e2c885b118c8bb7122783b5a4ef304d833b25f18a043cf807d02ad775105850b

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe
Size 243KB
Sample261006-wpf72aszdw
SHA256 e2c885b118c8bb7122783b5a4ef304d833b25f18a043cf807d02ad775105850b
MD5 a311753569b6651687f953c95fee800b
SHA1 e0cc3c651a6a017627836d78b800427cb53e6efe
SHA512 1fa4b9907e54204d46b83297133f070304cc6712712e627556325668522a7ae1be280ba53ddf190cf86787a54adb676f7853f45c8980f5064eaf254f7b1d79f1
SSDEEP 3072:zBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:Fb3TfLAUa3lLNngoqRttA7b
TLSH
T19634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2580	CP.exe
2312	zuomgelgbw.exe
2676	CP.exe
3660	CP.exe
5076	i_zuomgelgbw.exe
1640	lgeywqolge.sys
3628	CP.exe
1344	dbvtolgeyw.exe
4412	CP.exe
5080	CP.exe
2960	i_dbvtolgeyw.exe
240	nljdbytqli.sys
4544	CP.exe
1348	lfdyvtnlgd.exe
6140	CP.exe
1736	CP.exe
3268	i_lfdyvtnlgd.exe
5316	faxvqnlica.sys
2316	CP.exe
5484	faxvtqkifa.exe
5076	CP.exe
1404	CP.exe
1564	i_faxvtqkifa.exe
2520	vpnlfdxvpn.sys
4576	CP.exe
4996	hfzxvpnhfa.exe
4128	CP.exe
2512	CP.exe
2372	i_hfzxvpnhfa.exe
1740	pkicausqki.sys
836	CP.exe
5292	pnhfcauspn.exe
1780	CP.exe
4236	CP.exe
2156	i_pnhfcauspn.exe
1536	pnhfcxuspk.sys
4712	CP.exe
2892	pmkeczuspk.exe
3580	CP.exe
1516	CP.exe
464	i_pmkeczuspk.exe
3772	xupmhezxrp.sys
1988	CP.exe
5240	urpjhbzuom.exe
4688	CP.exe
4132	CP.exe
3524	i_urpjhbzuom.exe
5144	kecwurpjhb.sys
4988	CP.exe
2412	wuomgezwro.exe
760	CP.exe
3308	CP.exe
2900	i_wuomgezwro.exe
2032	wtomgeywqo.sys
780	CP.exe
5844	qojgbztrlj.exe
268	CP.exe
4844	CP.exe
3236	i_qojgbztrlj.exe
1276	qljgbytrlj.sys
2680	CP.exe
3804	jdbvtnlgdy.exe
200	CP.exe
2564	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_721523286\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_509767068\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_654651124\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_654651124\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_748826604\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_509767068\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_654651124\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_654651124\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_721523286\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvtqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvtqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lifdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomgelgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomgelgbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfcauspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfcauspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczuspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lifdyvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3932	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
236	ipconfig.exe
4400	ipconfig.exe
1500	ipconfig.exe
3260	ipconfig.exe
2712	ipconfig.exe
4656	ipconfig.exe
3220	ipconfig.exe
4272	ipconfig.exe
1988	ipconfig.exe
2892	ipconfig.exe
2236	ipconfig.exe
6040	ipconfig.exe
624	ipconfig.exe
5868	ipconfig.exe
932	ipconfig.exe
1128	ipconfig.exe
3936	ipconfig.exe
4008	ipconfig.exe
1500	ipconfig.exe
476	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{D200D718-EE4D-4A83-B066-4C90022297D9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
460	msedge.exe
460	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	i_zuomgelgbw.exe
Token: SeDebugPrivilege	2960	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	3268	i_lfdyvtnlgd.exe
Token: SeDebugPrivilege	1564	i_faxvtqkifa.exe
Token: SeDebugPrivilege	2372	i_hfzxvpnhfa.exe
Token: SeDebugPrivilege	2156	i_pnhfcauspn.exe
Token: SeDebugPrivilege	464	i_pmkeczuspk.exe
Token: SeDebugPrivilege	3524	i_urpjhbzuom.exe
Token: SeDebugPrivilege	2900	i_wuomgezwro.exe
Token: SeDebugPrivilege	3236	i_qojgbztrlj.exe
Token: SeDebugPrivilege	5816	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	1728	i_lifdyvqnig.exe
Token: SeDebugPrivilege	4692	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	4552	i_qnkfdxvpni.exe
Token: SeDebugPrivilege	5284	i_smkecxupmh.exe
Token: SeDebugPrivilege	3860	i_pjhbzurmke.exe
Token: SeDebugPrivilege	3260	i_urmjwuomge.exe
Token: SeDebugPrivilege	5224	i_ebwuomgeyt.exe
Token: SeDebugPrivilege	2572	i_ytqligdbvt.exe
Token: SeDebugPrivilege	2612	i_aysqlidbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4516	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	89
PID 4516 wrote to memory of 5676	4516	iexplore.exe	91
PID 5676 wrote to memory of 5836	5676	msedge.exe	92
PID 5676 wrote to memory of 5016	5676	msedge.exe	93
PID 5676 wrote to memory of 3932	5676	msedge.exe	94
PID 5676 wrote to memory of 5016	5676	msedge.exe	93
PID 5676 wrote to memory of 5016	5676	msedge.exe	93
PID 5676 wrote to memory of 4324	5676	msedge.exe	95
PID 5676 wrote to memory of 4324	5676	msedge.exe	95
PID 5676 wrote to memory of 3432	5676	msedge.exe	98
PID 5676 wrote to memory of 1840	5676	msedge.exe	97
PID 5676 wrote to memory of 1840	5676	msedge.exe	97
PID 5676 wrote to memory of 1840	5676	msedge.exe	97
PID 5676 wrote to memory of 3432	5676	msedge.exe	98
PID 5676 wrote to memory of 3432	5676	msedge.exe	98
PID 5676 wrote to memory of 4724	5676	msedge.exe	99
PID 5676 wrote to memory of 4724	5676	msedge.exe	99
PID 5676 wrote to memory of 4724	5676	msedge.exe	99
PID 5676 wrote to memory of 4124	5676	msedge.exe	100
PID 5676 wrote to memory of 4124	5676	msedge.exe	100
PID 5676 wrote to memory of 4124	5676	msedge.exe	100
PID 5676 wrote to memory of 2548	5676	msedge.exe	102
PID 5676 wrote to memory of 2548	5676	msedge.exe	102
PID 3392 wrote to memory of 2580	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	103
PID 2312 wrote to memory of 2676	2312	zuomgelgbw.exe	106
PID 5676 wrote to memory of 5256	5676	msedge.exe	109
PID 5676 wrote to memory of 5256	5676	msedge.exe	109
PID 5676 wrote to memory of 3252	5676	msedge.exe	110
PID 5676 wrote to memory of 3252	5676	msedge.exe	110
PID 5676 wrote to memory of 2856	5676	msedge.exe	112
PID 5676 wrote to memory of 2824	5676	msedge.exe	113
PID 5676 wrote to memory of 2824	5676	msedge.exe	113
PID 5676 wrote to memory of 2276	5676	msedge.exe	116
PID 5676 wrote to memory of 2276	5676	msedge.exe	116
PID 3392 wrote to memory of 3660	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	117
PID 3392 wrote to memory of 3628	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	121
PID 1344 wrote to memory of 4412	1344	dbvtolgeyw.exe	123
PID 3392 wrote to memory of 5080	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	126
PID 3392 wrote to memory of 4544	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	130
PID 1348 wrote to memory of 6140	1348	lfdyvtnlgd.exe	132
PID 3392 wrote to memory of 1736	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	135
PID 3392 wrote to memory of 2316	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	139
PID 5484 wrote to memory of 5076	5484	faxvtqkifa.exe	141
PID 3392 wrote to memory of 1404	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	144
PID 5676 wrote to memory of 6040	5676	msedge.exe	147
PID 5676 wrote to memory of 3772	5676	msedge.exe	148
PID 5676 wrote to memory of 4828	5676	msedge.exe	149
PID 3392 wrote to memory of 4576	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	152
PID 4996 wrote to memory of 4128	4996	hfzxvpnhfa.exe	154
PID 3392 wrote to memory of 2512	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	157
PID 3392 wrote to memory of 836	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	161
PID 5292 wrote to memory of 1780	5292	pnhfcauspn.exe	163
PID 3392 wrote to memory of 4236	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	166
PID 3392 wrote to memory of 4712	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	170
PID 2892 wrote to memory of 3580	2892	pmkeczuspk.exe	172
PID 3392 wrote to memory of 1516	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	175
PID 3392 wrote to memory of 1988	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	179
PID 5240 wrote to memory of 4688	5240	urpjhbzuom.exe	181
PID 3392 wrote to memory of 4132	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	184
PID 5676 wrote to memory of 5744	5676	msedge.exe	186
PID 5676 wrote to memory of 5744	5676	msedge.exe	186
PID 3392 wrote to memory of 4988	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	192
PID 2412 wrote to memory of 760	2412	wuomgezwro.exe	194
PID 3392 wrote to memory of 3308	3392	2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a311753569b6651687f953c95fee800b_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc527cc188,0x7ffc527cc194,0x7ffc527cc1a0
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10121455366765627785,6286378813709848099,262144 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,8627597672673268427,2639729783636934064,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:11
      4⤵
      System Time Discovery
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,16513177001419453796,4677033570150769569,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,13618437168451903278,17509901449218493059,2097152 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,3208022593277080782,1220720484745247604,2097152 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,2751526086008240488,17820869330357242135,2097152 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2406539539525879453,14274488216447067233,2097152 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10581754869694372561,12865027982784438986,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,12689936395340011470,11778647433935166216,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17168496979438161117,15888029271687428034,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:3252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10819979107684087014,7193259755665143103,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10819979107684087014,7193259755665143103,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,3455636287268400242,15386911660730023762,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,12753511655550562803,15946335623549768889,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5372190005549857795,12465779784049992133,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,5873780022757744640,6840188212408479998,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,8217833593699510601,14114512376086065079,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,16734287649234928397,4282529677943289444,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,3533375790670083472,9763777290138943486,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,12938355508353959457,8668874261349889582,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,11532087451352795925,18046915966412873791,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,7340500550594049050,15692125825064318157,262144 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,14635701117413819296,1022104655603414463,524288 --field-trial-handle=2252,i,10523828812962980920,14689824383312539201,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomgelgbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580
- - C:\Temp\zuomgelgbw.exe
    C:\Temp\zuomgelgbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomgelgbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\i_zuomgelgbw.exe
    C:\Temp\i_zuomgelgbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3628
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5080
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4544
- - C:\Temp\lfdyvtnlgd.exe
    C:\Temp\lfdyvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1736
- - C:\Temp\i_lfdyvtnlgd.exe
    C:\Temp\i_lfdyvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxvtqkifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2316
- - C:\Temp\faxvtqkifa.exe
    C:\Temp\faxvtqkifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxvtqkifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Temp\i_faxvtqkifa.exe
    C:\Temp\i_faxvtqkifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\hfzxvpnhfa.exe
    C:\Temp\hfzxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2512
- - C:\Temp\i_hfzxvpnhfa.exe
    C:\Temp\i_hfzxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfcauspn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:836
- - C:\Temp\pnhfcauspn.exe
    C:\Temp\pnhfcauspn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfcauspn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Temp\i_pnhfcauspn.exe
    C:\Temp\i_pnhfcauspn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkeczuspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\pmkeczuspk.exe
    C:\Temp\pmkeczuspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkeczuspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1516
- - C:\Temp\i_pmkeczuspk.exe
    C:\Temp\i_pmkeczuspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbzuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\urpjhbzuom.exe
    C:\Temp\urpjhbzuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbzuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\i_urpjhbzuom.exe
    C:\Temp\i_urpjhbzuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3308
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:780
- - C:\Temp\qojgbztrlj.exe
    C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4844
- - C:\Temp\i_qojgbztrlj.exe
    C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\jdbvtnlgdy.exe
    C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2564
- - C:\Temp\i_jdbvtnlgdy.exe
    C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lifdyvqnig.exe ups_run
  2⤵
  PID:4624
- - C:\Temp\lifdyvqnig.exe
    C:\Temp\lifdyvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lifdyvqnig.exe ups_ins
  2⤵
  PID:3536
- - C:\Temp\i_lifdyvqnig.exe
    C:\Temp\i_lifdyvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run
  2⤵
  PID:3808
- - C:\Temp\lfdxvpnifa.exe
    C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
  2⤵
  PID:1564
- - C:\Temp\i_lfdxvpnifa.exe
    C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnkfdxvpni.exe ups_run
  2⤵
  PID:1960
- - C:\Temp\qnkfdxvpni.exe
    C:\Temp\qnkfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnkfdxvpni.exe ups_ins
  2⤵
  PID:4896
- - C:\Temp\i_qnkfdxvpni.exe
    C:\Temp\i_qnkfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupmh.exe ups_run
  2⤵
  PID:5544
- - C:\Temp\smkecxupmh.exe
    C:\Temp\smkecxupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupmh.exe ups_ins
  2⤵
  PID:5764
- - C:\Temp\i_smkecxupmh.exe
    C:\Temp\i_smkecxupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run
  2⤵
  PID:2116
- - C:\Temp\pjhbzurmke.exe
    C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins
  2⤵
  PID:1752
- - C:\Temp\i_pjhbzurmke.exe
    C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjwuomge.exe ups_run
  2⤵
  PID:5504
- - C:\Temp\urmjwuomge.exe
    C:\Temp\urmjwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjwuomge.exe ups_ins
  2⤵
  PID:4672
- - C:\Temp\i_urmjwuomge.exe
    C:\Temp\i_urmjwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyt.exe ups_run
  2⤵
  PID:5896
- - C:\Temp\ebwuomgeyt.exe
    C:\Temp\ebwuomgeyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyt.exe ups_ins
  2⤵
  PID:5228
- - C:\Temp\i_ebwuomgeyt.exe
    C:\Temp\i_ebwuomgeyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqligdbvt.exe ups_run
  2⤵
  PID:5320
- - C:\Temp\ytqligdbvt.exe
    C:\Temp\ytqligdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqligdbvt.exe ups_ins
  2⤵
  PID:2956
- - C:\Temp\i_ytqligdbvt.exe
    C:\Temp\i_ytqligdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  PID:3976
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  PID:4776
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5216

C:\Temp\lgeywqolge.sys
C:\Temp\lgeywqolge.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\nljdbytqli.sys
C:\Temp\nljdbytqli.sys
1⤵
- Executes dropped EXE
PID:240

C:\Temp\faxvqnlica.sys
C:\Temp\faxvqnlica.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\vpnlfdxvpn.sys
C:\Temp\vpnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\pkicausqki.sys
C:\Temp\pkicausqki.sys
1⤵
- Executes dropped EXE
PID:1740

C:\Temp\pnhfcxuspk.sys
C:\Temp\pnhfcxuspk.sys
1⤵
- Executes dropped EXE
PID:1536

C:\Temp\xupmhezxrp.sys
C:\Temp\xupmhezxrp.sys
1⤵
- Executes dropped EXE
PID:3772

C:\Temp\kecwurpjhb.sys
C:\Temp\kecwurpjhb.sys
1⤵
- Executes dropped EXE
PID:5144

C:\Temp\wtomgeywqo.sys
C:\Temp\wtomgeywqo.sys
1⤵
- Executes dropped EXE
PID:2032

C:\Temp\qljgbytrlj.sys
C:\Temp\qljgbytrlj.sys
1⤵
- Executes dropped EXE
PID:1276

C:\Temp\ligdyvqnlf.sys
C:\Temp\ligdyvqnlf.sys
1⤵
PID:3264

C:\Temp\ysqnigaytn.sys
C:\Temp\ysqnigaytn.sys
1⤵
PID:4012

C:\Temp\vpnifaxspn.sys
C:\Temp\vpnifaxspn.sys
1⤵
PID:6072

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
PID:1120

C:\Temp\caukfzxrpj.sys
C:\Temp\caukfzxrpj.sys
1⤵
PID:2992

C:\Temp\urmjhezwur.sys
C:\Temp\urmjhezwur.sys
1⤵
PID:5304

C:\Temp\ebztomgezw.sys
C:\Temp\ebztomgezw.sys
1⤵
PID:5720

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:4528

C:\Temp\igaytqoigb.sys
C:\Temp\igaytqoigb.sys
1⤵
PID:5304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.exe

Path C:\Temp\dbvtolgeyw.exe
Size 243KB
SHA256 83610d424894e03247c574cd8726de124322037aadac8cb34317b1458897e392
MD5 abbc302f04f0ec1d0415eb3a86d2e946
SHA1 0e75cefdde8fc3618685886f25b19017d9c13525
SHA512 9e14a8174ca42d421a6a096d2a86b1b473c2bb2fca3e8bab1435a3625adf7ce27dc6ee953c9ba178b90c6b61990de8a5afdabd42e3512a67e5fddc36ca6491d0
SSDEEP 3072:ABb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:Qb3TfLAUa3lLNngoqRttA7o
TLSH
T1FD34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvqnlica.sys

Path C:\Temp\faxvqnlica.sys
Size 141KB
SHA256 6b1a291695e6fe7e567e90c2b513c4af801a795ca01f276acde50b29881350e9
MD5 9b3fd7dc06b7d4c8c43ad05b59a87d4e
SHA1 78d16b13f7c2eb81e08c1304551bd96d720481c7
SHA512 4ca2f7f6d47e32464787116f53edf32f0738ecbf423645e4514f5a9e64bd9134da4662cd2149d04480bd885437ff9955b09c31be90d1c994de1abdcf720f1512
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvtqkifa.exe

Path C:\Temp\faxvtqkifa.exe
Size 243KB
SHA256 159a7db21159fd11ad58c112df29245d3f714de330076708d68d81edeedcb6db
MD5 7c1df443058ad0b4260793c463b00f2d
SHA1 b069f7a85ee4ee1a86468039a464d71907d113c6
SHA512 69ae1274b47b3c001045613ab7dc4c13c13bb1508bb3b6384729186c475f60e648503aedd91610957888e08ea54568189020fe30c18eccf4c6c975ad215ec266
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:ab3TfLAUa3lLNngoqRttA7+
TLSH
T16834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxvpnhfa.exe

Path C:\Temp\hfzxvpnhfa.exe
Size 243KB
SHA256 97abb0d7e1db3b1f5507bd29d07d894fc35eb272dabd27c361ae9dad1bde633a
MD5 eea8d5ebe06c18418502a2865bcda5f0
SHA1 c444bc0a6974a8d554ef90a8d0802df9ce48085c
SHA512 59c5d17ed629153be53a1f05189fc816c96a755e64ab8c605426bbba676bc18b936ffa821fb07f1826451952b1e5d10a08b2ce5fbb5237c31d663fcf4decf0fb
SSDEEP 3072:EBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:cb3TfLAUa3lLNngoqRttA70
TLSH
T197344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtolgeyw.exe

Path C:\Temp\i_dbvtolgeyw.exe
Size 243KB
SHA256 7f19a62f2d900940bcb1ad8fdb85b310fa77245e1eec5516bb42fe67cc6d903c
MD5 9726a8a145913ec886254f2ab315b83d
SHA1 9ab7b164cd1599bd5e8bc40f61d3d660be3613d0
SHA512 654bafc8edc7387402789388a1ff81d9385c98bfa7fdc78094099e1925d566dd15da5ed89f265b7878106158549096a178f2e4938265aad7b6d2d85aa1aa8b1b
SSDEEP 3072:SBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:Kb3TfLAUa3lLNngoqRttA7S
TLSH
T1EA34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxvtqkifa.exe

Path C:\Temp\i_faxvtqkifa.exe
Size 243KB
SHA256 4cb635af76c6cf416172b62f6a71a39ceee977226dc264e71f1d1b84345a9a74
MD5 9c471d9c7e8f5e84d048a9a9eb12fa7f
SHA1 cc799e4e6d5224b40b66b860038182171d62a68c
SHA512 24abd2fd263e81eac6a95fa8ac83e4864d095695b5ea9e29f8e674e58d5890903eeec5b7ad8d07549dd9e1fbc0c66b04b6581fc7807a6f0338b8af42f967a17a
SSDEEP 3072:4Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:Ib3TfLAUa3lLNngoqRttA7Y
TLSH
T16B34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxvpnhfa.exe

Path C:\Temp\i_hfzxvpnhfa.exe
Size 243KB
SHA256 ffe76bab07df38229eb0134d651a882757940a26f62360e6f49febc3665a5a0f
MD5 4442599540a117f624f60ee3fd589ef3
SHA1 8064eadc61f9888f8ee0f51461f0b619ef5adf9a
SHA512 fb7c166056cb144882a669f4448efd963306f344702be3bbe309df4424e98b40c6042ec537b9104e7c4a5856ff4babe65c2a0ede9e8585fba431c52e424975f1
SSDEEP 3072:EBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:cb3TfLAUa3lLNngoqRttA7U
TLSH
T162344A0172818071E75A0B74045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvtnlgd.exe

Path C:\Temp\i_lfdyvtnlgd.exe
Size 243KB
SHA256 b1a9ad7cdea6e33add03bbe8924ae2d8046fc76027df5d1327da020a78039310
MD5 0930866df76c2e7d3adc5f10343834f5
SHA1 22cad37b0dae57e7338cc35e0770edf1c1ca449f
SHA512 997f70f624c2defd2f1416ed7cb075b3802dcf3bf2e317e1a34718dc044c6387a1acb9f2b571b846e0cbcdbc3ea3d28da9ce69c13141a28697c8f08c4642dd20
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:ab3TfLAUa3lLNngoqRttA7i
TLSH
T14134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfcauspn.exe

Path C:\Temp\i_pnhfcauspn.exe
Size 243KB
SHA256 5bcb1d4e8892203ab58af19936e51c4e62a24a823f7fda11c090c46b7ccebdfd
MD5 f9ccf26802dcef46bd8472943e264150
SHA1 e27f60df46915b0159fc4ae53a0349c6abcfd3c0
SHA512 07844379dc7129db538a887c4689873d38f3421e9b76d31c3b8bf0c899e1496b98321efa0e512f573addf2df5e31cc983ec863f328f287a84f771d3027654409
SSDEEP 3072:rBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:db3TfLAUa3lLNngoqRttA7L
TLSH
T1CB344A0172818071E75A0B78046AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zuomgelgbw.exe

Path C:\Temp\i_zuomgelgbw.exe
Size 243KB
SHA256 8b253d002fdf4220b04f8cefc7fa5146b44f744c2ee5acef9e2a44e8afbaf744
MD5 f515024eade0977ba470f36f47e943be
SHA1 6fd8f272f0591ab6339cbf3b023f6a54a4f1e11b
SHA512 c41dd9b462c0ec8abce6053a3bff7d83bcf8a4787016b6eee1729d3f5265f6498c99d024254038fc938a4c2f91fab386318ac4b5e1d62d9bcd615a2528b5363c
SSDEEP 3072:EBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:cb3TfLAUa3lLNngoqRttA78
TLSH
T163344A0172818071E75A0B78045AEB61867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvtnlgd.exe

Path C:\Temp\lfdyvtnlgd.exe
Size 243KB
SHA256 1416bfc5a9a490bf61a5323b56c6b263b5d634db98c1ff956c991e8d97b00b47
MD5 f435a0d8c7ec758cb56fe0fa263c02d1
SHA1 ba3ab0f4673cd75d5eaf27d6419fc23b8a1b576d
SHA512 55c864ba08af7578ca071b2dc145286adb75403bcaab40a1e350641f5623d618824e7e2e7baba535094bc55fee595195ef3d7faab28f5cde7b9b482ae4c0af6e
SSDEEP 3072:BBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:jb3TfLAUa3lLNngoqRttA7t
TLSH
T1CE344A0172818071E75A0B74045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqolge.sys

Path C:\Temp\lgeywqolge.sys
Size 141KB
SHA256 1e935500c6f0b8b0aa159f519e119f35f47ef94e15fe57477bd573743b874811
MD5 0317bb02f4853c2201cd969566eb286e
SHA1 39b5bd98a6eac1b969703a4a4271f4e38d1415a2
SHA512 9ac822289bacf700816443a659d7c8e8a1a77d77376a342a3c428054f65df0168ecf445c0aed1b84a8dd3593702bf6c4e65d882a551efd6a851db5013ff970dc
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbytqli.sys

Path C:\Temp\nljdbytqli.sys
Size 141KB
SHA256 e17683f025167da150f65989c48c96e4d529633b93ac92ddd229b0021deca8ac
MD5 c69f71593b1aeb2a1eaeb86854ebe063
SHA1 e7fcd4f2d6d94a9d0b8244cc28852aa3fbcc8512
SHA512 08ae51317e2b93a166e2617642050ce066c727d911e0cfdef7eb51c4fbc9eba75045750ff7db8fbf250ff4afa1a303937d7f1d80a0cea71a71bc9eccee53c958
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlt4:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausqki.sys

Path C:\Temp\pkicausqki.sys
Size 141KB
SHA256 a6eb895ed00ee9d3b4c270b0c54233ca91a30107c76678bc13a806f15b27ab7c
MD5 cfdb9de97c4b64cb57a705ed828f2abb
SHA1 78ee376b3f9fc5e8d69289154395221b752cdb84
SHA512 a31dd4fffe357147fbb828ba110b0092734b90ae4f9c1c9718b1e142be0cf4ba94a8cea6caf6af0882505738f838e655747d4e7d764197cef198238be14b7dae
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T146E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfcauspn.exe

Path C:\Temp\pnhfcauspn.exe
Size 243KB
SHA256 6b0526799a0c5853f05cc144eb59e730106fd800d9e522d9172b3817116ba8d1
MD5 820812a694b737c155328d927794e3ab
SHA1 68356a3471aa10c6b55299768f88cc4f68932c58
SHA512 fa3bd7013ff2a91979b63e1edbae6c9fe2a37f17b55789199c1be026e7dc5120f143d41d40a36dfb73f62cb4bd17c9d3c3cc24dca061debee92a9fbc8c79d94d
SSDEEP 3072:aBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:yb3TfLAUa3lLNngoqRttA7K
TLSH
T11E34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfcxuspk.sys

Path C:\Temp\pnhfcxuspk.sys
Size 141KB
SHA256 4cadb8a9e63b3ac740d43b6bc74813ecffefb815a7d74e00bfcb71cd83665bd1
MD5 7a544f2be49e8a775a5b2e59c55790fd
SHA1 54e161f9cef92739f35f2096d062090d36b0fb17
SHA512 f5b87112726964e3f82b708a068d274908bca7434282a2a30a417ae29f626a352b89463b4286f8183f0506eeb5d6c3762749d524b3af86102580d3169c018793
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T180E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnlfdxvpn.sys

Path C:\Temp\vpnlfdxvpn.sys
Size 141KB
SHA256 1f81846ad751cc748fdd50ad6519037a583b4a2bb1be39c41ab31ead63f3d3c4
MD5 cd4cb8971a0a8858f7683c03c770ccd3
SHA1 a294efe0eb6accc69b7789c98f0ab3a855900c1d
SHA512 563e11e4737ce4aeea7464e80d0d280b128fe03e21db1fe51daa7ca7d7d5c31aeb76b6da7fdd2441c8cfde8fe5a86ca88092bcb59af985b8996e2e6bf222de62
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T123E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuomgelgbw.exe

Path C:\Temp\zuomgelgbw.exe
Size 243KB
SHA256 ab7ee3b0e52a1a092e044191b94369c70315c12e4faf42f449d3ef1df653fdb8
MD5 6b9b18d17146a25ec15c5fc912c93518
SHA1 936889303e026226808c562853e783adaa5fb2c1
SHA512 d533861665f7f9cda47817378023831f37bd69e934da98190837057aff5b67a51230839a11260768c306671b19e2145a6867ae6933ad4281d9e8cc46fc728065
SSDEEP 3072:cBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:0b3TfLAUa3lLNngoqRttA7Y
TLSH
T1D7344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0426ada3-e4d1-4fc7-a14a-3c349f128405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0426ada3-e4d1-4fc7-a14a-3c349f128405.tmp
Size 33KB
SHA256 8d257fec5f926e5a35672c1eb8f8ea1ac9352259d9940869b0ededb60074888f
MD5 983109f3608eb8d5b21d431b80427211
SHA1 c090c087814caa672d56532ca19496560cedaee1
SHA512 265d8d6c706e4131ae9865ed1b8327a511c12bba75d9e5511f7c9bbacfe7aea91869a0d14c24a5ad9d677d69b8b5c9c7115783b9848f11e14b06a08b1b3f8acf
SSDEEP 768:GZ3crhq0vrc7fZrKrHzp5XSwQs88uBkiT2B4YGH4W:GZ3+q0QtrGdILNBM4YU4W
TLSH
T1D7F2B074EC949CB36CBBA3867A573B466FF01153C8C90A48C5DAA31E018775E2B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8936e263-db13-4e31-8892-ad8e5274c9d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8936e263-db13-4e31-8892-ad8e5274c9d1.tmp
Size 33KB
SHA256 4ab9b18ad231e2b218b6d1287b040feb83a2031cc400d448e4bd4020a8ba35f3
MD5 78084e859f7d3573c78af46a7bd5b449
SHA1 e2f9062a153a5f12132618d45ab42f3b6574dd71
SHA512 8ed78cd6b7f1bf41767765ce619b847283f089dea345572bd10dc11c50351c321c9a683b24611166046d3d926a7298c50bae92497ffd2b6e4ccdc179e7533ac5
SSDEEP 768:vZ3Rrhq/vrc7fZrKrHTp5XSwQs88uBkiT2B4YGH4W:vZ3fq/QtrG9ILNBM4YU4W
TLSH
T119F2B074EC949CB36CBAA3867A5737466FF05053C8C90A48C5DAE31D018775E2B4B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

484c954b-3f76-4a3f-ad0f-fac60f548212.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\484c954b-3f76-4a3f-ad0f-fac60f548212.tmp
Size 29KB
SHA256 92a0fbe10e5f76c83bfa70eabb3c3b4adcf2d9679084975a12311773793bfba0
MD5 c4c775a155de8467382f19b9f2b1b472
SHA1 8630498d18a4ed4b12c2c5b297fcdc00550c0f10
SHA512 3a1a8ddc0566b9be79b1833638dc1276279a0b39a5a58ca8e22654f9e5bf015e550d7027fff273c0d5df907d03dfc10dd0131cf981406fecbd121956ad4c327c
SSDEEP 768:U/pCax7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDjuyhpFroJx:U/pCanEbLmWg8KfrLu1jaQju8p+D
TLSH
T1A1D2D97B740CCA7F4F804ADDAC197ADB6DA902CB9A98CD4047FE941C02C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69b78e88-2d70-49f3-80da-ee1ca11bb9ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69b78e88-2d70-49f3-80da-ee1ca11bb9ea.tmp
Size 11KB
SHA256 d707d939af442d8d9f070cd6d4cdfd623193e508eadea8090fbe81927b1a7483
MD5 f74e674bc4b18f7bd718a9e837431a2b
SHA1 7a8ace4da0f5b64693e9179e4e47eb2f9d3e5173
SHA512 0f4c38307e62e1ab0ce8c24855f730aa888d7d9fb56eaad019f3430104059c95f2d2b79b413a9df38ae0fcbe20d1701386e9875eda5a69e296f3e29e652b1263
SSDEEP 192:sxRCRQC4/f/sVuCZusMzoA8p9L/g6+WNChu/YER2GBIgDO7J:sxRC14/f/s0Eu45/5l/tS
TLSH
T19B42B855AE24A97B8CCBD21EFB65BF53D6F91032A1D51E48A6FCC61C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 48faa94584a7a8d99241f38b603bb70cebf85cee97031503e1d3449fce266fd2
MD5 4c295536319dcaf5690505dc00627cd9
SHA1 d0155a68eb575c6d582fcf701cfea9af61cef03a
SHA512 181dab6545a0f36fee52c91ea09e8544aa55daaca3eedd1385f8dd9b2ef89bdb5f226680d4d95300a2e009558f6156901f57ab689c54b4061b5607a84cdf1ae0
TLSH
T1AF51B4A044D168B3EBB46731C1CE36F77E749EB556832E4312AADFBE6F467A48002174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 14482ed5580ab836019afc3484699c3f3b1ac1ec6d811903e5c44583beea75af
MD5 beb03317f6b67c1f94efb74b188b73cd
SHA1 7e5cddeee988d695329a517b561beb8188f97ecb
SHA512 cca432d9d202069d5602aaf8273693044829686a5647199fa13d6886297b17856b5facf5ab48a55f53c6275568bd8ec373864054c55468eafb7831cb030f2924
TLSH
T1CC51B4A048D128B3EBB46731C1CE36E77E749EB556832E4312AACFBE6F467A48001174
MD5 SHA1 SHA512 TLSH

Submit Download

301c93c4-47e8-4c35-8ba6-3eaba25dfb12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\301c93c4-47e8-4c35-8ba6-3eaba25dfb12.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6caabfb9-d1b2-4298-9b3a-e187d7fcbf4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6caabfb9-d1b2-4298-9b3a-e187d7fcbf4a.tmp
Size 2KB
SHA256 b0b2f75afe39e6a2247bec195736f25aed0e82b683d3791aabf030415a8af83c
MD5 7424a016bbc692acc3457a83e3dbcb45
SHA1 a3626a15ac91308018ea50a74367672e262b77e9
SHA512 f83919a419017a74dedae090cc3748adf52424639ff9948b27d57d7d42f884049497ed3c5724fbd87e6f03a5a769ba77a078a25fcbe6b87411d25593d70d7c6c
TLSH
T18A51C0F3C3E8866EC90156F0AA187E2BDE2D0954432C3D5AC8E4AF5B93E24B1D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

6da19673-c83c-469c-b26c-a4ef26a8a446.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6da19673-c83c-469c-b26c-a4ef26a8a446.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ba0fc72c-e8a2-41db-8681-76b887facd2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba0fc72c-e8a2-41db-8681-76b887facd2f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c05c85bf-fd1e-42a1-ae4d-32e76addb09a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c05c85bf-fd1e-42a1-ae4d-32e76addb09a.tmp
Size 11KB
SHA256 a702f062373f15c437d9f6030ae9c81f89f37ac578061e3aa48b85fe32879a3c
MD5 2e0f458855965aa197d7fbcf9a1e5935
SHA1 45ebd84acf4f6741507ceaaf0d7e652bbdd0c1a1
SHA512 5cbb3decf4f2d4b9cdc2248e605ca6ed9e91a261ff9240c47f3e9af502809d99cbddcb8e35939a0da9a60c6cd9b279b36dc998085b326de5bc75d76fdc24324a
SSDEEP 192:sxRtRQC4/f/sDuCZusMzoA8p9L/g6+WNChu/YER2GBIgV7J:sxRt14/f/syEu45/5l/tP
TLSH
T16332C855AE24A97B8CCBD21DFB65BF53D6F91032A0D51E48A6FCC61C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0a6ab00-ad00-47e1-bf76-4eb9070d3bd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c0a6ab00-ad00-47e1-bf76-4eb9070d3bd9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f3e2675b-8134-4ef8-aaba-b8f6ff18c838.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f3e2675b-8134-4ef8-aaba-b8f6ff18c838.tmp
Size 11KB
SHA256 3d8fa96aef62ed8d664e6a54da16022ab1bafbc06ba2b6adba33c3b938e6e8d2
MD5 dadf54b9111ad864c55d374d56975c61
SHA1 e9bfb54edd6b02b688d76d7553bcdcb1fe990003
SHA512 04afde7deddf180228bf0d3da300f4fb8974641179473e3de766d8c8ded28d9f75c9c29e6446de34779ed855bc3c0683b5c7c9cff5b63513289757130542b347
SSDEEP 192:sxRCRQC4/f/sVpCZusMzoA8p9L/g6+WNChu/YEnD2GBIgD07J:sxRC14/f/sHEu45/5l/bTs
TLSH
T18642B755AD24A97B9CCBD21DBB667F53E6F91032A1D11E48A6FCC61C04E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91dff756-dfa3-4ab8-aef9-c9cad1ca5e4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\91dff756-dfa3-4ab8-aef9-c9cad1ca5e4c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8294aefed466c52166b66268941da990fbe910ffeb379b71a94189663a99a3ce
MD5 1df3780986800966a99f939333aa1a39
SHA1 28afd594545b7686af52008c2d27f14cd30e76dd
SHA512 9d8ad56d50924c4e32b3d3da241fdd936a00063150186e47f9a1c53446db74f214f2629983adbc9486f345af36f20daacba3215e1dd1fd56dac97b187946bb31
SSDEEP 768:dFQN33wgJrhqGv/gerKrHuCp5XSwQs88uBkiT2B4YGH4W:sN3tqGPrGOcILNBM4YU4W
TLSH
T1901349F598D38976E8AE53836B3E2E065EBCD053B4884984B7C9590CCC832BFD707856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a53437e8-baa2-4106-a1ad-53927cfe6d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a53437e8-baa2-4106-a1ad-53927cfe6d0b.tmp
Size 37KB
SHA256 e519004383744a00ebbc038332d1c42c90784c67cdb0274224eaeb4df1d57dc8
MD5 f0af33c869fac08156a1e036aaa5dba8
SHA1 dc6e34a57ca53cfb6c627600c1fd01e5c661c987
SHA512 4a763505414fd89b0e12d356784fba2565d0ded2252efb06c9b537f1b4f70e0ab4087a74606c9a41543033eb706f3bae3c1ae5a2509d2cffeff4415448d4722e
SSDEEP 768:R/UxvxjgC+W31Xhc7fZrKHp5XSwQs88uBkiTC7/P84g:kZj3+W31atrYILNBuHg
TLSH
T10703D039EC946863ACB7A3853B5B275BAFF05053C0C40BA849EE7A1E029735D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

523f3fc3-2ba5-47b5-b088-de6efe246707.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\523f3fc3-2ba5-47b5-b088-de6efe246707.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c57c32a5-c602-4e49-9485-ee2fb5e466f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c57c32a5-c602-4e49-9485-ee2fb5e466f5.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

c9d60632-f2b3-4c7c-88e8-e794e56cacf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c9d60632-f2b3-4c7c-88e8-e794e56cacf1.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d2bd8bdc-0c60-4ea1-a9c6-087ad64ca020.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d2bd8bdc-0c60-4ea1-a9c6-087ad64ca020.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

19b6b2f4-448d-4bda-976d-53a1eb4652c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\19b6b2f4-448d-4bda-976d-53a1eb4652c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

96d200e7-c94c-4883-81a5-37dc01697e8f.tmp

Path C:\Users\Admin\AppData\Local\Temp\96d200e7-c94c-4883-81a5-37dc01697e8f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e0d803bc-272a-4b1d-9819-2abbbdda240e.tmp

Path C:\Users\Admin\AppData\Local\Temp\e0d803bc-272a-4b1d-9819-2abbbdda240e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5676_1043810653\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_509767068\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_654651124\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_721523286\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5676_748826604\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/240-239-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1120-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1536-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1640-190-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1740-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2520-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3264-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3772-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4012-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4528-482-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5144-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5304-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5304-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5316-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5720-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download