b06f246656b15fab1ddc38e9ae489c7345eb804af8c5e40be8fc9b0c8b1eeb0c

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-tprbwsdh82
SHA256 b06f246656b15fab1ddc38e9ae489c7345eb804af8c5e40be8fc9b0c8b1eeb0c
MD5 3d6f2906567c98af8017bdb1517484b9
SHA1 3e90502a3447111fd85be48d065ef85c88225720
SHA512 591e8dc649de69543233beba08facc768280eb204c120cdebcaa56765bae73198af8cc0452ce9e5d311099ba621d0727dd43c9750c504ecdd091c0e70ff5d91f
SSDEEP 3072:Yhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:gn7nLQka3lLNngoqRttA7q
TLSH
T19D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4856	CP.exe
1380	kfcupkidau.exe
4916	CP.exe
5284	CP.exe
1764	i_kfcupkidau.exe
2944	kicxusnkfc.sys
4116	CP.exe
2604	rpkhczurpk.exe
5952	CP.exe
1656	CP.exe
4924	i_rpkhczurpk.exe
5544	zwrpmkecau.sys
1856	CP.exe
5568	wusmkhcxus.exe
4308	CP.exe
4584	CP.exe
5512	i_wusmkhcxus.exe
5956	xrpjhczurm.sys
4904	CP.exe
5976	rpmgeczurp.exe
5096	CP.exe
1236	CP.exe
5108	i_rpmgeczurp.exe
5012	ecwugeywro.sys
1360	CP.exe
1152	trojgbztrl.exe
3596	CP.exe
6060	CP.exe
1048	i_trojgbztrl.exe
1960	wtrljhbytr.sys
5856	CP.exe
1480	zwrojytrlj.exe
1140	CP.exe
2472	CP.exe
5512	i_zwrojytrlj.exe
2692	vtqljdbytr.sys
4668	CP.exe
5596	wqoigaywql.exe
3520	CP.exe
4432	CP.exe
2864	i_wqoigaywql.exe
2324	tnlfdyvtnl.sys
4464	CP.exe
204	nlidaysqki.exe
3056	CP.exe
3228	CP.exe
6052	i_nlidaysqki.exe
3044	qnifdaysqf.sys
468	CP.exe
2248	ifaxsqnifd.exe
908	CP.exe
4508	CP.exe
1924	i_ifaxsqnifd.exe
2660	pnicausqki.sys
4472	CP.exe
3028	kfcausqkic.exe
4700	CP.exe
5996	CP.exe
5848	i_kfcausqkic.exe
4212	khfzxrpnhf.sys
4404	CP.exe
5932	khczxrpkhc.exe
4424	CP.exe
5292	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_1575427821\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_537147865\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_537147865\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_1912651869\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_879910192\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_879910192\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_1912651869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_879910192\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_879910192\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqkicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkhcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcupkidau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqkicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcupkidau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkhcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaywql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljhbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trligbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trligbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgeczurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljhbzwr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3764	ipconfig.exe
5640	ipconfig.exe
2284	ipconfig.exe
808	ipconfig.exe
4408	ipconfig.exe
5104	ipconfig.exe
5548	ipconfig.exe
4960	ipconfig.exe
3484	ipconfig.exe
4560	ipconfig.exe
2660	ipconfig.exe
2444	ipconfig.exe
4012	ipconfig.exe
5076	ipconfig.exe
2544	ipconfig.exe
3308	ipconfig.exe
3644	ipconfig.exe
696	ipconfig.exe
1192	ipconfig.exe
3304	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{01830468-0AF6-4276-BB01-3198808877FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	i_kfcupkidau.exe
Token: SeDebugPrivilege	4924	i_rpkhczurpk.exe
Token: SeDebugPrivilege	5512	i_wusmkhcxus.exe
Token: SeDebugPrivilege	5108	i_rpmgeczurp.exe
Token: SeDebugPrivilege	1048	i_trojgbztrl.exe
Token: SeDebugPrivilege	5512	i_zwrojytrlj.exe
Token: SeDebugPrivilege	2864	i_wqoigaywql.exe
Token: SeDebugPrivilege	6052	i_nlidaysqki.exe
Token: SeDebugPrivilege	1924	i_ifaxsqnifd.exe
Token: SeDebugPrivilege	5848	i_kfcausqkic.exe
Token: SeDebugPrivilege	2648	i_khczxrpkhc.exe
Token: SeDebugPrivilege	3716	i_pmhezxromh.exe
Token: SeDebugPrivilege	2036	i_wuomgeywro.exe
Token: SeDebugPrivilege	1168	i_wtrljhbzwr.exe
Token: SeDebugPrivilege	5916	i_trligbytrl.exe
Token: SeDebugPrivilege	1172	i_dyvqnlfdys.exe
Token: SeDebugPrivilege	3436	i_sqlidavsnl.exe
Token: SeDebugPrivilege	3920	i_xvsqkicays.exe
Token: SeDebugPrivilege	2660	i_spnhfzxrpk.exe
Token: SeDebugPrivilege	2668	i_pmhezxrpkh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4520	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	87
PID 4520 wrote to memory of 2948	4520	iexplore.exe	89
PID 2948 wrote to memory of 1748	2948	msedge.exe	90
PID 2948 wrote to memory of 2060	2948	msedge.exe	92
PID 2948 wrote to memory of 4252	2948	msedge.exe	93
PID 2948 wrote to memory of 4252	2948	msedge.exe	93
PID 2948 wrote to memory of 4252	2948	msedge.exe	93
PID 2948 wrote to memory of 672	2948	msedge.exe	94
PID 2948 wrote to memory of 672	2948	msedge.exe	94
PID 2948 wrote to memory of 2412	2948	msedge.exe	95
PID 2948 wrote to memory of 2412	2948	msedge.exe	95
PID 2948 wrote to memory of 2412	2948	msedge.exe	95
PID 2948 wrote to memory of 5320	2948	msedge.exe	96
PID 2948 wrote to memory of 5320	2948	msedge.exe	96
PID 2948 wrote to memory of 5320	2948	msedge.exe	96
PID 2948 wrote to memory of 1420	2948	msedge.exe	97
PID 2948 wrote to memory of 1420	2948	msedge.exe	97
PID 2948 wrote to memory of 1420	2948	msedge.exe	97
PID 2948 wrote to memory of 2588	2948	msedge.exe	98
PID 2948 wrote to memory of 2588	2948	msedge.exe	98
PID 2948 wrote to memory of 2588	2948	msedge.exe	98
PID 2948 wrote to memory of 4476	2948	msedge.exe	100
PID 2948 wrote to memory of 4476	2948	msedge.exe	100
PID 4056 wrote to memory of 4856	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	101
PID 1380 wrote to memory of 4916	1380	kfcupkidau.exe	104
PID 2948 wrote to memory of 2640	2948	msedge.exe	107
PID 2948 wrote to memory of 3328	2948	msedge.exe	108
PID 2948 wrote to memory of 2640	2948	msedge.exe	107
PID 2948 wrote to memory of 3328	2948	msedge.exe	108
PID 2948 wrote to memory of 2180	2948	msedge.exe	110
PID 2948 wrote to memory of 3408	2948	msedge.exe	111
PID 2948 wrote to memory of 3408	2948	msedge.exe	111
PID 4056 wrote to memory of 5284	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	114
PID 2948 wrote to memory of 4072	2948	msedge.exe	117
PID 2948 wrote to memory of 4072	2948	msedge.exe	117
PID 4056 wrote to memory of 4116	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	120
PID 2604 wrote to memory of 5952	2604	rpkhczurpk.exe	122
PID 4056 wrote to memory of 1656	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	125
PID 4056 wrote to memory of 1856	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	129
PID 5568 wrote to memory of 4308	5568	wusmkhcxus.exe	131
PID 4056 wrote to memory of 4584	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	134
PID 4056 wrote to memory of 4904	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	138
PID 5976 wrote to memory of 5096	5976	rpmgeczurp.exe	140
PID 4056 wrote to memory of 1236	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	143
PID 2948 wrote to memory of 3752	2948	msedge.exe	146
PID 2948 wrote to memory of 4464	2948	msedge.exe	147
PID 2948 wrote to memory of 3908	2948	msedge.exe	148
PID 4056 wrote to memory of 1360	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	151
PID 1152 wrote to memory of 3596	1152	trojgbztrl.exe	153
PID 4056 wrote to memory of 6060	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	156
PID 4056 wrote to memory of 5856	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	160
PID 1480 wrote to memory of 1140	1480	zwrojytrlj.exe	162
PID 4056 wrote to memory of 2472	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	165
PID 4056 wrote to memory of 4668	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	169
PID 5596 wrote to memory of 3520	5596	wqoigaywql.exe	171
PID 4056 wrote to memory of 4432	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	174
PID 4056 wrote to memory of 4464	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	178
PID 204 wrote to memory of 3056	204	nlidaysqki.exe	180
PID 4056 wrote to memory of 3228	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	183
PID 2948 wrote to memory of 4020	2948	msedge.exe	185
PID 2948 wrote to memory of 4020	2948	msedge.exe	185
PID 4056 wrote to memory of 468	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	191
PID 2248 wrote to memory of 908	2248	ifaxsqnifd.exe	193
PID 4056 wrote to memory of 4508	4056	2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3d6f2906567c98af8017bdb1517484b9_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff3079c188,0x7fff3079c194,0x7fff3079c1a0
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,4644798349510494649,6380956182150830632,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:11
      4⤵
      System Time Discovery
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1888,i,3042736712488378963,14535363013928919135,262144 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,4943635473049577452,6218080057183656700,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:13
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,16259983465694299212,2929908547083527359,2097152 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,11038415749538780633,13223368342302417647,2097152 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13732748544552567006,6118620378592972014,2097152 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,3143857294167670656,9982040006709008805,2097152 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,11989933433098634404,1792594857324666416,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,281579768364916941,7665996399392125469,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11405175596670052641,2887948558889159212,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13446840160984407976,15598798371560333016,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,13446840160984407976,15598798371560333016,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,3870103673571276882,4553043556484552726,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,2947131966119344642,9803641211977311131,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,16183985320628410441,12285513354967892524,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,12643681436374784177,8877161930085845372,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,5489507872484561735,16892815077261789973,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,7767868984946470479,14887727575713586779,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
      4⤵
      PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,18029771479316416415,5933021643368772884,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,11673369113909810983,4333203031967612567,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,16913270046057233823,7902025812255095440,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,16616132143496742922,3056474169212234884,262144 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,12443816082931479889,6636947695807118116,524288 --field-trial-handle=2432,i,1381246297266574256,3524896645666830531,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcupkidau.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Temp\kfcupkidau.exe
    C:\Temp\kfcupkidau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcupkidau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5284
- - C:\Temp\i_kfcupkidau.exe
    C:\Temp\i_kfcupkidau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhczurpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\rpkhczurpk.exe
    C:\Temp\rpkhczurpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhczurpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1656
- - C:\Temp\i_rpkhczurpk.exe
    C:\Temp\i_rpkhczurpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wusmkhcxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\wusmkhcxus.exe
    C:\Temp\wusmkhcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wusmkhcxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4584
- - C:\Temp\i_wusmkhcxus.exe
    C:\Temp\i_wusmkhcxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmgeczurp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4904
- - C:\Temp\rpmgeczurp.exe
    C:\Temp\rpmgeczurp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmgeczurp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_rpmgeczurp.exe
    C:\Temp\i_rpmgeczurp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1360
- - C:\Temp\trojgbztrl.exe
    C:\Temp\trojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6060
- - C:\Temp\i_trojgbztrl.exe
    C:\Temp\i_trojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5856
- - C:\Temp\zwrojytrlj.exe
    C:\Temp\zwrojytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_zwrojytrlj.exe
    C:\Temp\i_zwrojytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaywql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\wqoigaywql.exe
    C:\Temp\wqoigaywql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigaywql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Temp\i_wqoigaywql.exe
    C:\Temp\i_wqoigaywql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\nlidaysqki.exe
    C:\Temp\nlidaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3228
- - C:\Temp\i_nlidaysqki.exe
    C:\Temp\i_nlidaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:468
- - C:\Temp\ifaxsqnifd.exe
    C:\Temp\ifaxsqnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\i_ifaxsqnifd.exe
    C:\Temp\i_ifaxsqnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4472
- - C:\Temp\kfcausqkic.exe
    C:\Temp\kfcausqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5996
- - C:\Temp\i_kfcausqkic.exe
    C:\Temp\i_kfcausqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khczxrpkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\khczxrpkhc.exe
    C:\Temp\khczxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khczxrpkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5292
- - C:\Temp\i_khczxrpkhc.exe
    C:\Temp\i_khczxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxromh.exe ups_run
  2⤵
  PID:1180
- - C:\Temp\pmhezxromh.exe
    C:\Temp\pmhezxromh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxromh.exe ups_ins
  2⤵
  PID:1344
- - C:\Temp\i_pmhezxromh.exe
    C:\Temp\i_pmhezxromh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  PID:3500
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  PID:5260
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljhbzwr.exe ups_run
  2⤵
  PID:1596
- - C:\Temp\wtrljhbzwr.exe
    C:\Temp\wtrljhbzwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljhbzwr.exe ups_ins
  2⤵
  PID:4016
- - C:\Temp\i_wtrljhbzwr.exe
    C:\Temp\i_wtrljhbzwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trligbytrl.exe ups_run
  2⤵
  PID:3160
- - C:\Temp\trligbytrl.exe
    C:\Temp\trligbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trligbytrl.exe ups_ins
  2⤵
  PID:3408
- - C:\Temp\i_trligbytrl.exe
    C:\Temp\i_trligbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqnlfdys.exe ups_run
  2⤵
  PID:4496
- - C:\Temp\dyvqnlfdys.exe
    C:\Temp\dyvqnlfdys.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqnlfdys.exe ups_ins
  2⤵
  PID:2944
- - C:\Temp\i_dyvqnlfdys.exe
    C:\Temp\i_dyvqnlfdys.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidavsnl.exe ups_run
  2⤵
  PID:5848
- - C:\Temp\sqlidavsnl.exe
    C:\Temp\sqlidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidavsnl.exe ups_ins
  2⤵
  PID:1168
- - C:\Temp\i_sqlidavsnl.exe
    C:\Temp\i_sqlidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsqkicays.exe ups_run
  2⤵
  PID:4548
- - C:\Temp\xvsqkicays.exe
    C:\Temp\xvsqkicays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsqkicays.exe ups_ins
  2⤵
  PID:1296
- - C:\Temp\i_xvsqkicays.exe
    C:\Temp\i_xvsqkicays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfzxrpk.exe ups_run
  2⤵
  PID:5916
- - C:\Temp\spnhfzxrpk.exe
    C:\Temp\spnhfzxrpk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfzxrpk.exe ups_ins
  2⤵
  PID:5800
- - C:\Temp\i_spnhfzxrpk.exe
    C:\Temp\i_spnhfzxrpk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxrpkh.exe ups_run
  2⤵
  PID:3024
- - C:\Temp\pmhezxrpkh.exe
    C:\Temp\pmhezxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxrpkh.exe ups_ins
  2⤵
  PID:4328
- - C:\Temp\i_pmhezxrpkh.exe
    C:\Temp\i_pmhezxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1724

C:\Temp\kicxusnkfc.sys
C:\Temp\kicxusnkfc.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\zwrpmkecau.sys
C:\Temp\zwrpmkecau.sys
1⤵
- Executes dropped EXE
PID:5544

C:\Temp\xrpjhczurm.sys
C:\Temp\xrpjhczurm.sys
1⤵
- Executes dropped EXE
PID:5956

C:\Temp\ecwugeywro.sys
C:\Temp\ecwugeywro.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\wtrljhbytr.sys
C:\Temp\wtrljhbytr.sys
1⤵
- Executes dropped EXE
PID:1960

C:\Temp\vtqljdbytr.sys
C:\Temp\vtqljdbytr.sys
1⤵
- Executes dropped EXE
PID:2692

C:\Temp\tnlfdyvtnl.sys
C:\Temp\tnlfdyvtnl.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\qnifdaysqf.sys
C:\Temp\qnifdaysqf.sys
1⤵
- Executes dropped EXE
PID:3044

C:\Temp\pnicausqki.sys
C:\Temp\pnicausqki.sys
1⤵
- Executes dropped EXE
PID:2660

C:\Temp\khfzxrpnhf.sys
C:\Temp\khfzxrpnhf.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
PID:2480

C:\Temp\zurpjhbzur.sys
C:\Temp\zurpjhbzur.sys
1⤵
PID:5536

C:\Temp\zwromgebzt.sys
C:\Temp\zwromgebzt.sys
1⤵
PID:2744

C:\Temp\vtoljdbvto.sys
C:\Temp\vtoljdbvto.sys
1⤵
PID:4524

C:\Temp\bvtqoigays.sys
C:\Temp\bvtqoigays.sys
1⤵
PID:3004

C:\Temp\gaysqligay.sys
C:\Temp\gaysqligay.sys
1⤵
PID:4648

C:\Temp\xvsnkicavs.sys
C:\Temp\xvsnkicavs.sys
1⤵
PID:808

C:\Temp\axspkicaus.sys
C:\Temp\axspkicaus.sys
1⤵
PID:700

C:\Temp\pmhfzwuspk.sys
C:\Temp\pmhfzwuspk.sys
1⤵
PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwugeywro.sys

Path C:\Temp\ecwugeywro.sys
Size 141KB
SHA256 d9b80f441fa2ffd23468b8664dddb1b50cbf89f7a4a0ca3f7c9ad4ea21fafabd
MD5 81702c3fdcf926ab2a136cf345177ecd
SHA1 91db5dc87f756aa2913dede3295dedf5d5cd8212
SHA512 fd576674a654e6d59f1a6f68ca989f1b462fb416763faa73110e77f756bf1e4f437859abe640c54c74e322093290a2971e30dc97b922f4f0d69920e3ecf706ed
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T137E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcupkidau.exe

Path C:\Temp\i_kfcupkidau.exe
Size 243KB
SHA256 d7b1f223172c723df5312b5da8382450a9bffb75d148e11ed5d6b44bed1877be
MD5 ffc4673a42b657f63b6150d8d2adb731
SHA1 ec91789793c63efb4716a7e5de23feb6b0153cbe
SHA512 6725adee11de324fa1cf29ec2b914d4e56b7170f77eb0ea463a34a5f78798e255e6168f48fa3009904b145fe460e319e23ad5b0523c6f023d7ae991e58ef65c6
SSDEEP 3072:thn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:zn7nLQka3lLNngoqRttA7b
TLSH
T11334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpkhczurpk.exe

Path C:\Temp\i_rpkhczurpk.exe
Size 243KB
SHA256 54c6aaecd48bed96c17ee666cf2c1c05f3837097f0c343497cfce5ee2e4ed7b5
MD5 b18c5771d2124b295c5c5a3bf4157f95
SHA1 7b29e81fa6505ada5842dda9800702eab4ba448e
SHA512 72a98c9ad61dc6e12e462b315330c537dfaad9fbcf80c482d557ad1275b4dd142b820cae90e1113760890abf8d86ec4d960be54ac6aa78ecc0f99566db806cec
SSDEEP 3072:ghn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:Yn7nLQka3lLNngoqRttA7K
TLSH
T1F934590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmgeczurp.exe

Path C:\Temp\i_rpmgeczurp.exe
Size 243KB
SHA256 21259fac18cb8754d7eae251135c2169c3508a11a70359ebe0c57306d22825ce
MD5 cc8e7472eff25386f047af913efd9b46
SHA1 e8eec882e4c9b34858c292d67978822e869a0183
SHA512 a0e2b5216718d353421cab5755afde929fa6c4749527689741e0f491dfcca748f9c736d4db4756b96ebcfdbd7ac0d5c46ff4b5c185d6ea25a2c350f9794cd909
SSDEEP 3072:Vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:Ln7nLQka3lLNngoqRttA7L
TLSH
T18834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trojgbztrl.exe

Path C:\Temp\i_trojgbztrl.exe
Size 243KB
SHA256 af10255c31afc98287143ad21e8136ff1ca505770e8b288cadb244331e06592a
MD5 c7c21abd28e712bdf464ee2663f4b9c7
SHA1 ea66802a52a12ab4cdd689474e8e6a67583ea13d
SHA512 0fb32848bbf1cee227a36012a1ec006a1e5694a31fa8a4694cd13045c2fd4159b239e4b9fe7798552e11abbd359d5ae31aa74e7549404623ddbcdf3052259fd3
SSDEEP 3072:vhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:Zn7nLQka3lLNngoqRttA7F
TLSH
T10434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wusmkhcxus.exe

Path C:\Temp\i_wusmkhcxus.exe
Size 243KB
SHA256 630631990d64c3806c9a366f6e22b9d377b02c0f5a9ec428e1121c20a862aac6
MD5 225449abd2ee49163714c85d47f14579
SHA1 b05bd84624e83b3289bb2d36ba2683f4a4e36d87
SHA512 be2fc8f2bc49b74a2827c071c4a3ea258fac0b2db25d31696b97d6ccb1602a0ee77f159790a0bae7e02dab61be298e90c35832cfe9e5028c704bbdbec54c4cc7
SSDEEP 3072:Rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:fn7nLQka3lLNngoqRttA7X
TLSH
T10134590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrojytrlj.exe

Path C:\Temp\i_zwrojytrlj.exe
Size 243KB
SHA256 29771cd904f2fe22cc2cbc36d214216fa8049dd282135d8aab5dfe445718b85f
MD5 5a9dc205ec073f2d9062eec428bb27f0
SHA1 d1a061dedbf8076132411a3f8bccff7a59225866
SHA512 f15227a112dde15fcdef43c00b6e17cbd381cd2dbc6a11e3a5eb188a4fb65e6600a382046e45927920bca5f4c6c355e61358a7fc95d838854cc597c257452bc8
SSDEEP 3072:/hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:pn7nLQka3lLNngoqRttA7R
TLSH
T1B834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcupkidau.exe

Path C:\Temp\kfcupkidau.exe
Size 243KB
SHA256 5992fb78171f55b5b8d722e94c72afeec4ab8ad3d1cacc1abb0a2f855e4230a4
MD5 d7e2aeca9393560f0e4c02fbf9897ac2
SHA1 710a3e3890b318ea5369e3ec1766719f4fa4614c
SHA512 83c39854a18fd7b5317254e2ca679d6a3f810988a74edf8785aeffaf87d3ff4a210cb62cb3e0926321ff22cd675e6e78dff6389d54a241ef514c3467af0624b5
SSDEEP 3072:Lhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:Nn7nLQka3lLNngoqRttA7V
TLSH
T1B334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicxusnkfc.sys

Path C:\Temp\kicxusnkfc.sys
Size 141KB
SHA256 8ab9496eabfb5b537b055d8dbea58447765258d40f3e076c4b5f5cd7f34b5f81
MD5 d5f849764f3ee6137632d23ab79c4f14
SHA1 9274c1d58cf19ba3549c54531fa6ebc79bf510ac
SHA512 75a8e4602964c1ddaa6535d61d02290abd5ff3c4d94e230ef4d4a8038e6eb7cd6ca3a7d764babcd882c89b0bc691f938e541dc64418f706a6922e5a739c3662e
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhczurpk.exe

Path C:\Temp\rpkhczurpk.exe
Size 243KB
SHA256 cdc64dc859331f1caea3f638806a6a4bc7b204c801d8e1dd9768175ffc42021e
MD5 a828644f6bb9cef82ddbdd86c2c192cd
SHA1 be2b39288196aef4a627c39485831f85029b3125
SHA512 13a653c1f06dd93837f29db37b0a43c01038255d148e320056540f36729b39524248802a2e55a3b93738024cd554bce12a2367b3399d5bf89745953044102186
SSDEEP 3072:ghn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:Yn7nLQka3lLNngoqRttA7m
TLSH
T1D234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmgeczurp.exe

Path C:\Temp\rpmgeczurp.exe
Size 243KB
SHA256 e3cf67418d24387688da00e539ee09596039472057c18d3e80ac13b4956114e3
MD5 9d20d1aab7de586d1e708a25964a5282
SHA1 b6b714adad190d1cee07857543473e59a075a7b3
SHA512 2e26506fa2fbdadb9f5ace3f4cb0e16f7bee8106b13a9d4d8b8810f880fbeae3bf2ddecf624b971c18626ae0f2588bb4d164265ff93101e49e61405ed5eb7e6d
SSDEEP 3072:whn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:on7nLQka3lLNngoqRttA7u
TLSH
T13034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojgbztrl.exe

Path C:\Temp\trojgbztrl.exe
Size 243KB
SHA256 07cc82795fca67ea7324060cfeaa30b7f1493502416d773a27ad4ef61850e666
MD5 eab3382d6be451312542209ffa0baeaa
SHA1 67ccfec8d3a22a7b1c13010aa657a67e72adad87
SHA512 a2ad7c34cd0023400325a5c88d8a4049c7dbd4adfcb6b68d0ba1c640baad7d04ad84a8ab7316b885529db9c7bea478c755dcd450220f7b07b008da34b721e5a8
SSDEEP 3072:Whn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:qn7nLQka3lLNngoqRttA7w
TLSH
T1AE34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbytr.sys

Path C:\Temp\vtqljdbytr.sys
Size 141KB
SHA256 5089d8bfa2b204a249eac3723e114da89836a827fcba8f9cb908ac78d29a5d47
MD5 2de5d549e0717737ea0374926e15a0a2
SHA1 04714fb7a837d21603c33712c2ca3a3f6e0ce5dc
SHA512 0fc618ba6245b0d57bfd020c29f54f8e38a4a8b4acaf07d837790ef83710305973901b5abd3601351d5a2e3d06651d1f18a5d9862701f8dc12930eb1f2ed9e85
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljhbytr.sys

Path C:\Temp\wtrljhbytr.sys
Size 141KB
SHA256 854d0d09bfeb64ce42fd8024383a00ce4d61ec07e7c4ee5b879c1a4c5122c19b
MD5 44ac6c10c1def1cb3ffb5657571127a4
SHA1 89b8cd51fc65dbd93e81e0932af0fb06cf505b0b
SHA512 d2de1ed59c6c4a5159d47497bb3148a0cb6c12b15ac0d64c4c08a597e373b24fea6a0986ad618d8144df52e968b17e0a5b3bff701a6962175f56f0b397cd6797
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wusmkhcxus.exe

Path C:\Temp\wusmkhcxus.exe
Size 243KB
SHA256 e9fc7e323815bae1a1c7ffa24b45aff5de54b88762675ca93d268a1855a88359
MD5 86b6df8fcccd9db067c5526288730e87
SHA1 b6cf5badf25d76e0e9a8424e36ee82aa5c80e286
SHA512 dca37b903f49b76bcb5edbe434237a4e12e419fc6393b4c634bff088ec12a962097bc91cb3f922435b62209bea1f55b265eb4a0f172419a0734cf624127d2535
SSDEEP 3072:jhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:1n7nLQka3lLNngoqRttA7N
TLSH
T14B34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurm.sys

Path C:\Temp\xrpjhczurm.sys
Size 141KB
SHA256 db3670d6675d538197b62741db8dab02136a6dfb75a3b0f9287876dbf9ad4690
MD5 eb52f2ecad510a87c97c0da767a5bcf3
SHA1 b26049ebaf624ba3ec81e4c82190c77da6f54226
SHA512 ed53e3b9a320547d8ec3f51975a386ce527f35d0c7a93a15034a4d285ea8338740731c366acbd44311ce2c2a83f13559d9ebe64b9c60a38510b52f2b2e20fd42
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojytrlj.exe

Path C:\Temp\zwrojytrlj.exe
Size 243KB
SHA256 624bc7f3a88ea023eef86b2db399b35dc66fcf7e4fdcf64ec231906558411b04
MD5 cb6537e9594c75c4a26d95491bfc3ec0
SHA1 60c7993b8b60e6b8b5ec0cc6fb837a48d2e79eb3
SHA512 772c8a2b0e24d34d80ab73aead71e24cc1bf2c8c9c871b5f4a3aa982349e744e276c21781dd41e616a44d66cf46c15a31dd84ee2af60e621cd342f5ef30e0c98
SSDEEP 3072:Zhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:Xn7nLQka3lLNngoqRttA7r
TLSH
T17034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpmkecau.sys

Path C:\Temp\zwrpmkecau.sys
Size 141KB
SHA256 6d3cb0680b35577a37355465e55176310c7ed0844cd0f6412fbe552c9016c045
MD5 6210f43769d7093f4a7ca860340dc0cd
SHA1 9d82f3972f9b0e7d92692aa7df6b7582e1e29262
SHA512 bcc0e2cc65e0f459c6ad62faf1d4077c99b43b165344bf886400b0e0753cc6174f3ec89c7274eb486a8288a81b040bd2c305dcce68b820244ebb23c5e2c9c1cd
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

252899d2-771e-46f7-8bad-12600d500209.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\252899d2-771e-46f7-8bad-12600d500209.tmp
Size 35KB
SHA256 f099bfdde98c9766941bef329cba75b38faed6c118cd0d9c9cff58a45a6a9649
MD5 0d07fe25fa2a31cb04e5365eaa32bd43
SHA1 5d38fbecc414458a4590527eb26389c34ec7d782
SHA512 5218b9b668a6cce29f04c98edeebaf211658fbedbc0b87e50d97940d29a38f1e0c088131aaa96e3eaa09c4949ebaeb5498da75c8809f21a9c22f10f4b07d7592
SSDEEP 768:yS3GzUogm1d8HQrDmGA5b65Q92RQMPbzRsbVz:yS3g/tAF65dQMRsZz
TLSH
T1F7F2BF71ECB5DEB36CFDA1813647B3452FB84533D4C98A9498E6AF0D0583A8E030B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e33bc6e-d262-4796-a388-266d17c2bbdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e33bc6e-d262-4796-a388-266d17c2bbdf.tmp
Size 43KB
SHA256 dee29c332cde58d32a54c0b8f593350aa0de1c7c2327e6e5c53cb2413c5e88c6
MD5 9ae7b2c5f2b2d00057525ba07be35efd
SHA1 60dba3edfb16bc4fa1339385b92503c9826760d6
SHA512 65b084730c7a94b79648ba4225c751b189fe1c7723bd1a1d80146ed094092b97d31ec20345ceef75194cb00a6377630f867faee20094e378ba1a770f1e7fef7b
SSDEEP 768:6FQw3IwgozUvue1d8HEDmGA5b65Q92RQMPbzRsbVz:hw3JcAF65dQMRsZz
TLSH
T1981306F298E38A77E8AD5383677D6E455EBCC163B4888590B7D55E0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b25427c-7fda-477c-9a48-e17dcca00883.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b25427c-7fda-477c-9a48-e17dcca00883.tmp
Size 35KB
SHA256 7f4b192fbbcf3f1361ac73a594028eb52aa2b08b58bfc66194bd043c983fbe07
MD5 54af1863a8b07681631c4cf0744015f8
SHA1 edf767d6724a6eb0e834000d8bd4fe9c8fa34960
SHA512 26c8bd6217a7ce930c441acb0b29916b959b7183b8867526ad754be99fc5630951ffb54d8e52d7e296e9eb74c9d59dc3c1af6654e937b984c3010a44e3c36537
SSDEEP 768:LS3rPUogm1d8HQ0DmGA5b65Q92RQMPbzRsbVz:LS3j/cAF65dQMRsZz
TLSH
T1A4F2BF71ECB5DEB36CFDA1817647B3453FB84573D4C98A9498E5AB0D0583A8E030B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f57741b-8566-4118-80c8-7a5985e9bc98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f57741b-8566-4118-80c8-7a5985e9bc98.tmp
Size 39KB
SHA256 db1d85683f16a122512343c5bddc64098aeadfb9c78aaf98713cb781ab666376
MD5 f443550a64c1f48a585b9b978a6d2bd0
SHA1 6fc541d6891d797696a5214e334480db010458b8
SHA512 bbb6d18128f11115577154eefe54fd57258fb6d1ecc44ab6e56c67f5031c6bb930dadc9b0a0094d02061c5a92703dc4d577bb3bb8c37871e844ba1d7d58548ac
SSDEEP 768:U/UxvxjgC+B33fmngm1d1tDmGA5b65Q92RQMPbQFj0O:BZj3+B3Pa3AF65dQDFQO
TLSH
T1A503C036ECA1AEB7DCF95280364BB35AAFF84473C1C955A049F96F1D06C768C430B85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

0d403e5f-fc07-4a93-877a-160f4523f49c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d403e5f-fc07-4a93-877a-160f4523f49c.tmp
Size 29KB
SHA256 6d134e6d8ea3b3e8662ace81153717e5980867e4527b6e134ee2e7917419ffcc
MD5 3c259f6d78f5c4c9e33518600653687c
SHA1 38293dad8d75fa1117e241b7b27a2662c062118d
SHA512 59eed7bb3cd47a9e4ce278d13e433d51bc8a03394eee9b02e366d9412ebbfb73fa84dedf05e8f66a4aa7237f5d433584eab650b48aae4ef80e23ef4b232ce332
SSDEEP 768:L7aapW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXCFdNMMroHe:L7aap2Eb6DWgptfvDu1ja8CFrMX+
TLSH
T1D2D2EB7B640CCB7F4F904ADDEC197E9F6D6802CB9698CD4047FA941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b2ac0a2-619b-479f-95f1-80362c3d70dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b2ac0a2-619b-479f-95f1-80362c3d70dc.tmp
Size 11KB
SHA256 6b822f4d7ae14302a592b1886cc49442549ca4e251f3c8127b67d11a12d94681
MD5 e6f327209b1481a79a3544fd87221ae0
SHA1 4ab6cdf2305f7f16faa1ed66988d0a82ae716365
SHA512 993e083a2291cdbf0668661791a4c36694d5ac0fa29e1d0fd4da0e3de4cda5b4eb561b952f0a4db42cbd87c70283d754fb0cd3f593591cc6a1f55c2d2361f6d4
SSDEEP 192:sxRMRuCg/fsNsq/ZSzoA8p9S/g6+WNC7T/Y2AcFGGYkIgDJpJ:sxRMrg/fsNsqhf0/5u/LzV
TLSH
T1FF42B755AD28A97B4CCFD21DBB657F53E2F95132A0D01E48A6FC8A1C14E76CE630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48af2094-cf22-4fe5-91c2-f29b930b2df2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48af2094-cf22-4fe5-91c2-f29b930b2df2.tmp
Size 11KB
SHA256 24f47fe1717f8c1f39e4711ba9feefee7a3a5d47fb056ab75c47d6ca62934e92
MD5 c4d3b76295a2e05dd9b9cde436d85402
SHA1 9eb93739e54e1414399fc1cd257b33a48cd4a9cc
SHA512 a2c566f05b205061943747d538aade6153b7f65e64e89d4c0c0bf047ad4e574c0fc66fd0cd55e819e30095d7f82112c946f07e76e4db4d500da1ca3efdf409cc
SSDEEP 192:sxRMRuCg/fsNsv/ZSzoA8p9S/g6+WNC7T/Y2/cFGGYkIgD7pJ:sxRMrg/fsNsvhf0/5u/2zr
TLSH
T15442B715AE28A97B4CCBD21DBB657F53D2F91132A1D01E48A6FC861C14E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a905ce2-0fe6-433a-9e9d-8ec53a35e7d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a905ce2-0fe6-433a-9e9d-8ec53a35e7d7.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 353e3ee9ceea35375b37c59fb293c830d3fdc7840ea41766a09b856ee51173b2
MD5 4f633eddcbad609d96ac88449bf0b421
SHA1 0b1c64086397c67beb4e6525a12bd0206c8208c1
SHA512 ee97956a71893d056619e259f756e550b995b931e2d7a3d72c1730636817719d4f45981673edd69cbaf4ff0ccfcf56fa8555ca3cc2c087a9017f029a257b645f
TLSH
T1365198824184E3D1CB5C4773A5C565C776709BFC978F1E33A8E0E768971E702B25C844
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2888e7d4c396acff645e0a171d24332e983df830975295ef1406cec0f10254e
MD5 38c57d3d42b6b9bce30074e6682e803e
SHA1 e48ecfb6da54cbade15509ce1e0b0157b5d3d6b0
SHA512 d6acc6f84c940764db5c94749c5f721fd1f3909df6780f90deade4907150119f5ef3168b225dd3963e2af4fc949c78279fb4ddf8c88306daa91a1a8a24d435e7
TLSH
T1145198824284E391CB6C4373A5D565C77B709BFC978F1E33A8E0E7649B1E302B25C854
MD5 SHA1 SHA512 TLSH

Submit Download

27f574be-3612-4053-932c-676c5b7491a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\27f574be-3612-4053-932c-676c5b7491a5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

705748d1-88e2-4241-b847-07c05eb064c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\705748d1-88e2-4241-b847-07c05eb064c4.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

acb3d1c0-735e-4034-b1ae-20ce093fb023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\acb3d1c0-735e-4034-b1ae-20ce093fb023.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b08899ca-fcda-4b83-8663-7e675d48db56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b08899ca-fcda-4b83-8663-7e675d48db56.tmp
Size 2KB
SHA256 f0c7c76a856d364fd34d85925a3c5c9fe566671d8637f4aed3dcac9dec26e1b5
MD5 50953997d4258c34d86ef03c139758b3
SHA1 93ef514daf915d78288bf05a77b919b10164b28b
SHA512 941f17695a887cfee4c0ea35728135cf7c05bbd6d4ee34bd877b5b53a4c77df1d5465cbc1382316d1042ea2f57366ede449a02da3db42c5b02cedacbda9f2d6f
TLSH
T1A4519EF3C3E8866DC90156F4AB186E1BCE1D0955832C3D5AC9E4AE2B93E2471D18199E
MD5 SHA1 SHA512 TLSH

Submit Download

f64918b9-374f-4c5d-9edc-7c291e4efdf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f64918b9-374f-4c5d-9edc-7c291e4efdf6.tmp
Size 11KB
SHA256 ee9ea6f3d38d8719f2e6c1f8e3a84f5299afa71108df8afe433cae469fcc864c
MD5 2d96b087a6d1b5b443c990403e7df289
SHA1 43039768d3d7bce8d5339b7d193820a1c4995430
SHA512 cf535d1367797f0a08024adbbaa04882ac17196d6372807fde9d3089991f163ee8a5ea85334a204973e3f593c83c8548824bfab79798cbde17b5fe9f8b1e8295
SSDEEP 192:sxRTRuCg/fsNsB/ZSzoA8p9S/g6+WNC7T/Y2/cFGGYkIgVpJ:sxRTrg/fsNsBhf0/5u/2z9
TLSH
T14C32B715AE28A97B4CCBD21DBB657F53D2F91132A0D01E48EAFC861C14E76DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

412a669a-941a-4468-83d2-a8853e11d2e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\412a669a-941a-4468-83d2-a8853e11d2e7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6133d299-a239-4ad0-87c0-94c3a2168710.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6133d299-a239-4ad0-87c0-94c3a2168710.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

9df438ac-d1a7-47dc-a6d0-6cd88281f145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9df438ac-d1a7-47dc-a6d0-6cd88281f145.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

b41cddd3-8e9f-444d-a3e8-fd234332ce2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b41cddd3-8e9f-444d-a3e8-fd234332ce2b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d784520b-fc2f-442c-b82b-dccfcbce4283.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d784520b-fc2f-442c-b82b-dccfcbce4283.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d1b937de-dd07-49b3-aa81-4bfbda8a226f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d1b937de-dd07-49b3-aa81-4bfbda8a226f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

d52c0349-fa43-4da8-a547-6287958b653a.tmp

Path C:\Users\Admin\AppData\Local\Temp\d52c0349-fa43-4da8-a547-6287958b653a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f447852b-b9d9-4d56-870a-c3517b60d0b5.tmp

Path C:\Users\Admin\AppData\Local\Temp\f447852b-b9d9-4d56-870a-c3517b60d0b5.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2948_1762436106\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_1575427821\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_1912651869\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_537147865\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2948_879910192\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/808-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2480-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2692-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2744-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2944-190-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3044-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3044-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4212-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4648-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5536-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5544-239-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download