c785d079250f174f7eed840fe0ba0b6b152e093ba6a87308e89e5c4b990b101e

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
Size 243KB
Sample261006-r2laascv5k
SHA256 c785d079250f174f7eed840fe0ba0b6b152e093ba6a87308e89e5c4b990b101e
MD5 28fd7a7511eafe85804c62414fc620f0
SHA1 87c59eab12ed61e92700c5688fd29191c4905569
SHA512 be3be6a5700691c1b550bb76fd774c7042de328361a478ef81922c3c0348ec4026ad9dfc7fd2447f0b9b9fe1b5c5e5ec6ad35c6fc9fecb4f3dfee6b1a0b8d06e
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:d3frLQsa3lLNngoqRttA7T
TLSH
T1D9345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5092	CP.exe
3044	nigaytqlid.exe
5832	CP.exe
2656	CP.exe
3388	i_nigaytqlid.exe
5592	igaysqlidb.sys
4952	CP.exe
5800	yvqoigdyvt.exe
2544	CP.exe
3968	CP.exe
4928	i_yvqoigdyvt.exe
3256	qnifdxvqni.sys
3216	CP.exe
2340	nicavsqkic.exe
4672	CP.exe
2424	CP.exe
200	i_nicavsqkic.exe
6100	ifaxspnkfc.sys
2812	CP.exe
4176	ifaxvsmkif.exe
120	CP.exe
5592	CP.exe
5288	i_ifaxvsmkif.exe
5516	xsqkhfcaus.sys
236	CP.exe
1484	kecxupnkfz.exe
1416	CP.exe
4928	CP.exe
3256	i_kecxupnkfz.exe
5908	mkhcausmke.sys
4736	CP.exe
5316	hfzwusmkec.exe
5496	CP.exe
452	CP.exe
3952	i_hfzwusmkec.exe
2556	pjhbztromk.sys
5332	CP.exe
4172	pjgezwurmj.exe
5960	CP.exe
5304	CP.exe
2996	i_pjgezwurmj.exe
2260	wtrojhbztr.sys
4944	CP.exe
5816	ywqojgbztr.exe
5260	CP.exe
1256	CP.exe
5152	i_ywqojgbztr.exe
2772	mgeywqojge.sys
4924	CP.exe
560	tolgdywtol.exe
6140	CP.exe
3168	CP.exe
4220	i_tolgdywtol.exe
3032	bytqljdbvt.sys
5400	CP.exe
3288	wqolgdywqo.exe
2668	CP.exe
3012	CP.exe
3064	i_wqolgdywqo.exe
2072	vsqkidaysq.sys
5036	CP.exe
2064	qnlfdxvsqo.exe
4848	CP.exe
5888	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1678973094\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1678973094\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_164434651\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_164434651\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1871717712\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1871717712\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1871717712\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_506660599\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1871717712\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidyvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvsmkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzwusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nicavsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjgezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvsqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvsmkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nicavsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzwusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjgezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidyvtoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvsqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4216	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5948	ipconfig.exe
4540	ipconfig.exe
4792	ipconfig.exe
4864	ipconfig.exe
4792	ipconfig.exe
2212	ipconfig.exe
4192	ipconfig.exe
5416	ipconfig.exe
3064	ipconfig.exe
1676	ipconfig.exe
4368	ipconfig.exe
6004	ipconfig.exe
4508	ipconfig.exe
3496	ipconfig.exe
4860	ipconfig.exe
4192	ipconfig.exe
4304	ipconfig.exe
5264	ipconfig.exe
2476	ipconfig.exe
4668	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{3A5DB5DD-2DC8-4B73-B52C-060F80CCDA29}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	msedge.exe
696	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3388	i_nigaytqlid.exe
Token: SeDebugPrivilege	4928	i_yvqoigdyvt.exe
Token: SeDebugPrivilege	200	i_nicavsqkic.exe
Token: SeDebugPrivilege	5288	i_ifaxvsmkif.exe
Token: SeDebugPrivilege	3256	i_kecxupnkfz.exe
Token: SeDebugPrivilege	3952	i_hfzwusmkec.exe
Token: SeDebugPrivilege	2996	i_pjgezwurmj.exe
Token: SeDebugPrivilege	5152	i_ywqojgbztr.exe
Token: SeDebugPrivilege	4220	i_tolgdywtol.exe
Token: SeDebugPrivilege	3064	i_wqolgdywqo.exe
Token: SeDebugPrivilege	5656	i_qnlfdxvsqo.exe
Token: SeDebugPrivilege	2556	i_ausnkfdxvs.exe
Token: SeDebugPrivilege	3148	i_causmkecxu.exe
Token: SeDebugPrivilege	2904	i_hecausmkfc.exe
Token: SeDebugPrivilege	5656	i_mjhczusmke.exe
Token: SeDebugPrivilege	2556	i_mjhbzwrojh.exe
Token: SeDebugPrivilege	3512	i_rojgywqomg.exe
Token: SeDebugPrivilege	4212	i_qojgbytrlj.exe
Token: SeDebugPrivilege	2556	i_nlidyvtoig.exe
Token: SeDebugPrivilege	1992	i_qkidavsnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5564 wrote to memory of 3192	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	89
PID 3192 wrote to memory of 4388	3192	iexplore.exe	90
PID 4388 wrote to memory of 3540	4388	msedge.exe	91
PID 4388 wrote to memory of 2448	4388	msedge.exe	92
PID 4388 wrote to memory of 4216	4388	msedge.exe	93
PID 4388 wrote to memory of 2448	4388	msedge.exe	92
PID 4388 wrote to memory of 2448	4388	msedge.exe	92
PID 4388 wrote to memory of 4912	4388	msedge.exe	94
PID 4388 wrote to memory of 4912	4388	msedge.exe	94
PID 4388 wrote to memory of 6092	4388	msedge.exe	97
PID 4388 wrote to memory of 2312	4388	msedge.exe	96
PID 4388 wrote to memory of 6092	4388	msedge.exe	97
PID 4388 wrote to memory of 6092	4388	msedge.exe	97
PID 4388 wrote to memory of 2312	4388	msedge.exe	96
PID 4388 wrote to memory of 2312	4388	msedge.exe	96
PID 4388 wrote to memory of 2244	4388	msedge.exe	98
PID 4388 wrote to memory of 2244	4388	msedge.exe	98
PID 4388 wrote to memory of 2244	4388	msedge.exe	98
PID 4388 wrote to memory of 3948	4388	msedge.exe	99
PID 4388 wrote to memory of 3948	4388	msedge.exe	99
PID 4388 wrote to memory of 3948	4388	msedge.exe	99
PID 4388 wrote to memory of 3496	4388	msedge.exe	100
PID 4388 wrote to memory of 3496	4388	msedge.exe	100
PID 5564 wrote to memory of 5092	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	102
PID 4388 wrote to memory of 4396	4388	msedge.exe	104
PID 4388 wrote to memory of 2968	4388	msedge.exe	105
PID 4388 wrote to memory of 4396	4388	msedge.exe	104
PID 4388 wrote to memory of 2968	4388	msedge.exe	105
PID 3044 wrote to memory of 5832	3044	nigaytqlid.exe	107
PID 4388 wrote to memory of 2552	4388	msedge.exe	111
PID 4388 wrote to memory of 5940	4388	msedge.exe	112
PID 4388 wrote to memory of 5940	4388	msedge.exe	112
PID 4388 wrote to memory of 4092	4388	msedge.exe	115
PID 4388 wrote to memory of 4092	4388	msedge.exe	115
PID 5564 wrote to memory of 2656	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	116
PID 5564 wrote to memory of 4952	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	120
PID 5800 wrote to memory of 2544	5800	yvqoigdyvt.exe	122
PID 5564 wrote to memory of 3968	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	125
PID 5564 wrote to memory of 3216	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	129
PID 2340 wrote to memory of 4672	2340	nicavsqkic.exe	131
PID 5564 wrote to memory of 2424	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	134
PID 5564 wrote to memory of 2812	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	138
PID 4176 wrote to memory of 120	4176	ifaxvsmkif.exe	140
PID 5564 wrote to memory of 5592	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	143
PID 4388 wrote to memory of 1040	4388	msedge.exe	146
PID 4388 wrote to memory of 4996	4388	msedge.exe	147
PID 4388 wrote to memory of 4192	4388	msedge.exe	148
PID 5564 wrote to memory of 236	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	151
PID 1484 wrote to memory of 1416	1484	kecxupnkfz.exe	153
PID 5564 wrote to memory of 4928	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	156
PID 5564 wrote to memory of 4736	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	160
PID 5316 wrote to memory of 5496	5316	hfzwusmkec.exe	162
PID 5564 wrote to memory of 452	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	165
PID 5564 wrote to memory of 5332	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	169
PID 4172 wrote to memory of 5960	4172	pjgezwurmj.exe	171
PID 5564 wrote to memory of 5304	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	174
PID 5564 wrote to memory of 4944	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	178
PID 5816 wrote to memory of 5260	5816	ywqojgbztr.exe	180
PID 5564 wrote to memory of 1256	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	183
PID 4388 wrote to memory of 5864	4388	msedge.exe	185
PID 4388 wrote to memory of 5864	4388	msedge.exe	185
PID 5564 wrote to memory of 4924	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	191
PID 560 wrote to memory of 6140	560	tolgdywtol.exe	193
PID 5564 wrote to memory of 3168	5564	2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_28fd7a7511eafe85804c62414fc620f0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5564
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffaef9ac188,0x7ffaef9ac194,0x7ffaef9ac1a0
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9346117408808678174,8119789044082664696,262144 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2917664492905904553,13200322395658498097,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:11
      4⤵
      System Time Discovery
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,271199799780485875,8756855456195877334,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,15725337014437307585,7446157209663372315,2097152 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,13769508444725428380,14098101671011204101,2097152 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,5114424296130635242,5879340705105176080,2097152 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,4110926896500774669,13031374300440663673,2097152 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,8803600866074575041,5849703451821784463,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,12285310791078174669,10236515073340870999,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,17722451137207668847,16778612789223899902,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10707920280374442723,17098457872354927798,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,10707920280374442723,17098457872354927798,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,14295478769000639839,14227887327633822739,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,7313455140613422091,1864758405076357281,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,9033844278469141927,18111494262838320973,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,4827084493207597136,10607958877288056431,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,12720635665499435537,17182215234315872381,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,9604249327754092986,13290885353179065533,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,2569568048323513526,3468442135402199946,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,3398282935848469528,2369806352230342593,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,1618230353407769630,2928199200732077855,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,13010089921808506303,17785149153219074803,262144 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,4560841676770109969,17012571472120825322,524288 --field-trial-handle=2384,i,1438594853488005993,18013576200930484013,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
      4⤵
      PID:5908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaytqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5092
- - C:\Temp\nigaytqlid.exe
    C:\Temp\nigaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaytqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2656
- - C:\Temp\i_nigaytqlid.exe
    C:\Temp\i_nigaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigdyvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Temp\yvqoigdyvt.exe
    C:\Temp\yvqoigdyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigdyvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\i_yvqoigdyvt.exe
    C:\Temp\i_yvqoigdyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nicavsqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3216
- - C:\Temp\nicavsqkic.exe
    C:\Temp\nicavsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nicavsqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2424
- - C:\Temp\i_nicavsqkic.exe
    C:\Temp\i_nicavsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvsmkif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Temp\ifaxvsmkif.exe
    C:\Temp\ifaxvsmkif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvsmkif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5592
- - C:\Temp\i_ifaxvsmkif.exe
    C:\Temp\i_ifaxvsmkif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupnkfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:236
- - C:\Temp\kecxupnkfz.exe
    C:\Temp\kecxupnkfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupnkfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\i_kecxupnkfz.exe
    C:\Temp\i_kecxupnkfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzwusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4736
- - C:\Temp\hfzwusmkec.exe
    C:\Temp\hfzwusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzwusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:452
- - C:\Temp\i_hfzwusmkec.exe
    C:\Temp\i_hfzwusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjgezwurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Temp\pjgezwurmj.exe
    C:\Temp\pjgezwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjgezwurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\i_pjgezwurmj.exe
    C:\Temp\i_pjgezwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1256
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgdywtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\tolgdywtol.exe
    C:\Temp\tolgdywtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgdywtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\i_tolgdywtol.exe
    C:\Temp\i_tolgdywtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5400
- - C:\Temp\wqolgdywqo.exe
    C:\Temp\wqolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\i_wqolgdywqo.exe
    C:\Temp\i_wqolgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvsqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\qnlfdxvsqo.exe
    C:\Temp\qnlfdxvsqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvsqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\i_qnlfdxvsqo.exe
    C:\Temp\i_qnlfdxvsqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvs.exe ups_run
  2⤵
  PID:2004
- - C:\Temp\ausnkfdxvs.exe
    C:\Temp\ausnkfdxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvs.exe ups_ins
  2⤵
  PID:2220
- - C:\Temp\i_ausnkfdxvs.exe
    C:\Temp\i_ausnkfdxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  PID:5860
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  PID:5980
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecausmkfc.exe ups_run
  2⤵
  PID:912
- - C:\Temp\hecausmkfc.exe
    C:\Temp\hecausmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecausmkfc.exe ups_ins
  2⤵
  PID:3088
- - C:\Temp\i_hecausmkfc.exe
    C:\Temp\i_hecausmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhczusmke.exe ups_run
  2⤵
  PID:2920
- - C:\Temp\mjhczusmke.exe
    C:\Temp\mjhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhczusmke.exe ups_ins
  2⤵
  PID:1152
- - C:\Temp\i_mjhczusmke.exe
    C:\Temp\i_mjhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzwrojh.exe ups_run
  2⤵
  PID:1724
- - C:\Temp\mjhbzwrojh.exe
    C:\Temp\mjhbzwrojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzwrojh.exe ups_ins
  2⤵
  PID:1516
- - C:\Temp\i_mjhbzwrojh.exe
    C:\Temp\i_mjhbzwrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgywqomg.exe ups_run
  2⤵
  PID:4368
- - C:\Temp\rojgywqomg.exe
    C:\Temp\rojgywqomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgywqomg.exe ups_ins
  2⤵
  PID:3972
- - C:\Temp\i_rojgywqomg.exe
    C:\Temp\i_rojgywqomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbytrlj.exe ups_run
  2⤵
  PID:540
- - C:\Temp\qojgbytrlj.exe
    C:\Temp\qojgbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbytrlj.exe ups_ins
  2⤵
  PID:824
- - C:\Temp\i_qojgbytrlj.exe
    C:\Temp\i_qojgbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidyvtoig.exe ups_run
  2⤵
  PID:924
- - C:\Temp\nlidyvtoig.exe
    C:\Temp\nlidyvtoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidyvtoig.exe ups_ins
  2⤵
  PID:5968
- - C:\Temp\i_nlidyvtoig.exe
    C:\Temp\i_nlidyvtoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run
  2⤵
  PID:5232
- - C:\Temp\qkidavsnlf.exe
    C:\Temp\qkidavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins
  2⤵
  PID:5244
- - C:\Temp\i_qkidavsnlf.exe
    C:\Temp\i_qkidavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1408

C:\Temp\igaysqlidb.sys
C:\Temp\igaysqlidb.sys
1⤵
- Executes dropped EXE
PID:5592

C:\Temp\qnifdxvqni.sys
C:\Temp\qnifdxvqni.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\ifaxspnkfc.sys
C:\Temp\ifaxspnkfc.sys
1⤵
- Executes dropped EXE
PID:6100

C:\Temp\xsqkhfcaus.sys
C:\Temp\xsqkhfcaus.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Temp\mkhcausmke.sys
C:\Temp\mkhcausmke.sys
1⤵
- Executes dropped EXE
PID:5908

C:\Temp\pjhbztromk.sys
C:\Temp\pjhbztromk.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\wtrojhbztr.sys
C:\Temp\wtrojhbztr.sys
1⤵
- Executes dropped EXE
PID:2260

C:\Temp\mgeywqojge.sys
C:\Temp\mgeywqojge.sys
1⤵
- Executes dropped EXE
PID:2772

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:3032

C:\Temp\vsqkidaysq.sys
C:\Temp\vsqkidaysq.sys
1⤵
- Executes dropped EXE
PID:2072

C:\Temp\xvpnlfdxvp.sys
C:\Temp\xvpnlfdxvp.sys
1⤵
PID:4516

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
PID:2580

C:\Temp\khczurpkhf.sys
C:\Temp\khczurpkhf.sys
1⤵
PID:4208

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
PID:4768

C:\Temp\mjhbztrlje.sys
C:\Temp\mjhbztrlje.sys
1⤵
PID:1320

C:\Temp\wqomgebwro.sys
C:\Temp\wqomgebwro.sys
1⤵
PID:5232

C:\Temp\tqojgbytql.sys
C:\Temp\tqojgbytql.sys
1⤵
PID:6120

C:\Temp\oigdyvtqli.sys
C:\Temp\oigdyvtqli.sys
1⤵
PID:3528

C:\Temp\dsqkidavtn.sys
C:\Temp\dsqkidavtn.sys
1⤵
PID:1868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzwusmkec.exe

Path C:\Temp\hfzwusmkec.exe
Size 243KB
SHA256 a5cfe1d17a2c7e0d8f74d0abbbf03666a4175306e1a65e09c4cf37a811117df9
MD5 26a4f241d30dc711de3f37183537489a
SHA1 764275c5d0185f45fa066f803dc5c1842a0acb36
SHA512 1f337688921cd3273107f73408f8df6b990fbc285f8d989bf112bc556eb90d3bb040d3c1e1a7b93c093ebad2641cc8588c97e59f252c8dbb4686a9543079caa4
SSDEEP 3072:pF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:L3frLQsa3lLNngoqRttA7x
TLSH
T173345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzwusmkec.exe

Path C:\Temp\i_hfzwusmkec.exe
Size 243KB
SHA256 ec5248e122f1a5fdd11467565ba23d1d15046abbb949746ca6ecc79241be3fba
MD5 5073265ecceae01ad3ef244f0b8fd5df
SHA1 d410a2fe8fee34a4fb1e2e0c7ba8066afd2d2a55
SHA512 e9c7fbe5f1970783ee5b5433d938a2213b235df2940b56a0d32566d97a8f8dcd05c7adf38eff4c15155d29867e11a9798d3960f26505723909ad392660178880
SSDEEP 3072:8F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:o3frLQsa3lLNngoqRttA7k
TLSH
T14E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxvsmkif.exe

Path C:\Temp\i_ifaxvsmkif.exe
Size 243KB
SHA256 6d2d55bb6fd8a6daac80303abfd1b626f97deaeb5c933e67bb85043ef1961985
MD5 0b62dd3bd69d1c7e4bae721a89fcfea9
SHA1 bd75712b74e097a50df88ace45939b86ac29eee4
SHA512 7491874097ff7719cfd8eda55722a02a026e86aa07f3f9ee6d7b1e9f543a5a664d8717fafc84144342b303339571f155a1d95b8741d77cf298addb84ff246f88
SSDEEP 3072:bF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:53frLQsa3lLNngoqRttA7r
TLSH
T171345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecxupnkfz.exe

Path C:\Temp\i_kecxupnkfz.exe
Size 243KB
SHA256 88f2abeacebe5326477c9ee20a18871b493b67a2d4fba243d01b8764508f1660
MD5 d8e34ce5394e79ea44998f814c4d9d0d
SHA1 a1583eef739f9bddc3a1c8a87fe8e650eb447cd0
SHA512 a96d5658bdf173dfa335db7afa6a9c11d241fc1a6418a171b8267a7b10ca87df3000dbac9bdd49153f2583902f1cc31025719e1423858893667e2103749bd104
SSDEEP 3072:fF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:93frLQsa3lLNngoqRttA7L
TLSH
T1FD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nicavsqkic.exe

Path C:\Temp\i_nicavsqkic.exe
Size 243KB
SHA256 7685be2f82b7117b5e95d6411daa75668ff8219ab2640de8cbf4569dabd62137
MD5 9eba1326097f4af002698008deca5ea6
SHA1 1bc682decdf3f0c322a7e6a7dff3eb96171330c1
SHA512 455e4153f9f811488bcb8ba4ff02d2fbcba4a10d11926ad9fa00fe07b168d9eedf2bd20b6df1a7b884fc21e8152885438a9e00ea2e29c0a2c3ef0657802d0765
SSDEEP 3072:uF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:u3frLQsa3lLNngoqRttA76
TLSH
T1B2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nigaytqlid.exe

Path C:\Temp\i_nigaytqlid.exe
Size 243KB
SHA256 af40e4328ad5652676dce3922d391bcf591ab7408a272290884126e22a97821f
MD5 a83e85b5c44156453674543f97f69c1d
SHA1 b2124db716d5e7e48a3e9a7837d5d04f7d1227e3
SHA512 5eb32680426e31d44816803712380f29464030678422098bfa4b153b76becc5df2fc9ea122d61d26ef7d50376b34be05c4bc2130ab104d95b0c26ec327e0d2f0
SSDEEP 3072:X4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79O:E3frLQsa3lLNngoqRttA7A
TLSH
T11F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigdyvt.exe

Path C:\Temp\i_yvqoigdyvt.exe
Size 243KB
SHA256 6a7e734f3f08dd3a1a57fd379dc93cb45bfc5f86dbfd816b519e253c1568c4b1
MD5 11159571b98c42913d5d6303d3d4f628
SHA1 6c94d6010a8ee5bec41363c6f7fcd5b0fd25dd9a
SHA512 0e36090b56cbbfb4a7bbcd963b37492edcbd6b19e398a925bc6c0e1ff2ed302796f75dc7dbaf9d623159d91b838f2934e6241bb78147bfab2173260611188859
SSDEEP 3072:JF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:r3frLQsa3lLNngoqRttA7B
TLSH
T18A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxspnkfc.sys

Path C:\Temp\ifaxspnkfc.sys
Size 141KB
SHA256 622ebfdd09f69fb95f1d94c2dcf0ec2b0adfeca2abdd0d0d0e60617aff15a3b3
MD5 f534cb8b99f85e21c77d2379e9466cd0
SHA1 14241536a9c3dbfb70e37fd44deee0993d45c7ca
SHA512 ca5a88388e9ef976beea046c227c4d1dcb4235ca4ac5dd93fed9d9f1689036f45be9d6d123404ec09699efbd81a8a08c55dd6bb1cdf38d7b8f314d6ace468b22
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvsmkif.exe

Path C:\Temp\ifaxvsmkif.exe
Size 243KB
SHA256 1eb00b61ce4d42adf3c4303dc5b3f83aee644bbf9169e12e42b8dc41c7d57c32
MD5 db5fcf804aacf6c61d0a9628a0c1132c
SHA1 252abd00c967e8087105204e6e394cfbe4bb4ab6
SHA512 15f5f739175f88bd6d8a6945f15a5f55ad71fd45782c15a17f97a8620d4ecdb94e2c03365575612707d76d98136bab377f37fb0e719e761efcc4be34f93bb1b9
SSDEEP 3072:GF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:G3frLQsa3lLNngoqRttA7u
TLSH
T158345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlidb.sys

Path C:\Temp\igaysqlidb.sys
Size 141KB
SHA256 58be6d0a8ed0a4179d7f631b6fe052ecc9ce465525e608f2b38d452213da4b0e
MD5 7c2deee05146aad71631abd66b70f432
SHA1 747677a41504ee39c3f414c334ec1fd4c1783949
SHA512 6612535b497386e05b5ce584739931f5e231d567071c6aaf25def5a536d3d46f174393493b5236ac1c6eb7a06d8074b88762f9ece46dcc8a59e875a60b7668c6
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnkfz.exe

Path C:\Temp\kecxupnkfz.exe
Size 243KB
SHA256 6e5db5107c31df59391ecee260b542874adccbb929634131d0007f498645b40e
MD5 46e63b1d0a2295646cddfc954578c8e5
SHA1 bb7f2d1127ceb1ebf65d5a1c486100ee78c100f6
SHA512 d1fd6b8533f1d3421f0906c7f6fed767a8c2ac353890c37dcad0bfc8266c1914f1965c66144a77ede72b1c0f2ef2179c6929934a01408b7b38ea530c21393a2a
SSDEEP 3072:cF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:I3frLQsa3lLNngoqRttA70
TLSH
T12E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcausmke.sys

Path C:\Temp\mkhcausmke.sys
Size 141KB
SHA256 7966a9449c2b2b0eefd9808d529a6712f13a7e55a55d121cac0efef191c5ab32
MD5 b529a5647646e3d68d856bc72190a150
SHA1 dbdae94e9195e7fa9963f44e89157fd2ea649311
SHA512 4e73a7a07391676363b4ae09a8b3f2b52ee37a44183b633a249074db93b5c3f20adbc82ceb2a3244707fc968c4d18a79998692147f806bb8c7b1e582553ec19b
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicavsqkic.exe

Path C:\Temp\nicavsqkic.exe
Size 243KB
SHA256 68c7bd822966be6a65d0d864af7a4dadf52cb597d1c8943a08e8a5f82ce65818
MD5 c5f7aa6f743d75b8b14dd347a4529f28
SHA1 c2472b503ba6bf011ea838fbfa7f8ee056eef224
SHA512 8c2b60dd7806a71f5aaa8efb990d218cf545831e2e2a3c0eae5bc2e24d1c7e7366c44be126a6d92828ab0b51f38212e72956aa04a88f19754e13042f05b326b1
SSDEEP 3072:gF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:83frLQsa3lLNngoqRttA7w
TLSH
T19B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaytqlid.exe

Path C:\Temp\nigaytqlid.exe
Size 243KB
SHA256 08449caca20bea22f346c84a0f8e35371e4d07e57ca32c01c17c2e60836eb0a8
MD5 8ffe2e96d56271972feda736fdced1f6
SHA1 f22176ca40783469618260cd7e7b93e9075d77cd
SHA512 f02ae797806bcf63a4cbeeae4f7e2fc4699604430effde7552667b7e84096b88c4e9312469a334db3452339c5ddfe4bcdb80ccc85d5bddab390a200a5a023e35
SSDEEP 3072:6F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:q3frLQsa3lLNngoqRttA7y
TLSH
T17C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdxvqni.sys

Path C:\Temp\qnifdxvqni.sys
Size 141KB
SHA256 475ad9dd14dac2ec11b6cecf266b8a5725d764383d1c7ba635b368509e9bea56
MD5 77be3a08c69997b741df5f7ed276aab4
SHA1 622ba1fa53cc99e30655f3c8acccb9e7a4a2da46
SHA512 719349a5a75a2a3d6262da24577f66ad2e52746f8cdd94556421e49eb35f5aca75058dc56b2e67fa205fefc57ebd80e03587f288fe331ae79a12f50f9f8d5015
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkhfcaus.sys

Path C:\Temp\xsqkhfcaus.sys
Size 141KB
SHA256 f2b6f780094e2045cb0f514cf563bc197ca397d335b1cdea966934152407fbd2
MD5 eaa910361bf9d2d9f4ce861ba05528f2
SHA1 35011e90627d8e29b8acc6ca864c44e5695820b0
SHA512 2e2942685dc2ad1bc0f9343f94b055ea3bd3cc8fb3931f6b9c3e02c2e1e240ce0fb8df6061c30a9acb79cb1a25ea2033e7b66a3c16d1e2b63852eb66d8e7c138
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdyvt.exe

Path C:\Temp\yvqoigdyvt.exe
Size 243KB
SHA256 31c171b5cd38f9a45cf6c486544e5ba325235f4639fc10d07de476878f66819f
MD5 ef22277ea5888791fcb51f9751e5614e
SHA1 55dadfce395d4306e1b44366e09e5f247aad1b51
SHA512 bf4d99116e3c9224ba7cc13113816f31f79b9c801e30dca7e1e070caa1c2dd12998e1dd818693ffb19ba402b4604d6b6993266f4ba08f9b68d23ef6014f1ceee
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:m3frLQsa3lLNngoqRttA7W
TLSH
T14E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38d006fe-ef8e-4eee-9078-c1e98ab82d89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38d006fe-ef8e-4eee-9078-c1e98ab82d89.tmp
Size 41KB
SHA256 9556a5288bfc63bf58b6055f55ee90a84bb189fae47c1a001ac7f52abf48f61a
MD5 ff0bc3a28c6006dbdf52cd732b32e958
SHA1 410d5381f100b62acce4a1666f190bd9846f059c
SHA512 75749ee00601403d7e3ae6243030d701a18fe5eb07196876357098b1f03904afa849a16ba5a01624c4eaff393d6d48e6051084a4ffcdd47a95353e2a7b21e3f7
SSDEEP 768:w/UxvxjgC+J3ZWgm1OgJboDmGA5b65Q92RQMPbTRsaAd:dZj3+J34bIAF65dQARs1d
TLSH
T1C313CF32ECA4EDB39CF9A280368BB396AFB4157394C586A499E55F0C05C36CD034B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

48d4d5ea-0e1b-41cd-8050-d891fb8fd1cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48d4d5ea-0e1b-41cd-8050-d891fb8fd1cd.tmp
Size 11KB
SHA256 3656a67bb6da1186dcbb30974dcd9d73bf8f014e66c26e7e6fc28df6a8339450
MD5 3b82f6e880bf78edb344435e09af1ec5
SHA1 8a602a946f2fc536a96f5bdbfdb0c797ea13e3dc
SHA512 0c6baacb2f435b2f3589e2ffe6f471dc746bc1d4648c32ff1a20581d925766a6098a75b2e50006b86a1c611179c9f32808b203cce9a172255d55e985485d7a36
SSDEEP 192:sxR1RSCi/fsOs+DZVJ+e6zoA8p92/g6+WNCCv/Y2gceGyxrIgDrZJ:sxR1zi/fsOs+tV8e3E/57//Qxjz
TLSH
T11842CA15AD24E97B8CCBD30DBB65BF53E6F91032A0D01E48A6FC8A1C14E76DD220751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71fde2a3-2bcf-4208-9328-d7e3147ba836.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71fde2a3-2bcf-4208-9328-d7e3147ba836.tmp
Size 29KB
SHA256 aa64bf7ff219cf6fc15e79b270db657ba8a629b8a5dfd8b4d1689a30bc3047f6
MD5 b7d22ab9ab19465696e72bc5e74e78a5
SHA1 b58938c157b81fe9f7e5a7ee937e431dbf9c6f40
SHA512 563ae901aa14e9765ae91f46efe5ced61bf4d4ebd19c95d76f92dc35b657d23e8e914e968e6f8994d61163a7f6439704e80ea64c4528bc45513235711072b7cb
SSDEEP 768:L7aa8W7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwjFdNMproHx:L7aa82Eb6DWgptfvDu1jaHjFrMCR
TLSH
T1F0D2DB7B740CCB7F4F900ADDAC197E9F6D6802CB9698CD4047FA945C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

950e9738-50b6-442b-b995-15078ddbcc40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\950e9738-50b6-442b-b995-15078ddbcc40.tmp
Size 11KB
SHA256 2fae6982898d6a129017c4d935ee5d8df79c89444d91dcf3c72a78bd2feabcf1
MD5 79f72376730802bcaa93c6f9ed2180e0
SHA1 271207e75f786ecd3af7ae78606d75df9606f6f8
SHA512 68e7bae8e0fd687d3eec90d223ebf014002fec612f33c92dba333d574d307c89f13901c8c39ab13f9f54a18d1046525cd638c7e87ff5f867020d2e6bbffc7127
SSDEEP 192:sxR1RSCi/fsOsnDZVJ+e6zoA8p92/g6+WNCCv/Y2AceGyxrIgDBZJ:sxR1zi/fsOsntV8e3E/57/PQxjd
TLSH
T12A42D915AD24E97B8CCBD30DBB65BF53D6F91032A1D01E48AAFC8A1C14E76DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 0250e6a58379523bcc17ded5b06d7548196b611490b81572b7091d61e7cd07c4
MD5 61e9b4be11270d27de663f3423f23eb5
SHA1 11a840963a1f6c2ddeaf830f30010fa4ae70ae8d
SHA512 7bb00e1e93be5a84963b60a1a7649b9d7bed99541a0959ceb685bf6625ea01143d7ed479e2e60d7c1b58444031771374bd2a403ef9a82c482c8d3083f6de368f
TLSH
T1BE51B5BC42AF0159DB58493353E0618B3B38EAFD0A673EFF1DAAC8B46B16B15DE05004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 38ab625ed96e2d2e3de140925265ad26fa5ade9ecba03b78b90904c7988136cb
MD5 74770137fca9ce1b17e74690f57fe899
SHA1 4709ee6a8f8a5381eb12624e70938c68cdfb0052
SHA512 4cf53557e18d018c904f946b7d6de75adef8453ce7de7b4a18ead18aecbe954910214196e10158b49da408ddb650b9a2e5ed848cc19e4f069af1fea4babf3c91
TLSH
T1FD51A4BC42AF0159DB58493353E0618B3B38EAFD0A673EFF5DAAC8B46B16B15DE04004
MD5 SHA1 SHA512 TLSH

Submit Download

ec2b6823-32b9-4539-bb93-299a47a0cc84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ec2b6823-32b9-4539-bb93-299a47a0cc84.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

abfc86d5-dca5-4a1a-bc4e-72e9a28136b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abfc86d5-dca5-4a1a-bc4e-72e9a28136b2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ad12cb8a-355a-4e78-b0b5-adaa30b7931c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad12cb8a-355a-4e78-b0b5-adaa30b7931c.tmp
Size 2KB
SHA256 f2d657d2440c53c5394b9f0e893d43fe380fc5f4192d52c790e484d1e466d34b
MD5 749e99afdb21608ef95784e3138a0303
SHA1 318e1d7090d22cdf493da6d03782f027fb6cb521
SHA512 8b0d7fa623470e31b83f1fee5ae4a189977e532cf7053636a5bb4169bd5e081ad54b1df9157e2ab2c45dcda5911f63f684ec5c170ac084d49a1cc70a83fcf15d
TLSH
T14751AEF3C3E8866E9A0156F4AB186E2BCE1D0954432C3D5AC8E4DF1B93E2471D28199F
MD5 SHA1 SHA512 TLSH

Submit Download

d4c2121d-6b02-41da-ad30-d22cda62d7ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4c2121d-6b02-41da-ad30-d22cda62d7ee.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ef4a0e59-a045-414d-a9d0-25abaa06ad84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ef4a0e59-a045-414d-a9d0-25abaa06ad84.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb43d895-f2b1-4ba5-99b6-a3edd82e5432.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb43d895-f2b1-4ba5-99b6-a3edd82e5432.tmp
Size 11KB
SHA256 1567777c73c3f1384b0c19d7b9e1427545a18054211c627f2b3092ae2ef01c2a
MD5 85f7798c482ec1e50e1d296c924b6bfd
SHA1 b664ae3b8ce214249479baf6f2fd8684cd5aec91
SHA512 9f6016c52a12ebc903db59d92f9b78a9e9e10e4acd399c7e695f0d42ad9870e878dc1ccc174ffea11bf4981fa86a709da9c704756732044d331541b92d6b71c3
SSDEEP 192:sxR6RSCi/fsOsXDZVJ+e6zoA8p92/g6+WNCCv/Y2AceGyxrIgVZJ:sxR6zi/fsOsXtV8e3E/57/PQxjl
TLSH
T15A32D915AD24E97B8CCBD30DBB65BF53D6F91032A1D41E48AAFC8A1C14E76DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d76f679d-cf12-4b91-961c-4d6f84f674b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d76f679d-cf12-4b91-961c-4d6f84f674b8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aff311aa-6334-4f8d-bab5-bc187bd8e86c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aff311aa-6334-4f8d-bab5-bc187bd8e86c.tmp
Size 35KB
SHA256 090459c95ba0d885ddadbbaf3fe85631a41a8a814caae7c94be43211f5c6567b
MD5 2adaa6b3d6beedd4997b07b31cab5301
SHA1 f4a5403902893cda5f2815e8c8506c6c497ab4da
SHA512 3d2dd2dfcaae8fef354ead74690bc038dfb087ef5a0ecc24a8c42a1e0240b03697710f7df27b77dc4aa521cc52aff8ecc8eb2bae2995dac14206bade38ffd82f
SSDEEP 768:ss3OWgm1OgJbJDmGA5b65Q92RQMPbTRsa71:ss35b7AF65dQARsi1
TLSH
T183F2BF71ECA4DEF7ACBD92803686B3426FB85163D4C9869499E56F0D0483ACE031FD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce11cc1c-b026-46ea-96eb-50145cd4f227.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce11cc1c-b026-46ea-96eb-50145cd4f227.tmp
Size 43KB
SHA256 bf3d9b4118a7d8e23e2248aa1a2cc0a2e4957456fb12134f3cce1ae9ad7917b1
MD5 aaa467c3d9d32a4ae8db1e777e5c78d1
SHA1 9a30798ce25c7feb62f7c0262e6d3a0e80777873
SHA512 dd5e1999ee51e004c02ca14671d82c6fc40982291080eaeb8efc5363a6e4b10e7a651e50139cd0e530246917ebeee9059078971aade05cfe5d626a88214a8dca
SSDEEP 768:pFQq3XwgyZue1OgJwDmGA5b65Q92RQMPbTRsa71:oq3UQAF65dQARsi1
TLSH
T11A1306F298D3CAB6E8AD5383677D6E459EBCC163B4888580B7D45D0CCC825BFC30A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1452f618-7c4b-4cef-872c-d29fa2c424ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1452f618-7c4b-4cef-872c-d29fa2c424ab.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

4a97e94e-8c93-48d0-806e-c391abbbb298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4a97e94e-8c93-48d0-806e-c391abbbb298.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d04f6247-6afc-448f-b92f-6f61413e5acc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d04f6247-6afc-448f-b92f-6f61413e5acc.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

f1b1712f-d44a-4747-8f5b-7fe524a182e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f1b1712f-d44a-4747-8f5b-7fe524a182e5.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e76d7ab7-c860-41e1-bfda-55c5bc6a761c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e76d7ab7-c860-41e1-bfda-55c5bc6a761c.tmp
Size 39KB
SHA256 cb6dbf16f5d72b0123f977b996d08ac1c49f6f0772bfdba85fb99716d6e48124
MD5 a4bb282f812cb721a5a20ca234d86440
SHA1 c60a20ab0a5f2356489946b6da0b3be62f80362d
SHA512 7f8270dd610589c6af0de45991fc28e1247c1eab85236df35b575c77d38010a81415f1fe4327f079318d4d148b9c6e6d519037c70af7c13e75640b614fc9df2b
SSDEEP 768:U/UxvxjgC+B3q8FPvgm1OQtDmGA5b65Q92RQMPbsNFj0O:BZj3+B3qWv3AF65dQVNFQO
TLSH
T11A03CF36EC90AEB3DCF95280374BA35AAFF84563D0C556A049F96F1D06C768C830B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

074ae6df-590c-4993-ada0-292d2d3a0840.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\074ae6df-590c-4993-ada0-292d2d3a0840.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa6fc3ad-9b3d-47ea-b619-39978cfbb38f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa6fc3ad-9b3d-47ea-b619-39978cfbb38f.tmp
Size 35KB
SHA256 f05b1b0d2a16ce2a1ab65b54addddb1359a7d80cfdcb55ed9a6f3f44893bb6df
MD5 8b2b747eb581fa36436c05407c61f83d
SHA1 be3b82621c5d930e7585007f735bda6ffab9ce34
SHA512 3703462f92f431ffb5c729cdf19ded4fafa449deb06da40c13cd85c13a353d125c0da1d36ea3962fbb92f6f69be39f494e95bf127fbf079c003174b4701d40a1
SSDEEP 768:gs3NWgm1OgJbJDmGA5b65Q92RQMPbTRsa71:gs3Mb7AF65dQARsi1
TLSH
T1DBF2BF71ECA5DEF7ACBD92803686B3426FB85163D4C9869499E56F0D0483ACA031FD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59388654-6dea-4349-be35-b5ba7984bd0a.tmp

Path C:\Users\Admin\AppData\Local\Temp\59388654-6dea-4349-be35-b5ba7984bd0a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

730af221-6361-4d75-bbd9-616c1a8e083e.tmp

Path C:\Users\Admin\AppData\Local\Temp\730af221-6361-4d75-bbd9-616c1a8e083e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4388_1578091167\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_164434651\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1678973094\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1871717712\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_506660599\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/1320-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1868-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2260-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2772-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4768-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5232-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5516-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5908-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6100-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6100-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6120-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download