462bf1592e77743abe337a494bc8ca03146deaaa5bcaa0b4fd7fcdd6b63cfb9c

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
Size 243KB
Sample260817-ymmcdayclc
SHA256 462bf1592e77743abe337a494bc8ca03146deaaa5bcaa0b4fd7fcdd6b63cfb9c
MD5 1fee8c43ccc6c326180d53e78fa365ad
SHA1 f3e91ce1f0e54e99062f525068c2b76ce6182cdb
SHA512 c59ce6799a22378464eeddcc3ddae09e317743b363c7c4cff782eb8a131414ec4d2db11d5878b02690123c57654391f3f57a8d908ada7d1f08296f27e9cc48f2
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:SvMsLaOa3lLNngoqRttA7h
TLSH
T163345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3720	CP.exe
3040	nkfdxvpnhf.exe
1396	CP.exe
2136	CP.exe
4740	i_nkfdxvpnhf.exe
4864	zxrpnhfzxr.sys
536	CP.exe
4192	urpkhfzxrp.exe
5960	CP.exe
4348	CP.exe
1336	i_urpkhfzxrp.exe
1200	zxupmhezwr.sys
4992	CP.exe
4336	wuomgezwro.exe
1184	CP.exe
2884	CP.exe
4160	i_wuomgezwro.exe
5720	cwuomgezwu.sys
4940	CP.exe
5524	romgebztro.exe
2472	CP.exe
5828	CP.exe
1528	i_romgebztro.exe
4416	geywuomgey.sys
1540	CP.exe
2888	wtoljdbwto.exe
2128	CP.exe
3408	CP.exe
5496	i_wtoljdbwto.exe
4644	qolgeywqoi.sys
5512	CP.exe
3684	ljdbvtnlgd.exe
5928	CP.exe
8	CP.exe
800	i_ljdbvtnlgd.exe
4160	dyvtnlfdxv.sys
4600	CP.exe
444	ayvqnigdyv.exe
5332	CP.exe
960	CP.exe
124	i_ayvqnigdyv.exe
2916	licaysqnif.sys
1684	CP.exe
2608	causnkifdx.exe
5620	CP.exe
3420	CP.exe
1544	i_causnkifdx.exe
3760	fdxvsnlfdx.sys
2476	CP.exe
2660	vsmkfcxvpn.exe
2756	CP.exe
4436	CP.exe
5260	i_vsmkfcxvpn.exe
4160	czxspkhcau.sys
3580	CP.exe
3084	cxusmhfaus.exe
4580	CP.exe
5704	CP.exe
2996	i_cxusmhfaus.exe
1524	urpmheczur.sys
2264	CP.exe
4392	zwupmheczx.exe
1476	CP.exe
2900	CP.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4072_1425971379\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4072_1739888341\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4072_1739888341\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4072_630683724\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4072_630683724\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfcxusmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmheczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgebwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmheczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgebwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfcxusmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3612	ipconfig.exe
5308	ipconfig.exe
5508	ipconfig.exe
2556	ipconfig.exe
956	ipconfig.exe
1284	ipconfig.exe
4772	ipconfig.exe
2872	ipconfig.exe
3184	ipconfig.exe
1984	ipconfig.exe
4296	ipconfig.exe
4268	ipconfig.exe
624	ipconfig.exe
1932	ipconfig.exe
4280	ipconfig.exe
4636	ipconfig.exe
4164	ipconfig.exe
3860	ipconfig.exe
516	ipconfig.exe
5228	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314700674454781"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{138BE1C7-6DA0-4758-B364-2CF828A6E4A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe
4072	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	1336	i_urpkhfzxrp.exe
Token: SeDebugPrivilege	4160	i_wuomgezwro.exe
Token: SeDebugPrivilege	1528	i_romgebztro.exe
Token: SeDebugPrivilege	5496	i_wtoljdbwto.exe
Token: SeDebugPrivilege	800	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	124	i_ayvqnigdyv.exe
Token: SeDebugPrivilege	1544	i_causnkifdx.exe
Token: SeDebugPrivilege	5260	i_vsmkfcxvpn.exe
Token: SeDebugPrivilege	2996	i_cxusmhfaus.exe
Token: SeDebugPrivilege	1500	i_zwupmheczx.exe
Token: SeDebugPrivilege	4764	i_uomgebwuoj.exe
Token: SeDebugPrivilege	4584	i_trmgeywqoj.exe
Token: SeDebugPrivilege	5736	i_qoigbytqoj.exe
Token: SeDebugPrivilege	2456	i_igaywqoiga.exe
Token: SeDebugPrivilege	4332	i_dxvpnifays.exe
Token: SeDebugPrivilege	5884	i_snkfdxvpni.exe
Token: SeDebugPrivilege	4736	i_mhfcxusmkf.exe
Token: SeDebugPrivilege	4892	i_hfzxupmkhc.exe
Token: SeDebugPrivilege	4932	i_gecwurmjeb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 4084	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	88
PID 4084 wrote to memory of 4072	4084	iexplore.exe	89
PID 4072 wrote to memory of 3668	4072	msedge.exe	90
PID 4072 wrote to memory of 5932	4072	msedge.exe	91
PID 4072 wrote to memory of 2988	4072	msedge.exe	92
PID 4072 wrote to memory of 5932	4072	msedge.exe	91
PID 4072 wrote to memory of 5932	4072	msedge.exe	91
PID 4072 wrote to memory of 2596	4072	msedge.exe	93
PID 4072 wrote to memory of 2596	4072	msedge.exe	93
PID 4072 wrote to memory of 5328	4072	msedge.exe	95
PID 4072 wrote to memory of 1444	4072	msedge.exe	96
PID 4072 wrote to memory of 5328	4072	msedge.exe	95
PID 4072 wrote to memory of 5328	4072	msedge.exe	95
PID 4072 wrote to memory of 1444	4072	msedge.exe	96
PID 4072 wrote to memory of 1444	4072	msedge.exe	96
PID 4072 wrote to memory of 4068	4072	msedge.exe	97
PID 4072 wrote to memory of 4672	4072	msedge.exe	98
PID 4072 wrote to memory of 4068	4072	msedge.exe	97
PID 4072 wrote to memory of 4068	4072	msedge.exe	97
PID 4072 wrote to memory of 4672	4072	msedge.exe	98
PID 4072 wrote to memory of 4672	4072	msedge.exe	98
PID 4072 wrote to memory of 1560	4072	msedge.exe	176
PID 4072 wrote to memory of 1560	4072	msedge.exe	176
PID 5312 wrote to memory of 3720	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	101
PID 4072 wrote to memory of 2352	4072	msedge.exe	103
PID 4072 wrote to memory of 4624	4072	msedge.exe	104
PID 4072 wrote to memory of 2352	4072	msedge.exe	103
PID 4072 wrote to memory of 4624	4072	msedge.exe	104
PID 3040 wrote to memory of 1396	3040	nkfdxvpnhf.exe	106
PID 4072 wrote to memory of 4816	4072	msedge.exe	110
PID 4072 wrote to memory of 4788	4072	msedge.exe	164
PID 4072 wrote to memory of 4788	4072	msedge.exe	164
PID 4072 wrote to memory of 3892	4072	msedge.exe	114
PID 4072 wrote to memory of 3892	4072	msedge.exe	114
PID 5312 wrote to memory of 2136	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	116
PID 5312 wrote to memory of 536	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	120
PID 4192 wrote to memory of 5960	4192	urpkhfzxrp.exe	122
PID 5312 wrote to memory of 4348	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	125
PID 5312 wrote to memory of 4992	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	129
PID 4336 wrote to memory of 1184	4336	wuomgezwro.exe	131
PID 5312 wrote to memory of 2884	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	134
PID 5312 wrote to memory of 4940	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	138
PID 5524 wrote to memory of 2472	5524	romgebztro.exe	140
PID 5312 wrote to memory of 5828	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	143
PID 4072 wrote to memory of 6092	4072	msedge.exe	146
PID 4072 wrote to memory of 1112	4072	msedge.exe	147
PID 4072 wrote to memory of 1472	4072	msedge.exe	148
PID 5312 wrote to memory of 1540	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	151
PID 2888 wrote to memory of 2128	2888	wtoljdbwto.exe	153
PID 5312 wrote to memory of 3408	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	156
PID 5312 wrote to memory of 5512	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	160
PID 3684 wrote to memory of 5928	3684	ljdbvtnlgd.exe	162
PID 5312 wrote to memory of 8	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	165
PID 5312 wrote to memory of 4600	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	169
PID 444 wrote to memory of 5332	444	ayvqnigdyv.exe	171
PID 5312 wrote to memory of 960	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	174
PID 5312 wrote to memory of 1684	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	178
PID 2608 wrote to memory of 5620	2608	causnkifdx.exe	180
PID 5312 wrote to memory of 3420	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	183
PID 4072 wrote to memory of 6000	4072	msedge.exe	185
PID 4072 wrote to memory of 6000	4072	msedge.exe	185
PID 5312 wrote to memory of 2476	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	191
PID 2660 wrote to memory of 2756	2660	vsmkfcxvpn.exe	193
PID 5312 wrote to memory of 4436	5312	2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1fee8c43ccc6c326180d53e78fa365ad_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffb9c2fc188,0x7ffb9c2fc194,0x7ffb9c2fc1a0
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2024,i,10748472040667897782,17939904009796202862,262144 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,643308572532400391,14626091463714579072,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      System Time Discovery
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2740,i,10256777731070579664,2662460763466129349,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,2344550993460563081,10708650455247006027,2097152 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,4758290060186768113,4099574106357694036,2097152 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,11305253137712227572,16085829176081015839,2097152 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,1663047198948923359,6641117597090469772,2097152 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,10820541488700651044,13576992275828231715,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,7043172468464956232,8620578702067843839,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10457489798185122825,6806673961226279890,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1959033034926984111,8184622255886058961,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,1959033034926984111,8184622255886058961,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4909776830794678673,811538076138394338,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,3536914051847718902,14385499710799003654,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,16909108492108221153,8584309714839560586,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,7611523156268961693,3430175982088086409,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,4891857347172196227,262058076378640646,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3104,i,15488811298400490896,654249649778739702,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,15011795919782002335,502732417898982763,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=1444 /prefetch:14
      4⤵
      PID:4028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8821877862058322095,10643533377861192403,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,18055053805812447773,5697151789438774569,262144 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15182296365109154579,13583109459769743769,524288 --field-trial-handle=2356,i,1098905110313988575,1405493505132515361,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
      4⤵
      PID:4664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3720
- - C:\Temp\nkfdxvpnhf.exe
    C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2136
- - C:\Temp\i_nkfdxvpnhf.exe
    C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpkhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:536
- - C:\Temp\urpkhfzxrp.exe
    C:\Temp\urpkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpkhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4348
- - C:\Temp\i_urpkhfzxrp.exe
    C:\Temp\i_urpkhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4992
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgebztro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Temp\romgebztro.exe
    C:\Temp\romgebztro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgebztro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5828
- - C:\Temp\i_romgebztro.exe
    C:\Temp\i_romgebztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1540
- - C:\Temp\wtoljdbwto.exe
    C:\Temp\wtoljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_wtoljdbwto.exe
    C:\Temp\i_wtoljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5512
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:8
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqnigdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\ayvqnigdyv.exe
    C:\Temp\ayvqnigdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqnigdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:960
- - C:\Temp\i_ayvqnigdyv.exe
    C:\Temp\i_ayvqnigdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causnkifdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Temp\causnkifdx.exe
    C:\Temp\causnkifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causnkifdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Temp\i_causnkifdx.exe
    C:\Temp\i_causnkifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2476
- - C:\Temp\vsmkfcxvpn.exe
    C:\Temp\vsmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\i_vsmkfcxvpn.exe
    C:\Temp\i_vsmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxusmhfaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3580
- - C:\Temp\cxusmhfaus.exe
    C:\Temp\cxusmhfaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxusmhfaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Temp\i_cxusmhfaus.exe
    C:\Temp\i_cxusmhfaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwupmheczx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Temp\zwupmheczx.exe
    C:\Temp\zwupmheczx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwupmheczx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2900
- - C:\Temp\i_zwupmheczx.exe
    C:\Temp\i_zwupmheczx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgebwuoj.exe ups_run
  2⤵
  PID:1528
- - C:\Temp\uomgebwuoj.exe
    C:\Temp\uomgebwuoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgebwuoj.exe ups_ins
  2⤵
  PID:1740
- - C:\Temp\i_uomgebwuoj.exe
    C:\Temp\i_uomgebwuoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmgeywqoj.exe ups_run
  2⤵
  PID:4564
- - C:\Temp\trmgeywqoj.exe
    C:\Temp\trmgeywqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmgeywqoj.exe ups_ins
  2⤵
  PID:1640
- - C:\Temp\i_trmgeywqoj.exe
    C:\Temp\i_trmgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytqoj.exe ups_run
  2⤵
  PID:4172
- - C:\Temp\qoigbytqoj.exe
    C:\Temp\qoigbytqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytqoj.exe ups_ins
  2⤵
  PID:5724
- - C:\Temp\i_qoigbytqoj.exe
    C:\Temp\i_qoigbytqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqoiga.exe ups_run
  2⤵
  PID:3740
- - C:\Temp\igaywqoiga.exe
    C:\Temp\igaywqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqoiga.exe ups_ins
  2⤵
  PID:4060
- - C:\Temp\i_igaywqoiga.exe
    C:\Temp\i_igaywqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifays.exe ups_run
  2⤵
  PID:3404
- - C:\Temp\dxvpnifays.exe
    C:\Temp\dxvpnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifays.exe ups_ins
  2⤵
  PID:912
- - C:\Temp\i_dxvpnifays.exe
    C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpni.exe ups_run
  2⤵
  PID:2308
- - C:\Temp\snkfdxvpni.exe
    C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpni.exe ups_ins
  2⤵
  PID:2364
- - C:\Temp\i_snkfdxvpni.exe
    C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfcxusmkf.exe ups_run
  2⤵
  PID:5824
- - C:\Temp\mhfcxusmkf.exe
    C:\Temp\mhfcxusmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfcxusmkf.exe ups_ins
  2⤵
  PID:5052
- - C:\Temp\i_mhfcxusmkf.exe
    C:\Temp\i_mhfcxusmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxupmkhc.exe ups_run
  2⤵
  PID:5276
- - C:\Temp\hfzxupmkhc.exe
    C:\Temp\hfzxupmkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxupmkhc.exe ups_ins
  2⤵
  PID:5588
- - C:\Temp\i_hfzxupmkhc.exe
    C:\Temp\i_hfzxupmkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gecwurmjeb.exe ups_run
  2⤵
  PID:664
- - C:\Temp\gecwurmjeb.exe
    C:\Temp\gecwurmjeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gecwurmjeb.exe ups_ins
  2⤵
  PID:5012
- - C:\Temp\i_gecwurmjeb.exe
    C:\Temp\i_gecwurmjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4716

C:\Temp\zxrpnhfzxr.sys
C:\Temp\zxrpnhfzxr.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\zxupmhezwr.sys
C:\Temp\zxupmhezwr.sys
1⤵
- Executes dropped EXE
PID:1200

C:\Temp\cwuomgezwu.sys
C:\Temp\cwuomgezwu.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\geywuomgey.sys
C:\Temp\geywuomgey.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\qolgeywqoi.sys
C:\Temp\qolgeywqoi.sys
1⤵
- Executes dropped EXE
PID:4644

C:\Temp\dyvtnlfdxv.sys
C:\Temp\dyvtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1560

C:\Temp\licaysqnif.sys
C:\Temp\licaysqnif.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\fdxvsnlfdx.sys
C:\Temp\fdxvsnlfdx.sys
1⤵
- Executes dropped EXE
PID:3760

C:\Temp\czxspkhcau.sys
C:\Temp\czxspkhcau.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\urpmheczur.sys
C:\Temp\urpmheczur.sys
1⤵
- Executes dropped EXE
PID:1524

C:\Temp\bzxrpjhbzu.sys
C:\Temp\bzxrpjhbzu.sys
1⤵
PID:2612

C:\Temp\wtrljhbzwr.sys
C:\Temp\wtrljhbzwr.sys
1⤵
PID:2812

C:\Temp\tolgdywtrl.sys
C:\Temp\tolgdywtrl.sys
1⤵
PID:3000

C:\Temp\igaywqoifd.sys
C:\Temp\igaywqoifd.sys
1⤵
PID:4916

C:\Temp\gdyvqnifdy.sys
C:\Temp\gdyvqnifdy.sys
1⤵
PID:5096

C:\Temp\xvsnlfdavs.sys
C:\Temp\xvsnlfdavs.sys
1⤵
PID:3536

C:\Temp\kifaxspnhf.sys
C:\Temp\kifaxspnhf.sys
1⤵
PID:6036

C:\Temp\fzwupmkeca.sys
C:\Temp\fzwupmkeca.sys
1⤵
PID:5264

C:\Temp\pmhezwupmh.sys
C:\Temp\pmhezwupmh.sys
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomgezwu.sys

Path C:\Temp\cwuomgezwu.sys
Size 141KB
SHA256 5ac85df510a45a5a1e274109116f92b54028aeb8a54b4fb05fb6ed41323b1691
MD5 53b8db4f3ad2d90019689295ff63f779
SHA1 636eec65585ba02659b5270f49be228bf3cbcb3c
SHA512 67d7c700edd1633742cf7a4644148d4a30705e542ca0630718d7c46b8a9fa9f4f8535db860dbd0d6fb6e7e23c813d6744a560a6e6ea03c8ec6196d0d74b02aa5
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnlfdxv.sys

Path C:\Temp\dyvtnlfdxv.sys
Size 141KB
SHA256 67883d0a2d4d0e8a5ee9341ca161b729f08022f132918aaa1cab9353b0aeb312
MD5 d30874f1512272d556d7768bd02d28b5
SHA1 607d0be180602ab7c43d68841800c3c767196dc1
SHA512 d2affe6ade99f10e78c2d8ffeef738a3849f37ccc56960085be4c61a6df3897d505dd54f6873475ba9226614bf24168624807e72024c0c0c0328cb1cc1fcea4b
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuomgey.sys

Path C:\Temp\geywuomgey.sys
Size 141KB
SHA256 9bf29a27279ed6a92d97852b7746ba21e5787a2bb423033b59e2b1231ca93f18
MD5 2eae069fb4efd19534931aef4cb12528
SHA1 bbd6cb20794d75483b87a26c4fc72d2b7725e56a
SHA512 a2bc1a92c21d0d4b45bea3935c102f02c09e476d0486cb728d3a3cb273baa96d4d82cb020b66903cda7f1775acca6faf9f4bbcd0af1de93e3398b24dae655160
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 243KB
SHA256 96cdf1b8a91eef9299356b720bd220b19c233860082bbc9360a3be5c94dfa96d
MD5 82945130befab7a9dcf0bd67704de300
SHA1 b2828a83781aca05432ed2d5a33565da134e5420
SHA512 81fdf1bfd4a5f3059687ccc168091151208f5befb10149485e4eab1095c700269aa05475158d7811d881b919a0b4f1f2fa14f11d2c56d6b594b5cf1fe274b188
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:FvMsLaOa3lLNngoqRttA7I
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnhf.exe

Path C:\Temp\i_nkfdxvpnhf.exe
Size 243KB
SHA256 345a493e87610e907e8b674063789328f3c5d15221bbbf2206594d9984ff51f9
MD5 c22c9e14fcc9773219b5f9a30d295294
SHA1 e52bcf2bb3c3ae5ce22d40668800da49e486e0be
SHA512 0326f0da566750506ba0282fed43add0f86d39fb8811d16311a8b6a0d6137fd3011b417bd21f52a5e6584bf4770258fa750de1d4f7b87a2c19db0fabd0cc11c3
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:7vMsLaOa3lLNngoqRttA7i
TLSH
T1D2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgebztro.exe

Path C:\Temp\i_romgebztro.exe
Size 243KB
SHA256 a4a845597612097dd341f7daa15b4f54de72494d4fe45c30828eee46258fc94d
MD5 5d816006ed13ae6ebf51259c7c192905
SHA1 77f4239cfed8cd70663f5698c1385d15cc6a3563
SHA512 95e5685815252260b9c6039b25cdc355dfddcbfe4c8674a6b298230b8cdd1506a110832452ad4b7a00acd60fc79fcf4acd0603ba6460a0c79a86753a139b3e4e
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:svMsLaOa3lLNngoqRttA77
TLSH
T1BF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpkhfzxrp.exe

Path C:\Temp\i_urpkhfzxrp.exe
Size 243KB
SHA256 14e998675586aa503364ec684762c3ba60c47c375c368a1755f24e380a596f5c
MD5 5385459795a0727b6e206bc6fb78f4b7
SHA1 73524f489a335e39deb5781b30b104bc5295524b
SHA512 3edfe22ef69d34d1b0c8d68e65e3e2fc96959f77d92babe5717e6c45481eb847bec8cbb2bc3248881a760e354348dcbe6ede779143aae35db76901d004915cac
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:yvMsLaOa3lLNngoqRttA7l
TLSH
T11E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtoljdbwto.exe

Path C:\Temp\i_wtoljdbwto.exe
Size 243KB
SHA256 7688b83ec66ba15ccf8e8dc940df13e02c5668bb067c2fdb9303968e8c55b154
MD5 cafd79121097f703995c198d1777a254
SHA1 868317c7953902171593ec9b55549d19273d21cc
SHA512 83b4467406f04ed34c3ba164b8875f3f266b1679a4f5f5812640be846a76b6d3d94a9d74edfc9bf481f864fc23cf2575649084e49a65c7e674c6a460424279ba
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:evMsLaOa3lLNngoqRttA7h
TLSH
T1CB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwro.exe

Path C:\Temp\i_wuomgezwro.exe
Size 243KB
SHA256 4fc052d290594364a66d4cb94d9302758684c60da1c1231d538739dc837f8bdb
MD5 73006f21e6259604e261f3d26f19459c
SHA1 ee9667619414ce54b6474a79accbf6d6830d03ac
SHA512 d81916439b7ae296d4548812aca27f2de0277f77b6911c1cf10940febb83eaafdf358a0b34671ef83047a7b68ec6b524fed59e3099827a2cb79f37b4976f4816
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:7vMsLaOa3lLNngoqRttA76
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 243KB
SHA256 36b8541899784916f40055bb4881ac0f131c70c6a2bce03db214e16883df84fb
MD5 4c8a78498bb854737f7e0e2e6f900947
SHA1 6ca6bb2cfcb0b8e5417f77fe8beb2929e8f54bad
SHA512 81ad7ad1e97884d4b9536475834d85a98d9f0f1d52e3ed93da4fb3c932a5ba11fde1065a91072725bc733439a7e46a8c2634f98d691288746c2be48db214fda3
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:MvMsLaOa3lLNngoqRttA7T
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.exe

Path C:\Temp\nkfdxvpnhf.exe
Size 243KB
SHA256 01304829bb88ea207b82e616cc49ed920ad3343c5f4d61ab6c81750d1e644985
MD5 d46efb24348810ccbec532feab47d8aa
SHA1 ffe10a3a8993d5b7c94fe7c4eda43c0e8554aa1a
SHA512 de19731678a31654289d163d263f04224587a9fc6b4076219e1d4f918973e9066cefd53aabed4f1932a92e8a8336f9c3f1291c0dd7da4d0a2c992ebd7f15e4ff
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:UvMsLaOa3lLNngoqRttA7D
TLSH
T1AC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgeywqoi.sys

Path C:\Temp\qolgeywqoi.sys
Size 141KB
SHA256 79125952bbb3376d54e30f62485ca62d4dedb07a364a71a0bf9d352b69240c27
MD5 2f56fbb08332986080af0eabfbf93bc9
SHA1 d222a83981da090a68ee85fca4e88041734e632b
SHA512 7b7396fee66bbef79b2d97340a7bb96d936d1b77f3ceafb881836160a8e616e4c571744a092a97bd47c0481e512f6dc832565291944687fbd143d0a616ef9be7
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgebztro.exe

Path C:\Temp\romgebztro.exe
Size 243KB
SHA256 dfe656735f9d122fc243016ef4136817eb3a73baa3b3f82d517b0d04c1e15385
MD5 65a4509723d000e72c557febf74cac25
SHA1 2b619f3e5fa1587b1255a218760866f10c485bf8
SHA512 617a32f1c0c3032e81c84701bccc1b8d8c9c2ca1bf1f2ceb9e7146f8e379ae6cf6a811f9e26ff2ed7f724a81bfecf1af8dd218e7353c39cf567762c517da8b8e
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:OvMsLaOa3lLNngoqRttA7p
TLSH
T181345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpkhfzxrp.exe

Path C:\Temp\urpkhfzxrp.exe
Size 243KB
SHA256 7035aec3c1e18dbef0380001f19044e0581b81a2fa8b40f6ac82f5747f0ff4c6
MD5 c99f1be1ea8e0129744779e54b4b8e0b
SHA1 4793d348f61f4dc8e8111c066082a1ec3d1718ce
SHA512 8c4bb9adf277bc5aa45cb1c39e90e0349ded6538b96e0206d5f347e54c44623527fc57c90ce2c9d37971517c586263f8d0dbcc613645cbfffb6cc0ab2496f2fa
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:ovMsLaOa3lLNngoqRttA7D
TLSH
T155345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljdbwto.exe

Path C:\Temp\wtoljdbwto.exe
Size 243KB
SHA256 185e04066cd6af92f59e1c8899473fb91a08a4a410e49e6a61532b0cbfc62023
MD5 d2383b6a2a6b79f99601f083ec9ffcc3
SHA1 9ae3e7b9c41598d90df5871a6a64761cf9ca2e50
SHA512 2a1c8adae9057ae59cdebbab421bb083e3b7f70bbc24eb2b6984a63c86790f7ab03ce531b1a968264475014de85ced04e42979c16e361fe6dd667f03f24d6472
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:rvMsLaOa3lLNngoqRttA7m
TLSH
T15E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwro.exe

Path C:\Temp\wuomgezwro.exe
Size 243KB
SHA256 093bd4cd6539b22f0533edb01bb6e178b081b825d4788903c2025d141c666e22
MD5 04f83e0bfa126b3d0ad5132bddc749d9
SHA1 9495f5fe8d468390b553c103770044d117816516
SHA512 188869991242b2246edf6c59d3619a165ee910890d5b725da1090b2e6e5a9fa54f31de657d48600c718c3af59126ba0cd6ed5570c9b41bc4a87e21171e7937c8
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:2vMsLaOa3lLNngoqRttA79
TLSH
T1E6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpnhfzxr.sys

Path C:\Temp\zxrpnhfzxr.sys
Size 141KB
SHA256 da521905cd9828b8305cdf67279f023e7d5e68a6877e81cc837f3a36a641b763
MD5 3484474e5bf3a4678f06fd954c853caa
SHA1 429802d78aba48808a87ee708f62ff0d479ea1d7
SHA512 e390b41c9f9412905271e8ddf160f1dbc09006cc719732ac8a906d5f6e5af8042de0fac80292eedc61693e2bada6b4baeda852b5c2eaea7c2a3a9af076e3498e
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmhezwr.sys

Path C:\Temp\zxupmhezwr.sys
Size 141KB
SHA256 a024fbc4a228f73a207bf84d1c8bcc923c7397611f04e0ccfa8d7eacb7ecd9ad
MD5 ff9dc428f3b2c1d2d7195fe4357f12f9
SHA1 03042117d2cbf010e81191bce0abaefeacb68be5
SHA512 ffaf528cb57a51f0e58b4e55311e1caba0dcc34d0a655200bfe3e23517be483058d019f76c0b4140287b2c393baec94dcffb18793afe48ef7333c9b74e5b7455
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01b053646982a73d5d66463f81522bf1ba48f97c3fb4cd04348a9ffe19524e9a
MD5 1cb3cb1a9b8873cb109ba8b9f368d907
SHA1 b551fffa631d461773c0b5ef9c9e941b6a73d95c
SHA512 4cdb6dc78df0a68112f7e91ae5ca328362fca9f4a2d154232492f81cf0bb43d048af1164a2a885698cfb979bb0cc92961b56abcb91bbe801a18e30dd0afd681d
TLSH
T1B961C794032E8DE3FB658671D0E150DEF2F488C4939B2E2D1DF0E678A48EF756447425
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3673.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a3673.TMP
Size 3KB
SHA256 42bdd4444cc6686c0549db670096a94ab059dc187ea626f4db673559f6aa352e
MD5 842ac3fa221a08e86c90106b7b9e0f06
SHA1 f6d228478857c0234e7881d137c17e83c155f4e0
SHA512 de41c75e809dfb476ccdcfdef6914e0fd8b1b18cebdc2d303d117f3297bb50be53f7fc159a7d5f27ae03c2954ddfeb1ec8c2d9a50cbcb3b6fbd622db92ac4c58
TLSH
T19F61C694032E8DE3FB658671D0E150DEF2F488C4939B2E2D0DF0D678A48EF356447025
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1d9e2550c9b0e6dac823668adb642b901fe7d185b3e4e2fbd9ea571b7ba30a2c
MD5 38ecc22f0c5423314ec6767f8c987ec6
SHA1 bc33b04d6fc4c82b8db012735c9b40b4697d7bdd
SHA512 d261a1b2fdb0fd274517d737cd7eb1d00157f20bc6aca88601c5ed5825a29423e17fc85e8e3592ce6aeb0bee67a172b6d065f6dc69419a3d571fc8da3770a592
TLSH
T13A41ADF783F4856E991196F0AB186E1BCF2C0511432C7D5AC9E0AF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8fd5447dc198fd1e1bb21f641ec9e92e949ec55f80b06f734bc3c07c51df94a9
MD5 a363a2a87d665fa520be30d06b50dea2
SHA1 a7fe5ba36a2d51f98864d78145ae5e707f8fd113
SHA512 f93952fcc4464098f6cf875c2425996ee9e41674f378c765e7f27636ef5bad234696f1e37852cb4a2a65eb9af72953458b292973c10bad4723e2f5f4f3bd5697
SSDEEP 192:sxRjRnyM/jK1Ml8wCn/fFsgHpvZxbwzoA8p97/g6+WNCJW/YZ7qqhsaGNIgVggJ:sxRjF8n/fFsqpxVpB/59/z3aE
TLSH
T16262D915AA34997BCCDBD20DFA557F53D6F81573A2900E44AEFC8A1C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d51f615c45e335717b3c0a34874ded54dae64ea934ad48027330c67f6fdcc176
MD5 6ea7a5ff16d0ade755c7043064e9627a
SHA1 27e72ab77ad29f5c71d47748454710ba87c85425
SHA512 1914a02bf26644d0dad8bd7545b6364bbc2093f8f817a3a08532acf1a160d53a8949bcf1284a0d522c818597ecb7062895b0dbac9afb4f9320a459fbb08fd268
SSDEEP 192:sxRMRnyM/jK1Ml8wCn/fFseHpvZxbwzoA8p97/g6+WNCJW/YZ7qqhsaGNIgDEggJ:sxRMF8n/fFsIpxVpB/59/z3DE
TLSH
T19D62C915AA34997BCCDBD20DFA557F53D6F81572A2900E44AEFC8A1C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 887b4143e3fe857122eb05d628f2c1b7e6de4e39f1df78d43f44e3458c64c7f3
MD5 3091ca9e31091b2ad05c8cbdff62546d
SHA1 118b44407b135151715740045edaab248fff41fa
SHA512 1bf1a6bb40f18657de221cb65e159fa7406c98d7d063103a072f073b6d07d2dbc616346837d6204f7b9c7132a539e8b1fa2e0ac40bcaa27ea0353ba3a0318a78
SSDEEP 192:sxRMRnyM/jK1Ml8UQaCn/fFseHMvZxbwzoA8pr7/g6+WNCJW/YZ7q2vsaGNIgDmF:sxRMFqdn/fFsIMxVpX/59/33JE
TLSH
T1A462C815AA34997BCCDBD20DFA557F53D6F81572A1900E44AEFCCA1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 77d436cc4a6f4eea9f54162401fe722eceb301edf85760bc1f0ab62f3c1e5e20
MD5 defd80df32617bb4274e28267b33f913
SHA1 f98c0ba43e534a84cd9d2eafc2f607e59678b795
SHA512 e5bf5567a890a0d8a449dc0c70d43bab1887f7ce34779c0a5eb05646f6661e3a33fdb8d86ab3363843cff97265e1f1cd5c72bade2e397aabcbef17fa62dc9c84
SSDEEP 768:kfISpS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAIGSV2sroHh0mU:kfISpqE7CvWgd5fWbu1jaPIGU23Hh0mU
TLSH
T13BE2ED3B640CCB7F4F8049DCEC297E9AADE802CF96D8C99447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 808cddf56b0032d26bb36d879168ea6987af2d8359fdbbdbf711006c2f56267b
MD5 5e5b97733341ac7ca9cd52febd69f5e2
SHA1 df2888013c54d40b2677a442061a8697cf8d0e3d
SHA512 e5fe16b390a8d41902630bcdc8337ea500b49f0a86edfa899cc1ddf40b7edeadac4e2d532b05a3e98f52923ca06c2c06a763a36bd25f95892befdf690c485d6b
SSDEEP 24:KSitLEitHitWitIPitNSitmitGitx1itaitBDitsI4itSitxKXitOhPitoitx1RO:KsSIfKjCsLyhIIHK1WstnIFK0cwnyhz
TLSH
T1C791069575FB86103CBE261C91A8C617AA81F0773019AE6B37E821B10F67F015DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7ead1ba-2e91-4063-b35b-e5043f8df640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7ead1ba-2e91-4063-b35b-e5043f8df640.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad7d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad7d3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 71a3e0d180c1160796bc1a5110c5028f7a2c784824ab262a4d1bc4f7c212d2e3
MD5 f95ea2532f9beeec8d877634586b26ee
SHA1 3ced95d3556cf1049f475b39a4dcf98990281f54
SHA512 2a5f6e542eb840062bee1153d84cae9277d0f9169df122377e890ddfaab21642acaacaa15e19a79c2bd896bd0685d5bd9e72f2dacb8a72bd1886ffc8246d94be
SSDEEP 768:FFZ3Izh63HwgvIhLjLXAam6aQMGdjWca4Ghf9/vH:13Iw3SmaME6p/v
TLSH
T19B03F7F198E78937D89E5783A33D6E86A9BCC163B4884984FBD55D0CCD821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b4280ed704f140f7f46d845eeaeb3cbbc8cf0a4576ce0fcad52c7150c10b8ec4
MD5 356b91c1de394f7f72f285a71fb27423
SHA1 b0ded0703c3ce757bf9fbc28c4982c4be5204682
SHA512 775a4468ac54846b204d7117a7f32e9320c4bedad5ee314dcac61dfb054c52a928725e8b64ce50ef058d9816c244f2c4f2212255ed822e756816fc90c0543532
SSDEEP 768:/rv+4UNbdq379q3LoAAam6aQMGdjWca4GhfByPeU/:/bsbc3RKmaME6pKH
TLSH
T1E3F2AE31A86C9973DDB79A99F21B6787BEF421A394C40E80CDD96B0D439718E2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 47027ab3130efed2abef77141f6954203645d00d36d29d7891c0c3f146c3e644
MD5 186739a40de522b7d245c9f85fde18f9
SHA1 bf040a17048173396ba905a9011c2c1c3a7d2e4c
SHA512 2cf6cb670b4f0f0be662b8e1b476120017a73bbacfb8e5f1b41046783436f836ffdfbf90f68de9813093d55401463414e820e4b2e1acd7fe71b16759b37b28e9
SSDEEP 768:irv+4UNbd43Tkq3LjLUaAam6aQMGdjWca4Ghf9/gc:ibsby3W0maME6p/N
TLSH
T1BDF2AF31A87CD8339CB7A295F25B7683BEB412B398C40E84D9D96B0D429718E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e5741e9a9c49f19bf0fbb4b7eac6bfe384ab4cdf7f1222d3bce5b306cc852800
MD5 de5c22a4896e368cf495b11ea44b289a
SHA1 775d5c176143a536ee6bed36e6109f087c727fdb
SHA512 0a389e2639038340fd18775d6386b54e527fbee5e6147d95e263e83008e719aac7ce18ab8102a791c8657f2c3ef0492cf6bd3af9504328ea4513fdd732040e7b
SSDEEP 768:I3Izhg3Mkq3LjLUjAam6aQMGdjWca4Ghf9/vH:I3I23LFmaME6p/v
TLSH
T19BE28F716868DD739CA7A195F72B33C7FEB0127398D80E84D9E95B1D468318E270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d8b9982f632a8c5343922a47a401ec88a7ebc4a209eb01319e66bfc9cfec710b
MD5 5afdcf891a8c368cb0305d83cc97a96e
SHA1 bb7c0c3a3436c7439b210367e27c78d254a5ab85
SHA512 445407811bafb50dfb348c3020770d5431f72563c2f22d29640f303122b23b4e64e3f97669030e5e63d7ce2a0fbdf8e1513c2bf254efcd6749095c27ef290078
SSDEEP 768:Frv+4UNbdq3+Oq3LjLU0Aam6aQMGdjWca4Ghfw/PeU/:Fbsbc3vWmaME6poH
TLSH
T163F2BF31A46CD8739CB7A295F25B6787BEB022B388C40E84D9D96B0D429718E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e8132e939585df26773e7e8de479ad5566b2bb907a76955c67d66993f4272fa8
MD5 77d00c8be2300f0ad2304b7e89da6fd0
SHA1 645496b795ac9e2b6a519cead0d19e3cdef249ab
SHA512 3257fe02f1b7f488656d5ee6f38b93e4be3201b8bf393793721ac896321e079e3f31b67b09bee20960ba1aa75ca7def6b279b0321ba21f6fd580614994d566cf
SSDEEP 768:n3Izhg3dkq3LjLUjAam6aQMGdjWca4Ghf9/vH:n3I23wFmaME6p/v
TLSH
T1B1E28E716868D9739CA7A195F72B33C7FEB0127398D80E84D9E95B1D468318E270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

0c147158-11dc-4816-a209-96b1a75dff72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0c147158-11dc-4816-a209-96b1a75dff72.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4072_494731359\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1524-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3000-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3536-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3536-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4644-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4864-185-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4916-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4916-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4920-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5264-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6036-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download