09c576936eaebb28f246e8628812875eb2b47d27a483affae9f33ccfcf6c4d12

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 13:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-ql1vdazvex
SHA256 09c576936eaebb28f246e8628812875eb2b47d27a483affae9f33ccfcf6c4d12
MD5 631fd698622e8067e32306bc0a6c2f7b
SHA1 54cd68410ed3fbd50508f53edd3e410e8a83659b
SHA512 174675ed36622b4c71cf6969539bc77b0554a087affc464a4e839d6a4e4720ff27953a4c0d0391e0089ce7c28316ace4d8a7adcb8ee44b3d490f8cf0ccbe003f
SSDEEP 3072:LhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:NiA7nLtm/ka3lLNngoqRttA79
TLSH
T17C345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5508	CP.exe
720	fzxrpjeczu.exe
4432	CP.exe
4312	CP.exe
4232	i_fzxrpjeczu.exe
2636	pmhfzxrpjh.sys
4656	CP.exe
4304	bzxrpjhbzt.exe
5776	CP.exe
2404	CP.exe
4592	i_bzxrpjhbzt.exe
2068	zwromgeywr.sys
1528	CP.exe
5404	zwromgebzt.exe
4428	CP.exe
4168	CP.exe
240	i_zwromgebzt.exe
2760	olgdbztrlj.sys
5948	CP.exe
5000	qojgbztomg.exe
4160	CP.exe
2348	CP.exe
3444	i_qojgbztomg.exe
2600	gaytqoigay.sys
4680	CP.exe
5996	bytqligayt.exe
4512	CP.exe
5096	CP.exe
5412	i_bytqligayt.exe
3188	ayvqnljdbv.sys
3892	CP.exe
1092	qkigavsnki.exe
4092	CP.exe
3632	CP.exe
4240	i_qkigavsnki.exe
2500	aysqkicayv.sys
200	CP.exe
5288	axspnlicay.exe
5372	CP.exe
5860	CP.exe
1084	i_axspnlicay.exe
1180	hfcaxspnki.sys
980	CP.exe
1028	mkifaxvsnk.exe
1892	CP.exe
3152	CP.exe
6112	i_mkifaxvsnk.exe
1660	xupnhfzxrp.sys
252	CP.exe
4572	wusmkecxur.exe
3956	CP.exe
5204	CP.exe
5612	i_wusmkecxur.exe
5716	xrpkhczurp.sys
2660	CP.exe
3484	kecwuomhez.exe
2664	CP.exe
2308	CP.exe
2696	i_kecwuomhez.exe
2444	rpmhezxrpj.sys
4756	CP.exe
5680	trmjecwuom.exe
3740	CP.exe
3272	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1999942641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_582124997\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1178955236\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1178955236\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1547838669\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1547838669\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_582124997\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1547838669\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1547838669\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkecxur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkifaxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspjhfcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspjhfcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkifaxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkecxur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwromgebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbytqoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4424	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5860	ipconfig.exe
5008	ipconfig.exe
5972	ipconfig.exe
5876	ipconfig.exe
5064	ipconfig.exe
672	ipconfig.exe
3492	ipconfig.exe
6072	ipconfig.exe
4632	ipconfig.exe
4964	ipconfig.exe
2096	ipconfig.exe
1360	ipconfig.exe
1212	ipconfig.exe
4564	ipconfig.exe
2548	ipconfig.exe
3968	ipconfig.exe
2068	ipconfig.exe
6056	ipconfig.exe
240	ipconfig.exe
4388	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{8A3A2646-AC3B-4A37-ACF2-A19C5CAD8106}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	msedge.exe
2872	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe
6032	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	i_fzxrpjeczu.exe
Token: SeDebugPrivilege	4592	i_bzxrpjhbzt.exe
Token: SeDebugPrivilege	240	i_zwromgebzt.exe
Token: SeDebugPrivilege	3444	i_qojgbztomg.exe
Token: SeDebugPrivilege	5412	i_bytqligayt.exe
Token: SeDebugPrivilege	4240	i_qkigavsnki.exe
Token: SeDebugPrivilege	1084	i_axspnlicay.exe
Token: SeDebugPrivilege	6112	i_mkifaxvsnk.exe
Token: SeDebugPrivilege	5612	i_wusmkecxur.exe
Token: SeDebugPrivilege	2696	i_kecwuomhez.exe
Token: SeDebugPrivilege	3744	i_trmjecwuom.exe
Token: SeDebugPrivilege	1116	i_zwrojgbywq.exe
Token: SeDebugPrivilege	4444	i_lgdbytqoig.exe
Token: SeDebugPrivilege	3440	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	5160	i_lidavsnlfd.exe
Token: SeDebugPrivilege	4820	i_pnkicavsnl.exe
Token: SeDebugPrivilege	2796	i_rpkhcausmk.exe
Token: SeDebugPrivilege	3820	i_xspjhfcauk.exe
Token: SeDebugPrivilege	6088	i_bzxrpjhczu.exe
Token: SeDebugPrivilege	4908	i_ebwuomgeyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 5644	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	89
PID 5644 wrote to memory of 6032	5644	iexplore.exe	90
PID 6032 wrote to memory of 2976	6032	msedge.exe	91
PID 6032 wrote to memory of 5040	6032	msedge.exe	92
PID 6032 wrote to memory of 4424	6032	msedge.exe	93
PID 6032 wrote to memory of 5040	6032	msedge.exe	92
PID 6032 wrote to memory of 5040	6032	msedge.exe	92
PID 6032 wrote to memory of 5784	6032	msedge.exe	94
PID 6032 wrote to memory of 5784	6032	msedge.exe	94
PID 6032 wrote to memory of 5268	6032	msedge.exe	96
PID 6032 wrote to memory of 3180	6032	msedge.exe	97
PID 6032 wrote to memory of 5268	6032	msedge.exe	96
PID 6032 wrote to memory of 5268	6032	msedge.exe	96
PID 6032 wrote to memory of 3180	6032	msedge.exe	97
PID 6032 wrote to memory of 3180	6032	msedge.exe	97
PID 6032 wrote to memory of 5936	6032	msedge.exe	98
PID 6032 wrote to memory of 2880	6032	msedge.exe	99
PID 6032 wrote to memory of 5936	6032	msedge.exe	98
PID 6032 wrote to memory of 5936	6032	msedge.exe	98
PID 6032 wrote to memory of 2880	6032	msedge.exe	99
PID 6032 wrote to memory of 2880	6032	msedge.exe	99
PID 6032 wrote to memory of 5844	6032	msedge.exe	101
PID 6032 wrote to memory of 5844	6032	msedge.exe	101
PID 4380 wrote to memory of 5508	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	102
PID 720 wrote to memory of 4432	720	fzxrpjeczu.exe	105
PID 6032 wrote to memory of 5916	6032	msedge.exe	106
PID 6032 wrote to memory of 5240	6032	msedge.exe	107
PID 6032 wrote to memory of 5916	6032	msedge.exe	106
PID 6032 wrote to memory of 5240	6032	msedge.exe	107
PID 6032 wrote to memory of 3908	6032	msedge.exe	111
PID 6032 wrote to memory of 4644	6032	msedge.exe	112
PID 6032 wrote to memory of 4644	6032	msedge.exe	112
PID 6032 wrote to memory of 4532	6032	msedge.exe	113
PID 6032 wrote to memory of 4532	6032	msedge.exe	113
PID 4380 wrote to memory of 4312	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	116
PID 4380 wrote to memory of 4656	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	120
PID 4304 wrote to memory of 5776	4304	bzxrpjhbzt.exe	122
PID 4380 wrote to memory of 2404	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	125
PID 4380 wrote to memory of 1528	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	129
PID 5404 wrote to memory of 4428	5404	zwromgebzt.exe	131
PID 4380 wrote to memory of 4168	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	134
PID 4380 wrote to memory of 5948	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	138
PID 5000 wrote to memory of 4160	5000	qojgbztomg.exe	140
PID 4380 wrote to memory of 2348	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	144
PID 6032 wrote to memory of 5176	6032	msedge.exe	146
PID 6032 wrote to memory of 2664	6032	msedge.exe	147
PID 6032 wrote to memory of 3064	6032	msedge.exe	148
PID 4380 wrote to memory of 4680	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	151
PID 5996 wrote to memory of 4512	5996	bytqligayt.exe	153
PID 4380 wrote to memory of 5096	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	156
PID 4380 wrote to memory of 3892	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	160
PID 1092 wrote to memory of 4092	1092	qkigavsnki.exe	162
PID 4380 wrote to memory of 3632	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	165
PID 4380 wrote to memory of 200	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	169
PID 5288 wrote to memory of 5372	5288	axspnlicay.exe	171
PID 4380 wrote to memory of 5860	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	174
PID 4380 wrote to memory of 980	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	178
PID 1028 wrote to memory of 1892	1028	mkifaxvsnk.exe	180
PID 4380 wrote to memory of 3152	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	183
PID 6032 wrote to memory of 3716	6032	msedge.exe	185
PID 6032 wrote to memory of 3716	6032	msedge.exe	185
PID 4380 wrote to memory of 252	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	191
PID 4572 wrote to memory of 3956	4572	wusmkecxur.exe	193
PID 4380 wrote to memory of 5204	4380	2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_631fd698622e8067e32306bc0a6c2f7b_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x330,0x7ffaeef8c188,0x7ffaeef8c194,0x7ffaeef8c1a0
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,7053201767313586945,2695254635840706504,262144 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,18279785387342081707,17309160923578190866,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:11
      4⤵
      System Time Discovery
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,9759191360903328829,7399531735068018927,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7156329882232491447,3563579181610548711,2097152 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,16975480836407552327,16563430884655313153,2097152 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,2509693657683903369,6466233864477717553,2097152 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:9
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,10772003372317011990,192913475940837432,2097152 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6821892228383414542,17521824836789656097,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,957030725803204515,9115827645420311958,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,11900137092868355990,7138028925793804477,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15183336494500191187,8868613339282591648,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,15183336494500191187,8868613339282591648,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,12060997138302164724,14674082548124546827,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13064458604617179363,14931344942068991843,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,1253131536457648561,17084600835177200919,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,4502383054722572713,16638932964355914572,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,3347639342931349743,17669575454173903207,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,7554362243526352697,5428696713183654517,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,1318631071711065084,8170616753262431005,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,13443299875801142819,15913379994703804282,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,2530586160777018415,12015885334029846476,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6648,i,14132720930465243069,7570663931025798624,262144 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13630375639128759723,13022174730036324559,524288 --field-trial-handle=2368,i,15632273443569264609,18342096471107952171,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpjeczu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5508
- - C:\Temp\fzxrpjeczu.exe
    C:\Temp\fzxrpjeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpjeczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4312
- - C:\Temp\i_fzxrpjeczu.exe
    C:\Temp\i_fzxrpjeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzxrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4656
- - C:\Temp\bzxrpjhbzt.exe
    C:\Temp\bzxrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzxrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\i_bzxrpjhbzt.exe
    C:\Temp\i_bzxrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwromgebzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1528
- - C:\Temp\zwromgebzt.exe
    C:\Temp\zwromgebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwromgebzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\i_zwromgebzt.exe
    C:\Temp\i_zwromgebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbztomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\qojgbztomg.exe
    C:\Temp\qojgbztomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbztomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\i_qojgbztomg.exe
    C:\Temp\i_qojgbztomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqligayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4680
- - C:\Temp\bytqligayt.exe
    C:\Temp\bytqligayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqligayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Temp\i_bytqligayt.exe
    C:\Temp\i_bytqligayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkigavsnki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3892
- - C:\Temp\qkigavsnki.exe
    C:\Temp\qkigavsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkigavsnki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3632
- - C:\Temp\i_qkigavsnki.exe
    C:\Temp\i_qkigavsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspnlicay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\axspnlicay.exe
    C:\Temp\axspnlicay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspnlicay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5860
- - C:\Temp\i_axspnlicay.exe
    C:\Temp\i_axspnlicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkifaxvsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Temp\mkifaxvsnk.exe
    C:\Temp\mkifaxvsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkifaxvsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\i_mkifaxvsnk.exe
    C:\Temp\i_mkifaxvsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wusmkecxur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:252
- - C:\Temp\wusmkecxur.exe
    C:\Temp\wusmkecxur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wusmkecxur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Temp\i_wusmkecxur.exe
    C:\Temp\i_wusmkecxur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2660
- - C:\Temp\kecwuomhez.exe
    C:\Temp\kecwuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2308
- - C:\Temp\i_kecwuomhez.exe
    C:\Temp\i_kecwuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3272
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojgbywq.exe ups_run
  2⤵
  PID:5600
- - C:\Temp\zwrojgbywq.exe
    C:\Temp\zwrojgbywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojgbywq.exe ups_ins
  2⤵
  PID:3104
- - C:\Temp\i_zwrojgbywq.exe
    C:\Temp\i_zwrojgbywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdbytqoig.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\lgdbytqoig.exe
    C:\Temp\lgdbytqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdbytqoig.exe ups_ins
  2⤵
  PID:4588
- - C:\Temp\i_lgdbytqoig.exe
    C:\Temp\i_lgdbytqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run
  2⤵
  PID:4248
- - C:\Temp\lidbvtnlfd.exe
    C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
  2⤵
  PID:3428
- - C:\Temp\i_lidbvtnlfd.exe
    C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavsnlfd.exe ups_run
  2⤵
  PID:988
- - C:\Temp\lidavsnlfd.exe
    C:\Temp\lidavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavsnlfd.exe ups_ins
  2⤵
  PID:460
- - C:\Temp\i_lidavsnlfd.exe
    C:\Temp\i_lidavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkicavsnl.exe ups_run
  2⤵
  PID:4296
- - C:\Temp\pnkicavsnl.exe
    C:\Temp\pnkicavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkicavsnl.exe ups_ins
  2⤵
  PID:4768
- - C:\Temp\i_pnkicavsnl.exe
    C:\Temp\i_pnkicavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run
  2⤵
  PID:5188
- - C:\Temp\rpkhcausmk.exe
    C:\Temp\rpkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins
  2⤵
  PID:1968
- - C:\Temp\i_rpkhcausmk.exe
    C:\Temp\i_rpkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspjhfcauk.exe ups_run
  2⤵
  PID:5156
- - C:\Temp\xspjhfcauk.exe
    C:\Temp\xspjhfcauk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspjhfcauk.exe ups_ins
  2⤵
  PID:4156
- - C:\Temp\i_xspjhfcauk.exe
    C:\Temp\i_xspjhfcauk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzxrpjhczu.exe ups_run
  2⤵
  PID:1116
- - C:\Temp\bzxrpjhczu.exe
    C:\Temp\bzxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzxrpjhczu.exe ups_ins
  2⤵
  PID:4520
- - C:\Temp\i_bzxrpjhczu.exe
    C:\Temp\i_bzxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:6072
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:2096
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5000

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2636

C:\Temp\zwromgeywr.sys
C:\Temp\zwromgeywr.sys
1⤵
- Executes dropped EXE
PID:2068

C:\Temp\olgdbztrlj.sys
C:\Temp\olgdbztrlj.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\gaytqoigay.sys
C:\Temp\gaytqoigay.sys
1⤵
- Executes dropped EXE
PID:2600

C:\Temp\ayvqnljdbv.sys
C:\Temp\ayvqnljdbv.sys
1⤵
- Executes dropped EXE
PID:3188

C:\Temp\aysqkicayv.sys
C:\Temp\aysqkicayv.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\hfcaxspnki.sys
C:\Temp\hfcaxspnki.sys
1⤵
- Executes dropped EXE
PID:1180

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\xrpkhczurp.sys
C:\Temp\xrpkhczurp.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Temp\rpmhezxrpj.sys
C:\Temp\rpmhezxrpj.sys
1⤵
- Executes dropped EXE
PID:2444

C:\Temp\trljebwtom.sys
C:\Temp\trljebwtom.sys
1⤵
PID:2504

C:\Temp\jdbywqoljd.sys
C:\Temp\jdbywqoljd.sys
1⤵
PID:3636

C:\Temp\qligaytqlj.sys
C:\Temp\qligaytqlj.sys
1⤵
PID:4356

C:\Temp\sqlidbvtnl.sys
C:\Temp\sqlidbvtnl.sys
1⤵
PID:5772

C:\Temp\qkicaxvpni.sys
C:\Temp\qkicaxvpni.sys
1⤵
PID:2600

C:\Temp\fcxvpnhfsp.sys
C:\Temp\fcxvpnhfsp.sys
1⤵
PID:2096

C:\Temp\xrpkhfzxup.sys
C:\Temp\xrpkhfzxup.sys
1⤵
PID:5068

C:\Temp\fzxromkhcz.sys
C:\Temp\fzxromkhcz.sys
1⤵
PID:2460

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqnljdbv.sys

Path C:\Temp\ayvqnljdbv.sys
Size 141KB
SHA256 aa8b6d79222faee368c778d8519bb6744d8f94e8a1812860f921d587a28d63a0
MD5 e9feef6628d650f9d800d53689f646d7
SHA1 78fecea55919cbc43abb824aacbc76dddd30757b
SHA512 61f435c7579a430ef6091266fd4472c87fa16285b223b9b825a852499a4ccf26dfc23613232b769dc08b47706e87e29800e1b377a0f9f9183015f7c08ff1cbdd
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqligayt.exe

Path C:\Temp\bytqligayt.exe
Size 243KB
SHA256 a1beb41d398526652e35ea5f528ffdb16aa25776a5d4aea4686254bd05531da6
MD5 cd0ea2b3d7779bf608d8dc73a8868b90
SHA1 bdcadc8c05adeb7a81f6adc94133fc82086b3e3d
SHA512 0455b6cd32fc0342a7e113d1445d8d8ad169afc33af4163ecd6d1ae667dbf5afc0e928d2a3f15fb7c7c3442ec2e74b8c8e21fc60e88d0d01de7012539901c429
SSDEEP 3072:UhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:kiA7nLtm/ka3lLNngoqRttA7i
TLSH
T128345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzxrpjhbzt.exe

Path C:\Temp\bzxrpjhbzt.exe
Size 243KB
SHA256 f37a94a8b39ad0bc680fdb8160e090de87d9a21c19f35be82b002775235fa5e7
MD5 fd64a127e23131331f15bc151ef811c2
SHA1 e10963093b993d23311a5bfdd73ce51dab351488
SHA512 a39ee912c30b573a037cfab0e319ea514d2f8eaccb5e3ea332aa54ac8fe991bdbe81f9f0b1ff775b11871f7a27ea11167c375162c8d7ade0b37936e9c801b173
SSDEEP 3072:QhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:IiA7nLtm/ka3lLNngoqRttA7u
TLSH
T1CB345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpjeczu.exe

Path C:\Temp\fzxrpjeczu.exe
Size 243KB
SHA256 0561077aa5d565b2a3090ad136a41243a404d7657f54e7b5fcc71e450c10abf6
MD5 21b1082686e171c1635790f6972073c5
SHA1 a2ed4415e88f21a47e68b614b20b7172dba6790b
SHA512 1752bebf698015d74400bd6a20cc4bf946fe3451ef5d82a58354c93e3e995db8dc6300eadabb5f2f04e34f1565fa5d20fa87f8d826c35fba784e8c55ffb54148
SSDEEP 3072:IhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:QiA7nLtm/ka3lLNngoqRttA7G
TLSH
T117345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqoigay.sys

Path C:\Temp\gaytqoigay.sys
Size 141KB
SHA256 e95341171eac591c33df9646a21f0f8cee9b21493c91c278c927a0ad3901e0cf
MD5 443f12d07e9bd919dc8acc5bffac58a3
SHA1 4768afa082e6813b409a59f54b5af75c32aa2be8
SHA512 f22a702763c35d9dc707786d86f781ad8abb02ab2c4d46462d69aa98f8773ce1fa0fabe9755e3d05b7708319afd68709244116f0312c43683259e2b7a7f1e1e9
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqligayt.exe

Path C:\Temp\i_bytqligayt.exe
Size 243KB
SHA256 f9378119dd09f0c905927de618bfc771352e67cc4178c480e280eaddadbf1e2d
MD5 a6a657052fcf6bbc3e470ababedc282a
SHA1 8b5fecee84e43d7cedf71955a74ae32d05c97c93
SHA512 2b623bb37f1821e792e79fd4b704e23170104a15f81c64dc29bedac256783d8cb6066d3126f6e65158a0267338a1dc4c6711a31944786c6ab606c7425c307680
SSDEEP 3072:3hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:xiA7nLtm/ka3lLNngoqRttA79
TLSH
T198345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzxrpjhbzt.exe

Path C:\Temp\i_bzxrpjhbzt.exe
Size 243KB
SHA256 3387e0d13f70e62a8ebc8abcd7f5fe51eadabe6c9bafca0e10305c802ff9f778
MD5 4015cf22aab145aadca78f880cd5fa45
SHA1 177e7ee5971b12dd4f9cb19b8c2f4afc955a9c8c
SHA512 8b09522a5b1898d981046748b89e032072792ca8cd94cabcf7aecca80cd33c2059a44e48d7f4cf95e1e09c1d53d4ac9a37040eae1941d55af78a17808ad1de39
SSDEEP 3072:QhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:IiA7nLtm/ka3lLNngoqRttA7i
TLSH
T1DA345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpjeczu.exe

Path C:\Temp\i_fzxrpjeczu.exe
Size 243KB
SHA256 f928b9ed2fff4c150f200cc7c38d19a1dd2df1f2b6f10bdfcd3903ce6a877648
MD5 16a159424a911060b2f3731ed5e47242
SHA1 7304c97b07f54bfdb33a007b2e9b200395a2625a
SHA512 84ee686417f9d287be5543d4be000d65a9fd59a816210922c42cfe5c5b1f52e4ed28c2096dd59f55eed72c59084e0c2dd92f2bb983eecd2d091129324329e53c
SSDEEP 3072:WhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:qiA7nLtm/ka3lLNngoqRttA7g
TLSH
T1DE345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkigavsnki.exe

Path C:\Temp\i_qkigavsnki.exe
Size 243KB
SHA256 c98109ec5839d61b28c6cf582348b541e3ceafc3716f8ca7386fcfe6cd6c891b
MD5 d8b163359f9174d00d08a2cab71cdb9f
SHA1 4963614267ac385cf59320f78222db58939ea04e
SHA512 45af87fa6608bdcecf8329f96659bfa4eeb04773aa93b5ed6321690d5d5d33191b90ba29cb418651c4405544f74bd5dcd39f3cef1e6131233de01a2fe9b981bc
SSDEEP 3072:PhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:5iA7nLtm/ka3lLNngoqRttA7F
TLSH
T170345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgbztomg.exe

Path C:\Temp\i_qojgbztomg.exe
Size 243KB
SHA256 6d6b4490fdefc5580ce6dc68f4428ebe99394ca199babe1783d2e225b3226ed3
MD5 1a9f724928cc3eb25c0679a23ab20675
SHA1 4aef3df7de7d24074eea53b0fd80ac9c402ab8ba
SHA512 355bb11db7bf6890f49e8441199cbf6c66b562253fb5faf32ecf5b2800405f954a0789876359a6f9e24be42dd2755ef9d33691131bcc86210cd33e682a8d4784
SSDEEP 3072:ZhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:XiA7nLtm/ka3lLNngoqRttA77
TLSH
T1A1345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwromgebzt.exe

Path C:\Temp\i_zwromgebzt.exe
Size 243KB
SHA256 1f48692f9b978b43977e4c990be347a44ad7fd37f494c60ea657141264f880f6
MD5 270391d42c0050f1d03a024bd5d1e7e4
SHA1 08c03333294b5f39785accfa3f5dcb04bc762d65
SHA512 4f9def29ba075f51438be025870dc06b64dff0b7a973e1c2103f84a1e72266eb79d33dd64a46ec67785d280b6dc106a6da7545ad75946540f9d62b6e9e1569aa
SSDEEP 3072:/hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:piA7nLtm/ka3lLNngoqRttA7V
TLSH
T114345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbztrlj.sys

Path C:\Temp\olgdbztrlj.sys
Size 141KB
SHA256 09202f605379d19a8b8948d8dcd1e0efba04578748fa64cb8f53328b950f3e37
MD5 364384937a38e704d4b51d83f8b749af
SHA1 b73671d7d8f7be37a3380e40a2dc219f1f358e4f
SHA512 0412425996905ca2241cac5f5c62fef257976d6a900551d9c09b37dcd4dc7910573d70a6837d8058bc39e2e2898dea0ad26b7d97001640c45a46c551b582d896
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 8d6f2252ac436b8bedaf7114434fa86632c4366f690d5c919529c95a6ed71bde
MD5 e839534599b4c4ce3a7d2bb517e1cb28
SHA1 83e0c4566240ea56cece35cec9d2249f97903e8a
SHA512 d83b628fad58f58ce52aacdd149eb49fec60565829eb42ca0f5f3e11959e714e40c3579adeb1800c71e5cf3f4d96cf2f42e65e0c8ea19a85526264d56d40c26e
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EEE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigavsnki.exe

Path C:\Temp\qkigavsnki.exe
Size 243KB
SHA256 4ed4aeaefe7d240d61b868a5988ce289f386627499e8c8e43c50a0e84a94e6a2
MD5 18ddb4cd5197911b3ac1efb4bd501f55
SHA1 2746e7c897b28d84224b8c5c1112afe13e9c9baa
SHA512 48c4ed24c1744bb61de5e50f9e2b42b83b2aaedccbb1ba0f66e47254d2ea165fdeb1e8f1bc0de907332c1018cb17423af5778c5f60d1b0337d2c4270f682d1f9
SSDEEP 3072:ghiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:YiA7nLtm/ka3lLNngoqRttA7G
TLSH
T1BD345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbztomg.exe

Path C:\Temp\qojgbztomg.exe
Size 243KB
SHA256 d296f17d0d0b98fa85b2b2f444505663dd2e8a72e252654821d61a96e79b4e44
MD5 9a5866eb344cc05181fbfbdee6b153b0
SHA1 19703d1a0f5ebf8d153264ec080b456edd08f59a
SHA512 8f9a5f8d0a8b3f0b63caeb42fd8d4aa09e4fd3fa2d98f4549ef0a63a95a0d7c39269e3c99d49991972edae1a6e69f4892cb8e3bc74435ffdc099749459696d13
SSDEEP 3072:BhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:PiA7nLtm/ka3lLNngoqRttA7b
TLSH
T151345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwromgebzt.exe

Path C:\Temp\zwromgebzt.exe
Size 243KB
SHA256 9062f87758e8df55066bb0bce3523661a591b5069c1dad36813104c3ec70ce31
MD5 5b0635520b867caa51d499ab9d1c6b2c
SHA1 3f2cd20a70c043524d9b15a448c56eb461d4eed7
SHA512 287b3bf617e8cc935e2a24cff8b3ce23b63328bb5427f7054487e2741e72c0b6f547205c5bac47d82d977407ea5e714b1990fc68d254fd358d39f2e032d9b3af
SSDEEP 3072:LhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:NiA7nLtm/ka3lLNngoqRttA7J
TLSH
T17C345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwromgeywr.sys

Path C:\Temp\zwromgeywr.sys
Size 141KB
SHA256 99fcbb3b5f95f9f118db99b8355c0595005370c7a82e4d1ab27c0a30fb9aaac7
MD5 dc0e26896a94214212263fe8d2467b08
SHA1 7442888666978ec41422c4a75f9c521e515796d2
SHA512 3ab4b8e1e55225bbd775e6bf0770d8c5e10e166124c9206678aa2ae2d0c3df53e24c968c3179c5c91538dd8d86458b09767ec8b81a952a2f08344b384ab29eed
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

09923218-9824-4ea0-8779-a2f544774e78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09923218-9824-4ea0-8779-a2f544774e78.tmp
Size 34KB
SHA256 9f5cf26c729585430b0cbced1400d93e6415aef2125b30fbecf4995aae82585c
MD5 ba7fa5bb2fe1d931d83f6716d2e2a155
SHA1 1a18cb5f5054c5d8c0adaa1c361f298e3a7cc4ab
SHA512 b5e36f8b35f5de8bbc7144fb7c6b576089e78861c667fdf34bc1d48df1221cb4a19a2d515877f78c948fa0368d66345617ad75bb98015893a9de5fae554668da
SSDEEP 768:3UY3MvqYnieOT93xxWnUPO4Qp7cPAiSm2eo4w4cciGrTFlo2slo:3UY3MyMCbWwQpYoimeoR4ccFFq2slo
TLSH
T168F2BEB0D9A8EE73ACFBA34576497342BFF4116398C55F84CAE95B0D01436AA071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e15f784-385d-4ce2-9042-aad32b2804c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e15f784-385d-4ce2-9042-aad32b2804c6.tmp
Size 42KB
SHA256 7b603f29aea553b120291d28b34f38d4f1ce69e7b621b9cf737485ce030de26e
MD5 ca9410cad20f5cc5117d5958def37ad9
SHA1 a6ef399f9deba2e0d05803b1ae29c09425e12a18
SHA512 6d7d48e356df4562438c4e657d0b3888a8b75eadda860606eefdb9aadd9438ce791cb3006321437bf5c50be9c048610a3cf855591a8454a2d1804dddd88854d8
SSDEEP 768:WFQj3LwgzvGYVuOT93xMnnUPO4Qp7cPAiSm2eo4w4cciGrTFlo2slo:dj35OM6nwQpYoimeoR4ccFFq2slo
TLSH
T1111318F198D79A76E8AE5783673C6E42AEBCC153B4885984F7D55E0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f13925e-fd7d-4314-ab58-5e331d728640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f13925e-fd7d-4314-ab58-5e331d728640.tmp
Size 37KB
SHA256 4e27e062c9bf2a2ebb329bbdd089c890bb8425b398550b1339a7e56f671aed19
MD5 6ed2ce7e70dad159e929d6251fe42041
SHA1 39913697f823b8fbcac33cfad48f3e7ee0a6a862
SHA512 21759e6eea96a8d084b58212bb3b15e900ad344bc134f925222a7106fbd55a667ab1c881b88cd88be91b83201437bcd3b143b2003d633c9cb03503ed08d32bf8
SSDEEP 768:vw/UxvxjgC+5j3wVx48lieOT9TjFnUPO4Qp7cPAiSm2eo4w4cciGrTF5+AgZbCMc:vdZj3+5j3w/4yCTjFwQpYoimeoR4ccFx
TLSH
T1AD03BF75E8A8AE77DCF39784361D6342EFF1416395C22AA4CAED1E0D42872AD430BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a256d48-c45d-49b5-8c6e-b88ba0d4edd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6a256d48-c45d-49b5-8c6e-b88ba0d4edd7.tmp
Size 34KB
SHA256 d05d05c273a55ad8692d07c12d6281328612f0c99da59ba225d2933e7bf29c08
MD5 4b0c7d5a627310881a30ab7bcf470496
SHA1 da3fcdf65f02177174a2a8dd5c65af46108bae81
SHA512 3b7f4078d1b244b2bc60c1cf6bd757c9c689f684f1a6d5cfc9447234d91c4a30706b085de6afb91092d7ff54e68c824385b0af03cac97cd8174ae0e2e2038a71
SSDEEP 768:MY3Pv5YnieOT93xxWnUPO4Qp7cPAiSm2eo4w4cciGrTFlo2slo:MY3PBMCbWwQpYoimeoR4ccFFq2slo
TLSH
T1E5F2BEB0D9A8EE73ACFBA34576497342BFF4116398C55F84C6E95B0D01436AA071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

193ea8df-cf76-47e7-a010-8d7b10b0a9bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\193ea8df-cf76-47e7-a010-8d7b10b0a9bd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26a5fc8f-ab9d-444a-b3ff-ab25a0c178db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26a5fc8f-ab9d-444a-b3ff-ab25a0c178db.tmp
Size 11KB
SHA256 b2affdbf5fbb9de1317788b39ffb72578b1e3f4addc1c52e6e3a916aa2bbb1a9
MD5 00d136a50cd34ee3f0b05010be8905aa
SHA1 5978b9194823b33e5d23ef998ad4da3730ba3b7a
SHA512 c9b1f9c33f7036d6591a688c53349f1c8964af3d77c7d5e5337b7fff5c17ee05c39d9953d30545cab8c8dcdc53dd882f48d8f59126252c755de1e696c8aecb4d
SSDEEP 192:sxRMRgCU/fensQFIZulGjzoA8p9C/g6+WNCXb/YcpXtiTqGpIgVcJ:sxRMxU/fensg2ulGSQ/5o/J9iTLW
TLSH
T11932C915AD28A97B8CCBD20DBB557F63D6F81132A0D51E48A6FC9A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cb54337-ad62-4790-abf7-314b31cede9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cb54337-ad62-4790-abf7-314b31cede9c.tmp
Size 11KB
SHA256 86928ceeb8017f47ac4aa696c203d0956d7cb2ecc1ed0473c38983bb040b6073
MD5 9155be400a74740beb8d30a68edbcd9c
SHA1 f002ce6f4eba87d3126672884ecf4fd94627eae7
SHA512 088bb1d29b144ffff345d45250351a21783e48160f4ea7a6c37745af9740f780f97c20d4608533d5866776fc586d08ceed6a8043c898b41f6447ad6955c9f06b
SSDEEP 192:sxR/RgCU/fensWFIZulGjzoA8p9C/g6+WNCXb/YcpXtiTqGpIgDZcJ:sxR/xU/fensG2ulGSQ/5o/J9iTLG
TLSH
T16842C915AD28B97F8CCBD20DBB557F63D6F81132A0D51E48A6FC9A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d346fcf-03ab-474f-b741-ad0289bfa208.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d346fcf-03ab-474f-b741-ad0289bfa208.tmp
Size 29KB
SHA256 d01c3d98db31de84f19f52d98bf64e64cac3003a62ef13866ec0fa62d432be8f
MD5 b09e379a0b3340b4dbdf50d23b162731
SHA1 ae0fb0dff980d121414e9a21edfbde9b0ebc371b
SHA512 1bbd51e27df9e2d14d31cce0c542c507831641368eda2ea17a578a871885ff1f56975b0358960b09110737e0e3a072f90aace00077b645f7926d417202965051
SSDEEP 768:DFakb4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVa/J97gzroMue:DFakb4ymEbs5Wg1Bf9tu1jat/JxgAMue
TLSH
T125D2EB3B744CCB7E4F804A9DEC197E9B6DA802CB9598C94047FE941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 23296b896e61e5a021402f0282203166cf9ec6ebb9d1a0b2f512121843077e49
MD5 ddd555e7d589b124dcbcf5d6114833d2
SHA1 96ff2642cec0c42b780a6ca43cb6f4f749246ffe
SHA512 bb9fd543244a0dd157dd2741a95e8efb2a1b83eb16ba18f4ae089a33867a76c126ecf6f67a77eb15f8b63bcd3b49d66320749b01d7ad120d784e7b267a107fd6
TLSH
T1FF61507859908245FF7E407DD7D09CC336B34AAB52432E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7a08569beb84c24d773c3664d08bf09fbae32ec86d4a446712631119e74c5bcd
MD5 25bd2dc7fa43be37fa2cc038c0f1635e
SHA1 65672017d875507535a552931b99fb42dbef657d
SHA512 00b5d5267b1add2310cade47cd32edcfd1a28d0a1d143c8c471dd00727a31503a2ff03951c6adb99606748c7cdcac6a6d8e8b68d6c4388f08ce7b57025d3480a
TLSH
T1F161607849808241FFBE407DD7D09CC336B34AAB52432E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

2bfb9c8b-ae7f-425f-9aab-ef511a13d0f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2bfb9c8b-ae7f-425f-9aab-ef511a13d0f1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1d66a306-7097-4856-ac19-20b502ab1261.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d66a306-7097-4856-ac19-20b502ab1261.tmp
Size 2KB
SHA256 153d3a5480d5a55455304e1325d86a525893214c4d63fc2daae0c4512f16ad71
MD5 13f8d7aa977f8d77fd42369a485d1107
SHA1 67af738a305c8c42f412ce58522dd81ab512adfb
SHA512 62532fe063472f2e30d40a194533a24835a7311aa1a1c9c38848e949e0748dab829ad2b1e4638b41a2de02bed78949c3744c85104fa93dda7cafa94af6925971
TLSH
T10D5190F3C3E8866E890156F4AB187E2BDE2D0954532C3D5AC8E4DE2B93E3471D18159F
MD5 SHA1 SHA512 TLSH

Submit Download

a3d23cb9-6842-4408-a665-e9e9b2cdfa5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3d23cb9-6842-4408-a665-e9e9b2cdfa5e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f6fedbce-4d3b-4ca9-a4ef-a2f48a3e1ef9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6fedbce-4d3b-4ca9-a4ef-a2f48a3e1ef9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e5a004cf40c25f77d67abe43c91c515ca063b3b505adf94f7ff4c71d69fcf579
MD5 40e062f5556e2001f629faf214320f3d
SHA1 8b35388c23f424f8a247fad286aa3173468b10c8
SHA512 196bf2967f041886d5deb4845569c994d4d217773e69a01c74417a695fb6ce5eb029736478ab10e68117937324b7234aa31667632d0077d630995a71f3943d5b
SSDEEP 48:KMLGnrFNdWTNYdIarWKVz9BWRjGoQRLHyDC9ocC4IpTM7kIakpKVg9ypRa5oj0wk:KsYoKRqmuZ+Kqc9UoKBaC5
TLSH
T1EF91852275BB4351383E3E0C92D49A5A864136F67038E96F3FE944564D2BE045EFC9EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5cda187-d4fe-43a2-87b1-dd31d6135bb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5cda187-d4fe-43a2-87b1-dd31d6135bb8.tmp
Size 11KB
SHA256 9ecaf62b5c272a528cd2bf86f1b6df3e967f75c109c20d85f13668def689e2fc
MD5 33b85ee3269571722ecf509c031d3daf
SHA1 aa127ed4500ca29cfe0f91fdc5f0aa4913ec2a2f
SHA512 8bf86181b3024e13edb779b69d00b2ba75fd459a75ba41470ce79d6bb874c4cf59c02b6f63d274a2364188d4cab4b1e4067c1bc87867378e5be9a05a322081cd
SSDEEP 192:sxR/RgCU/fensWPIZulGjzoA8p9C/g6+WNCXb/Yc4XtiTqGpIgDzcJ:sxR/xU/fenss2ulGSQ/5o/Y9iTLo
TLSH
T1C842D815AD28797B8CCBD20DBB557F63E6F85132A0951E48A6FCDA1C14EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d3d12075-aecd-4cdd-ab6b-00fb968c675d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d3d12075-aecd-4cdd-ab6b-00fb968c675d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0eb63460-ca66-4279-9621-178035716ff1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0eb63460-ca66-4279-9621-178035716ff1.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

b4fca0b1-8e70-4e7c-aaac-9c37f60b3dd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b4fca0b1-8e70-4e7c-aaac-9c37f60b3dd3.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

be4603a0-4ece-428d-963c-cfd9a844f3f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\be4603a0-4ece-428d-963c-cfd9a844f3f9.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

c7a62907-3a13-4f29-be73-c2dc5358d937.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c7a62907-3a13-4f29-be73-c2dc5358d937.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

22fc0ff6-1d75-416d-8b2c-527d047daeb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22fc0ff6-1d75-416d-8b2c-527d047daeb3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bdc1d552-1e54-4871-a048-1a06ee6a4caa.tmp

Path C:\Users\Admin\AppData\Local\Temp\bdc1d552-1e54-4871-a048-1a06ee6a4caa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d87a5f72-12fc-4ba5-9e9d-1579fcca0d38.tmp

Path C:\Users\Admin\AppData\Local\Temp\d87a5f72-12fc-4ba5-9e9d-1579fcca0d38.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6032_1166471300\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1178955236\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1547838669\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_1999942641\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6032_582124997\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/672-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1180-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-358-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2096-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2096-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2504-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2636-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3188-288-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4356-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-441-0x0000000000AB0000-0x0000000000AED000-memory.dmp

Download

memory/5068-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5716-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download