8449d00b6e220856ad3f70280c625b
SSDEEP 384:nUiFiZcIF8NLgg8TUNTUlIR02KPvuTKO6duEqfbYGGpe+DLwPbOOPrXLpe8C/5t9:vFQFQggwg/Suz6HGGNkbOi9Pct9
TLSH
T18CF2B3F198E78977E8AE4B97637D6E4699FCD153B4884984B7C44D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e822a64d8d3e5e32770b0e1cd4ab127ac4754f00a2487cbfd3696261f18d8e0a
MD5 0db4790ee98016b6c928870c7597c8c5
SHA1 6802f552c136350ef2a58b2e134cadf99ebdf99e
SHA512 02f2331b5c2715142cd1ed7dbdd96044b9732224b72f4debd2b1f8b1a5a628c10190458a048c22c64fe2a65617783756c3418e0b0b1ab36edf910b25fa8ca31c
SSDEEP 384:n+iF1tNn/s3n9Sn8NLgg8TUNTUlIRkPvuTKq6duEqfbYGGpe+DL9kbOOPrXLpe8R:VF1j+9SQggwg+uL6HGGNSbOi9Pct0
TLSH
T1DED25D32E869CEA7ECEA8FD8B74A7646EEF415A3D48D59D8DAC45D0C00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 96b6075648ab938ed18bcf31a340310484b4ffd2bebc8b8c0b23e163242a5b4e
MD5 102bdce89a862300d81bf68f5c3218b0
SHA1 e0e41f209e85b2beec1ab091b6801e91ef196840
SHA512 d32102864eede30358540ae43fe479e237f7652ca3d68796192c45552f40fb7f290ab4aa7cc4760fe650b5bd7e16bc65e85d5b2bfb6cbf11a18d065ac41dbba5
SSDEEP 384:n+iFiZcI58NLgg8TUNTUlIR02KPvuTKq6duEqfbYGGpe+DL9rbOOPrXLpe8C/5t9:VFQ5Qggwg/SuL6HGGNRbOi9Pct9
TLSH
T14DD25C31E868CEA7ECEA9FD5B7497646DEF411A3D48C8AD8EAD45D0C00C71AD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 989797d004bfd1b39cde8ae5125ceca15038278c6d29fffbf99c731d857404a5
MD5 b31f8378ed43bb0a52d4e3749251fde6
SHA1 0293fd2365466b6b36ad4ecbf0592f5156dd46a1
SHA512 02373ead80a6340e8ce6e85e659063fed0a7975b5c9daf0dd1bc9a3871ef17889c532c8c7956d5f39972942f0c96e3450a9cf511e077bb622c0de56816fa0504
SSDEEP 384:nJiFiZcI58NLgg8TUNTUlIR02KPvuTKq6duEqfbYGGpe+DL9rbOOPrXLpe8C/5t9:gFQ5Qggwg/SuL6HGGNRbOi9Pct9
TLSH
T141D25C31E868CEA7ECEA9FD5B7497646DEF411A3D48C8AD8EAD45D0D00C71AD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ba2e9e1dc9f41a03a6f9c78b80fb30c274964963f2251592dfb2b130ef63c377
MD5 5f94a33b59296b3341593fac8b25dba6
SHA1 05f1e16ef4467ddcef18aa0219fa83c31a562a3b
SHA512 5d8596fbc317a64f4c1dcd6fbf8c279b67a8d08b3ef2df1a1182acd15343ae0eb19f49c032ecd21fe3d9adc6e43e6c6e8424237b15a4901828049e9c429d3ded
SSDEEP 384:nxiF1tNn/s3n9Sn8Nggg8TUNTUlIRiPvuTZW6duEqfbYGGpe+DL9kbOObjI9G6wN:YF1j+9SXggwgUuo6HGGNSb29MJ
TLSH
T1D0D24B36E859CEB7EDEA4FA9B34A7646EEE011A7C49C5EC8DAD45D0C00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be397fe2-375f-4338-8e68-39e61f882c2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be397fe2-375f-4338-8e68-39e61f882c2a.tmp
Size 26KB
SHA256 a640d7703fbdde265f2094c550124c5202d551a30402aa9548168888b93c32cc
MD5 3d4d5d9c5cd87c0ef6aa52d326fa6fa9
SHA1 72a942ae0ef3bbac5d63197e7d97f2fce741e757
SHA512 b7850b58070e4581a9450d555b88b546c7eba562b8a73d1b0318fc63ba3123aaedbc64f0dbe45052cccccd6cbe2dbc855e0dc2a3e1d94d57b407d356c551f4ec
SSDEEP 384:nIiF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTu4REqfbYGGpeKLnOObjI9G6w738LEEy:TF1j+9SXmwgUuxUGGrn29MJ
TLSH
T159C24B32EC59CAB7EDEB4F99B34A7A46EEE01167849C5AC8DAD85D0C00C71ED0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1504-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1684-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2052-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2052-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2332-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2728-361-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3196-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3312-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3560-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3560-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3696-296-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3696-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-202-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-300-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-257-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-215-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6188-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6356-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6880-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7016-182-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads