8e0dfdc9d1d28fddb7ffba4b97362a239559ba56f7baa5180de71f033b30152f

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261002-eqks6stdpe
SHA256 8e0dfdc9d1d28fddb7ffba4b97362a239559ba56f7baa5180de71f033b30152f
MD5 be68f9f1b5c469dcf0988ba816225d1e
SHA1 34e45fb9634746580ca2ea1d6e5d98673ae24f41
SHA512 1d5ccd83a2b489e79e9993cdc148285e6e7e2c8dd562835145a8ce1f2f7bd9cbedd1b2b54008837a79cd05fb61a6cd521d7f11fa57a0f1ee6d7b5df1827ee191
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5272	CP.exe
2596	kfdxvpnhcx.exe
5012	CP.exe
2176	CP.exe
3536	i_kfdxvpnhcx.exe
1152	pkhcausmke.sys
1668	CP.exe
2612	hfzxrpjhec.exe
4888	CP.exe
4484	CP.exe
4492	i_hfzxrpjhec.exe
5188	zwrpjhbztr.sys
4796	CP.exe
1896	rpjhbzupmh.exe
4748	CP.exe
1088	CP.exe
5560	i_rpjhbzupmh.exe
4116	jhbztrljhe.sys
2280	CP.exe
5864	jebztromjd.exe
4912	CP.exe
3364	CP.exe
5532	i_jebztromjd.exe
4568	ywqomgeywq.sys
5028	CP.exe
600	rojytrljdb.exe
1332	CP.exe
556	CP.exe
1348	i_rojytrljdb.exe
2168	gdywqoljdb.sys
4944	CP.exe
3792	gaytqlidbv.exe
2096	CP.exe
5560	CP.exe
1660	i_gaytqlidbv.exe
2540	gdbvsqlida.sys
5832	CP.exe
1000	igaxvqniga.exe
1640	CP.exe
1112	CP.exe
5696	i_igaxvqniga.exe
3980	pnifdxvqfa.sys
5924	CP.exe
4148	kicaysqkid.exe
1276	CP.exe
3500	CP.exe
4640	i_kicaysqkid.exe
3852	xvpnkicaxs.sys
4196	CP.exe
5644	xvpnhfaxsq.exe
5780	CP.exe
4560	CP.exe
720	i_xvpnhfaxsq.exe
1424	pnhfzxrpkh.sys
5748	CP.exe
4848	khcausmkec.exe
264	CP.exe
6084	CP.exe
5180	i_khcausmkec.exe
5452	eczurpjhbz.sys
3000	CP.exe
4304	ezwurmkezx.exe
1252	CP.exe
2000	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1048981939\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_324388751\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_324388751\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_324388751\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_324388751\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1172660590\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1059482940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1059482940\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1048981939\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnifaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifdavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifdavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxupnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxupnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgecwurp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2956	ipconfig.exe
864	ipconfig.exe
3536	ipconfig.exe
5504	ipconfig.exe
3388	ipconfig.exe
2112	ipconfig.exe
4424	ipconfig.exe
5780	ipconfig.exe
2248	ipconfig.exe
4344	ipconfig.exe
1784	ipconfig.exe
1508	ipconfig.exe
4356	ipconfig.exe
3388	ipconfig.exe
468	ipconfig.exe
3296	ipconfig.exe
5768	ipconfig.exe
3972	ipconfig.exe
6140	ipconfig.exe
4608	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{DD144EE4-9C68-4FC8-9582-AA27E183B940}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3536	i_kfdxvpnhcx.exe
Token: SeDebugPrivilege	4492	i_hfzxrpjhec.exe
Token: SeDebugPrivilege	5560	i_rpjhbzupmh.exe
Token: SeDebugPrivilege	5532	i_jebztromjd.exe
Token: SeDebugPrivilege	1348	i_rojytrljdb.exe
Token: SeDebugPrivilege	1660	i_gaytqlidbv.exe
Token: SeDebugPrivilege	5696	i_igaxvqniga.exe
Token: SeDebugPrivilege	4640	i_kicaysqkid.exe
Token: SeDebugPrivilege	720	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	5180	i_khcausmkec.exe
Token: SeDebugPrivilege	2248	i_ezwurmkezx.exe
Token: SeDebugPrivilege	2852	i_eywuomgecw.exe
Token: SeDebugPrivilege	2536	i_geywqomgeb.exe
Token: SeDebugPrivilege	5064	i_eywtrljdby.exe
Token: SeDebugPrivilege	3288	i_igaywqoiga.exe
Token: SeDebugPrivilege	2360	i_xvqnifdavp.exe
Token: SeDebugPrivilege	1508	i_ysqnifaxvp.exe
Token: SeDebugPrivilege	2976	i_ifaxupnhfa.exe
Token: SeDebugPrivilege	6112	i_xrpkhcausm.exe
Token: SeDebugPrivilege	2848	i_rpmgecwurp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 5276	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5276 wrote to memory of 5752	5276	iexplore.exe	89
PID 5752 wrote to memory of 3348	5752	msedge.exe	90
PID 5752 wrote to memory of 1120	5752	msedge.exe	91
PID 5752 wrote to memory of 2896	5752	msedge.exe	92
PID 5752 wrote to memory of 480	5752	msedge.exe	93
PID 5752 wrote to memory of 2896	5752	msedge.exe	92
PID 5752 wrote to memory of 2896	5752	msedge.exe	92
PID 5752 wrote to memory of 480	5752	msedge.exe	93
PID 5752 wrote to memory of 2096	5752	msedge.exe	94
PID 5752 wrote to memory of 5292	5752	msedge.exe	95
PID 5752 wrote to memory of 2096	5752	msedge.exe	94
PID 5752 wrote to memory of 2096	5752	msedge.exe	94
PID 5752 wrote to memory of 5292	5752	msedge.exe	95
PID 5752 wrote to memory of 5292	5752	msedge.exe	95
PID 5752 wrote to memory of 1348	5752	msedge.exe	97
PID 5752 wrote to memory of 1348	5752	msedge.exe	97
PID 5752 wrote to memory of 1348	5752	msedge.exe	97
PID 5752 wrote to memory of 5000	5752	msedge.exe	98
PID 5752 wrote to memory of 5000	5752	msedge.exe	98
PID 5752 wrote to memory of 5000	5752	msedge.exe	98
PID 5752 wrote to memory of 3016	5752	msedge.exe	99
PID 5752 wrote to memory of 3016	5752	msedge.exe	99
PID 5784 wrote to memory of 5272	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 5752 wrote to memory of 1812	5752	msedge.exe	103
PID 5752 wrote to memory of 2748	5752	msedge.exe	104
PID 5752 wrote to memory of 1812	5752	msedge.exe	103
PID 5752 wrote to memory of 2748	5752	msedge.exe	104
PID 2596 wrote to memory of 5012	2596	kfdxvpnhcx.exe	106
PID 5752 wrote to memory of 1332	5752	msedge.exe	110
PID 5752 wrote to memory of 3288	5752	msedge.exe	111
PID 5752 wrote to memory of 3288	5752	msedge.exe	111
PID 5752 wrote to memory of 1484	5752	msedge.exe	114
PID 5752 wrote to memory of 1484	5752	msedge.exe	114
PID 5784 wrote to memory of 2176	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5784 wrote to memory of 1668	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2612 wrote to memory of 4888	2612	hfzxrpjhec.exe	122
PID 5784 wrote to memory of 4484	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 5784 wrote to memory of 4796	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1896 wrote to memory of 4748	1896	rpjhbzupmh.exe	131
PID 5784 wrote to memory of 1088	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5784 wrote to memory of 2280	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 5864 wrote to memory of 4912	5864	jebztromjd.exe	140
PID 5784 wrote to memory of 3364	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5752 wrote to memory of 1380	5752	msedge.exe	146
PID 5752 wrote to memory of 1512	5752	msedge.exe	147
PID 5752 wrote to memory of 1144	5752	msedge.exe	148
PID 5784 wrote to memory of 5028	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 600 wrote to memory of 1332	600	rojytrljdb.exe	153
PID 5784 wrote to memory of 556	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 5784 wrote to memory of 4944	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 3792 wrote to memory of 2096	3792	gaytqlidbv.exe	162
PID 5784 wrote to memory of 5560	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 5784 wrote to memory of 5832	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 1000 wrote to memory of 1640	1000	igaxvqniga.exe	171
PID 5784 wrote to memory of 1112	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 5784 wrote to memory of 5924	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4148 wrote to memory of 1276	4148	kicaysqkid.exe	180
PID 5784 wrote to memory of 3500	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 5752 wrote to memory of 2376	5752	msedge.exe	185
PID 5752 wrote to memory of 2376	5752	msedge.exe	185
PID 5784 wrote to memory of 4196	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 5644 wrote to memory of 5780	5644	xvpnhfaxsq.exe	193
PID 5784 wrote to memory of 4560	5784	2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_be68f9f1b5c469dcf0988ba816225d1e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ff9dc29c188,0x7ff9dc29c194,0x7ff9dc29c1a0
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,9541915301847970302,2076108816380378804,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,6830549670240860310,1685754152155699011,262144 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,167790680068680332,4666104564152501917,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:13
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3211235653599508431,4684363114635736400,2097152 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,3660792826434420705,2939579085027695088,2097152 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,13589510279658774776,5608086092443397941,2097152 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:9
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,6849026550299355655,4348894634585854329,2097152 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,3789112792780983119,11329433850389779794,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7908812101316364129,18321110313575174605,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12859812470316122680,4998748734395501657,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15416420485167575292,14651993556239166436,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,15416420485167575292,14651993556239166436,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14460456997227685139,6831600889288211231,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,10407635577834926972,15912098917653005031,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,17313462122483495647,10318422913497749782,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,10066000015764225872,4998861617251864101,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,15619125220581196411,609873388853005476,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,14395135260405357993,10853187039896407486,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,1691361619692435511,9631857959744554452,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,9974707610577020026,15097204219966256869,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,542935412471186283,15109798255815708228,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5996,i,14876445813366542653,10889201079202807798,262144 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,4342170072032547088,4182992072939210346,524288 --field-trial-handle=2408,i,15439977512969005398,905965904621958083,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhcx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5272
- - C:\Temp\kfdxvpnhcx.exe
    C:\Temp\kfdxvpnhcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2176
- - C:\Temp\i_kfdxvpnhcx.exe
    C:\Temp\i_kfdxvpnhcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Temp\hfzxrpjhec.exe
    C:\Temp\hfzxrpjhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_hfzxrpjhec.exe
    C:\Temp\i_hfzxrpjhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\rpjhbzupmh.exe
    C:\Temp\rpjhbzupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1088
- - C:\Temp\i_rpjhbzupmh.exe
    C:\Temp\i_rpjhbzupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebztromjd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2280
- - C:\Temp\jebztromjd.exe
    C:\Temp\jebztromjd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebztromjd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Temp\i_jebztromjd.exe
    C:\Temp\i_jebztromjd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\rojytrljdb.exe
    C:\Temp\rojytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:556
- - C:\Temp\i_rojytrljdb.exe
    C:\Temp\i_rojytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqlidbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\gaytqlidbv.exe
    C:\Temp\gaytqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqlidbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5560
- - C:\Temp\i_gaytqlidbv.exe
    C:\Temp\i_gaytqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaxvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5832
- - C:\Temp\igaxvqniga.exe
    C:\Temp\igaxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaxvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1112
- - C:\Temp\i_igaxvqniga.exe
    C:\Temp\i_igaxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\kicaysqkid.exe
    C:\Temp\kicaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\i_kicaysqkid.exe
    C:\Temp\i_kicaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\khcausmkec.exe
    C:\Temp\khcausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\i_khcausmkec.exe
    C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwurmkezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3000
- - C:\Temp\ezwurmkezx.exe
    C:\Temp\ezwurmkezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwurmkezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_ezwurmkezx.exe
    C:\Temp\i_ezwurmkezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywuomgecw.exe ups_run
  2⤵
  PID:4108
- - C:\Temp\eywuomgecw.exe
    C:\Temp\eywuomgecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywuomgecw.exe ups_ins
  2⤵
  PID:5996
- - C:\Temp\i_eywuomgecw.exe
    C:\Temp\i_eywuomgecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqomgeb.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\geywqomgeb.exe
    C:\Temp\geywqomgeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqomgeb.exe ups_ins
  2⤵
  PID:4308
- - C:\Temp\i_geywqomgeb.exe
    C:\Temp\i_geywqomgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtrljdby.exe ups_run
  2⤵
  PID:5304
- - C:\Temp\eywtrljdby.exe
    C:\Temp\eywtrljdby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtrljdby.exe ups_ins
  2⤵
  PID:3896
- - C:\Temp\i_eywtrljdby.exe
    C:\Temp\i_eywtrljdby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqoiga.exe ups_run
  2⤵
  PID:4172
- - C:\Temp\igaywqoiga.exe
    C:\Temp\igaywqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqoiga.exe ups_ins
  2⤵
  PID:2296
- - C:\Temp\i_igaywqoiga.exe
    C:\Temp\i_igaywqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnifdavp.exe ups_run
  2⤵
  PID:1840
- - C:\Temp\xvqnifdavp.exe
    C:\Temp\xvqnifdavp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnifdavp.exe ups_ins
  2⤵
  PID:3972
- - C:\Temp\i_xvqnifdavp.exe
    C:\Temp\i_xvqnifdavp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqnifaxvp.exe ups_run
  2⤵
  PID:5180
- - C:\Temp\ysqnifaxvp.exe
    C:\Temp\ysqnifaxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqnifaxvp.exe ups_ins
  2⤵
  PID:4692
- - C:\Temp\i_ysqnifaxvp.exe
    C:\Temp\i_ysqnifaxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxupnhfa.exe ups_run
  2⤵
  PID:4008
- - C:\Temp\ifaxupnhfa.exe
    C:\Temp\ifaxupnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxupnhfa.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_ifaxupnhfa.exe
    C:\Temp\i_ifaxupnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run
  2⤵
  PID:5364
- - C:\Temp\xrpkhcausm.exe
    C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins
  2⤵
  PID:2360
- - C:\Temp\i_xrpkhcausm.exe
    C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmgecwurp.exe ups_run
  2⤵
  PID:4992
- - C:\Temp\rpmgecwurp.exe
    C:\Temp\rpmgecwurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmgecwurp.exe ups_ins
  2⤵
  PID:6104
- - C:\Temp\i_rpmgecwurp.exe
    C:\Temp\i_rpmgecwurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3836

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:1152

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5188

C:\Temp\jhbztrljhe.sys
C:\Temp\jhbztrljhe.sys
1⤵
- Executes dropped EXE
PID:4116

C:\Temp\ywqomgeywq.sys
C:\Temp\ywqomgeywq.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\gdywqoljdb.sys
C:\Temp\gdywqoljdb.sys
1⤵
- Executes dropped EXE
PID:2168

C:\Temp\gdbvsqlida.sys
C:\Temp\gdbvsqlida.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\pnifdxvqfa.sys
C:\Temp\pnifdxvqfa.sys
1⤵
- Executes dropped EXE
PID:3980

C:\Temp\xvpnkicaxs.sys
C:\Temp\xvpnkicaxs.sys
1⤵
- Executes dropped EXE
PID:3852

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:1424

C:\Temp\eczurpjhbz.sys
C:\Temp\eczurpjhbz.sys
1⤵
- Executes dropped EXE
PID:5452

C:\Temp\mgeczurpjh.sys
C:\Temp\mgeczurpjh.sys
1⤵
PID:5500

C:\Temp\jhezwrojhb.sys
C:\Temp\jhezwrojhb.sys
1⤵
PID:4700

C:\Temp\yvtrljdbzt.sys
C:\Temp\yvtrljdbzt.sys
1⤵
PID:5696

C:\Temp\idaytqliga.sys
C:\Temp\idaytqliga.sys
1⤵
PID:5964

C:\Temp\ligayvqnif.sys
C:\Temp\ligayvqnif.sys
1⤵
PID:4700

C:\Temp\vpnlfdaysq.sys
C:\Temp\vpnlfdaysq.sys
1⤵
PID:4676

C:\Temp\kicaxsqkic.sys
C:\Temp\kicaxsqkic.sys
1⤵
PID:2404

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:4288

C:\Temp\czxrpmhezx.sys
C:\Temp\czxrpmhezx.sys
1⤵
PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidbv.exe

Path C:\Temp\gaytqlidbv.exe
Size 226KB
SHA256 b33d119d072811d06d9c14afadf6905428a437a11235ae7b85bc28a23032efd7
MD5 f9642f3f783b199d7ea6c6c06aab1fb6
SHA1 8edab44365586413139f11d09b15c3bc1c1541d6
SHA512 58e663cfa904a77cc912d432a50b484fb702a87c2934a6fcedee1af12eea8f9b161c06111dcf6c9a4c8a862ff2c57033f95715e592c89169a9ea2fb83986c95f
SSDEEP 3072:+7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:rXY4LK+a3lLNngoqRttA7
TLSH
T1C434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoljdb.sys

Path C:\Temp\gdywqoljdb.sys
Size 141KB
SHA256 d62486f7148bda80ea9ab2f1e1afa576bf1cbf3ac598ddec9fb7bf2c8d399f29
MD5 05fd366712d23ba648c25753d701ffd5
SHA1 3a0f5b22d79b123b003e8cd63b0e6170ab613aff
SHA512 ceba178488aca3a1971fd2fafba97e23b93d8518df939cf649e21568247bb5de14870e025854e0db642ecd0f267ef253aa4ab7ca02e19a927a7ddf218c919ccc
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T180E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhec.exe

Path C:\Temp\hfzxrpjhec.exe
Size 226KB
SHA256 3a5122bfb26d8b0f85f62f28b2af2f7134092f92174f21ea74a15a94a592cce5
MD5 98bd31b125ad8bcc0ea2cc3c48ed38f1
SHA1 700da025a707e93afebd44acee19711cb6994f02
SHA512 e55f7e2d520841717ec6f1fa3f223bd3093c4a79ee0cc40f53e52049eee0d6d44a25c44d9a65802abf4c5a3ca5be51b6b4a675124ecdf2c805da94418529456b
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqlidbv.exe

Path C:\Temp\i_gaytqlidbv.exe
Size 226KB
SHA256 f9b65b03575777ee863346ddee289e79497911b019816830a76d6961995aa91c
MD5 31ef62815a30ebb9d3f6bd7fa4758810
SHA1 607ea8b3d7da8d96ad4402c565aad30dc2620760
SHA512 60e6c02a494d7d1fea2b3d274248562a907b4fec80f16de79953e93eb267e27afb12802f70c3ebe6bb1c54ec7de8516a88ea476dfc0f345cbe1b9615629de46a
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpjhec.exe

Path C:\Temp\i_hfzxrpjhec.exe
Size 226KB
SHA256 d0a72eec3466ac07e53eb1d2f490350946f1b7fd5edf6f0c7bec6ed579d8c6ef
MD5 8f8d5e171dc93fe36ee245c00b3aaef0
SHA1 ff633d36b7c37bb1ac3e8d8eaff417c94c775f22
SHA512 ccee00d9bc4c9eb126e87323be25c01edc28eb89d907d327552d2e8a85bcd312a0545cc2c325bc5966dc76a64e1187e9826a50c2eb806069de2be62f190ac354
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebztromjd.exe

Path C:\Temp\i_jebztromjd.exe
Size 226KB
SHA256 208f1c1131ea37536b6109c974f3a16dfe8a81f099fc159f2efe986081acb2cb
MD5 7b49140930e9a72ee3c15ddefcfac715
SHA1 25a9f4c3a41bbbf8f292a4f3af626cf55f28f7e0
SHA512 2c58e711eae6b48cfe19f5d0e4f8ab41c49cb1795a48788163583602b0b0df69978bd576def0412c1842ccdf5b4993e6aa6546f32f29f00b494e7d34af006dc3
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T19534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxvpnhcx.exe

Path C:\Temp\i_kfdxvpnhcx.exe
Size 226KB
SHA256 1cfbc8682d9abd5bfc6b9ffc58941cbbedc5c1c36cba4e17827b60f88e013aab
MD5 6dd4d6ce338ee861b7b3b2e90a638bc3
SHA1 41c1dd32d361a2d0cc2154ba74a80b4e6ca68526
SHA512 69db629520264c23d5666420f7604b643ae8d3af9c63cfed2ba1b47b8c5a10c8692b230d811ccdc47ea89746a9abd74f421963ab302c264dc5728578920a4dc1
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T18134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojytrljdb.exe

Path C:\Temp\i_rojytrljdb.exe
Size 226KB
SHA256 f2fffa1c0c5bf8420da5ce57d6c47605c2eb48e802a8560caca1c67b968a9902
MD5 1354a91856132373ba934550d9387d28
SHA1 80104ab4662a403146d834f0d929d64e9717164f
SHA512 c98d1c01c43a141a8d2f785880deb4a3654183cef9db5ca9bda6949e58c5c6c0c2708cf16d3722a6f2dc6b606018972613dcb54e9fb3fa1783314b94b9803b3c
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzupmh.exe

Path C:\Temp\i_rpjhbzupmh.exe
Size 226KB
SHA256 7e23e06fa7468645565ac4dd74679fbb333bf7bacab3549b063303edb6a89abd
MD5 f784350dc15dc3da47fd4e84ec7191e2
SHA1 c6e4826694657e9de88107193b23d2ae23517645
SHA512 dabe0ce10ad0057079fda142c2aef25aa8e620c785b10018ea5afa54ec6a59d27a5b6dafb0b45f49fc0647371a3ae1813e57f46aa1952f632024c2ac64db0cfb
SSDEEP 3072:lsGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:BXY4LK+a3lLNngoqRttA7
TLSH
T17E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztromjd.exe

Path C:\Temp\jebztromjd.exe
Size 226KB
SHA256 8b8dd23430ebcba466c109759233174c7c6d9c459719a3bf6dbbcc8f98f73f2a
MD5 1fd135d1cd4b4885660f1f2665ea769d
SHA1 d7d8bb1ebe41b6470c945331eb1775920186c80d
SHA512 d3eed149fab984753d1a9dc09a1d82f53f3623a50d1244e1addae7e80ca1e9d572cfc6c3ce6d405ca93fb594a266447c9ab329fb54244b5f1ea5ead38cb95951
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T19134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljhe.sys

Path C:\Temp\jhbztrljhe.sys
Size 141KB
SHA256 c0641767f172c50b12a344c03e44a492f04173e955e00b4cbb1e527b8e18589a
MD5 7ea6936530ef79b3f15ccf04044c59b1
SHA1 99009a31723f3a4bae7821280a354dd5731a7d37
SHA512 a21507af54097eeff9c779bf2f7313c1c4b56612f9cf87a291ffad0275fc572aa8eed15aa5e97d2eda447d7c7b0101aef1a4715279b1028969e534ea3076532b
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhcx.exe

Path C:\Temp\kfdxvpnhcx.exe
Size 226KB
SHA256 342e1683e0c21047af7cc90a9e21216bcd83ab3395de5496fb4009f34ea9606c
MD5 0ab7cb8ef0804136a8a1ed9dcb9c2b0b
SHA1 6505ebc5ad8e101ce363bacec20344361231a619
SHA512 c2846be1192de9271b671a66658ad853eae3886bb8e7eb5a67d0807635c08a2ee1ca26dcc2458b639df107ff0b1c0b84e8c2c9a6d931b70300a8c16db58d0796
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T14E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.sys

Path C:\Temp\pkhcausmke.sys
Size 141KB
SHA256 44056f309a5a00b8f250cd1b93a15d80c017dc6cf84c93cf85f50ebd38ae1c4d
MD5 0e4bdc64553b4c3b604ee9665e214e8b
SHA1 0c4e81b23b7e6a5679420956fbdb88e82495ecbe
SHA512 3379a5183801c57355846833fd1f8ed25cd3c83f7cbd818c4916b3bb200769455f1750eea6d45a0e76f02b029522b9bf0e36889dce36c6a33656bafce633fda9
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T102E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojytrljdb.exe

Path C:\Temp\rojytrljdb.exe
Size 226KB
SHA256 7057dbba44909e89c1dc28bc36bca8c51c828a6553e969c67e1ae843cad7064d
MD5 4125465f84593df524769708a3590bd3
SHA1 d298586d65e617b035e75d093558a046a2797c36
SHA512 6150d20d8945347cf7fca98b27b9c6c2d57dec0937917ca4f4f1479595ddb05b6d40857f39d2caa7661ab602d2b2f7566375378eda3ee88b0adb635861ed53bb
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T18A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzupmh.exe

Path C:\Temp\rpjhbzupmh.exe
Size 226KB
SHA256 c4b662d58724328ef9cbf9542011c40ebd2fd8d2ae24d45823fd7c98d699b729
MD5 95e41807095eaddcd8ba78a582d23f45
SHA1 11cd1e6c7ab28871c671adcd28df82633348adc0
SHA512 cf0a3adb71b4949477380ce2157d035a668dee5fff35cb537894f6802a04fbec4a88219e7b5c528f48a01bf374a7dfce36715613f377e2390256a26ee59b23d8
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1AE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgeywq.sys

Path C:\Temp\ywqomgeywq.sys
Size 141KB
SHA256 bb9e5b1291dbcbf5a7abc2e35173c77fd6b1987c691304a8db32ccbd2f907c6a
MD5 bcdd69c291e7a2ac56af6bc18f2f3148
SHA1 2c760e4c50640a0d3aa17b2c5639d2c0c89df88e
SHA512 61d543aa4ce2b640939401790ab90d8c5f963666dbff85bbda3fa2bc39c5404a23a4f19f50eb354e519d07b7372371e47e50236bf4c115cb6b810c0356bbf6e6
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbztr.sys

Path C:\Temp\zwrpjhbztr.sys
Size 141KB
SHA256 cea6551eea41ae1268a3338f4634b175e9e067045f7608740f2aefccaa5cfc03
MD5 a9bb8de2c9dcba3bac9f5fab28001cc2
SHA1 4336d9ad1783d83bf5f57745dac52468f9c14577
SHA512 37570d24abfc9704b4bd7dae0918c11af6c74123b77f477e70c080bea2dfbccf4d52b64167d5ba433faf972baeaec71251c0b471e45b0c0684ea069c48a5d179
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1edaae16-6639-4d91-96e3-e87fa36ac6ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1edaae16-6639-4d91-96e3-e87fa36ac6ae.tmp
Size 33KB
SHA256 769c46da69cd97aabdde06e1b19877d7a0257c6c3897da13a9ce8921908d2e54
MD5 30517850a32cda01db70300e72ab84e4
SHA1 efb73954309676355d4c60b5df47754d4c6969a5
SHA512 51185594f507774d604217e38b49ef20d3a4a88d647fb734545de376ce4cc16ac16116c06762cba778da6f9d28a684dd2e677f16d1532ea0fab58ee054bcc385
SSDEEP 768:/53KBRyc7fZrK2p5XSwQs88uBkiT2l4YGHMqm:/53KB7trNILNBU4YU9m
TLSH
T100F2B075EC949873ACBAE3817B563B026FF06053C4C80A44D9DEA61E018775E3B4B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ea3931-f7e2-4069-8b3c-a18f085d4d7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\25ea3931-f7e2-4069-8b3c-a18f085d4d7b.tmp
Size 42KB
SHA256 51914c0d6c23b995b38076df08f1b7aacfb39c194d04ec56669df1763ce7ca86
MD5 e5944416ffa4f181f20c3e103b2ed0fe
SHA1 c58ec24e8570a6cd24a5891818be5d7b319bbf9a
SHA512 c58cdb858bc64cbbab44a9c27e23626e4872f1f7fa7681ece43edaf03cbd5aee6040681a952ee6f4d79dd8b283febc242a351dad6b26cee2cf0706389dc4716c
SSDEEP 768:SFQu3Wwg2BUiEerK7ap5XSwQs88uBkiT2l4YGHMqm:pu3DB9rq0ILNBU4YU9m
TLSH
T1E71338F598D78576E8AE9383673D2E029EFCD053B4884984B7C95D0DCC822BFD70A856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

0f2cc87f-3260-4a31-a104-9c0eb89a76da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0f2cc87f-3260-4a31-a104-9c0eb89a76da.tmp
Size 11KB
SHA256 a1c693400b2b9c66aee9327b53b87c09ce5d6a1d8a271af1c8e204a1b80727ef
MD5 efb0e908851e9fdefa0e0333f6ab38ba
SHA1 7144763c3eb39836819b97a2008685e06f3a301f
SHA512 a66e8e5422f9b3de170eb0ce5470fbac375fc0d9b5d5c2739780f28f3d6c6be43428787e8beb879ac231078a8041bacbaaaeaf312e367dbd678e3ebfbacb548b
SSDEEP 192:sxR0RYC8/f/srRZ9kHFzoA8p9G/g6+WNCMg/YEflGtIgDNNJ:sxR0N8/f/sr/iIA/5y/u5
TLSH
T16942CA15AE28A97B9CCBD21DBB657F13E3F95032A0941E48E7FD8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

463867c4-e96d-4617-b0db-2e1a02071235.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\463867c4-e96d-4617-b0db-2e1a02071235.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e317da9-2d55-46b3-b48c-466edd066285.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e317da9-2d55-46b3-b48c-466edd066285.tmp
Size 11KB
SHA256 394b47b423d1a6fa6f37e2a8bf8f5789fea62e10088636997d9b014b30af9a42
MD5 d41f99c3267673ea0b8ca643582a408c
SHA1 7a9ef485148f4f952f65da59476c8b591c0eed16
SHA512 92410fa1c0d8137b07ea7c5969873a702f8be0c0b118ebc1dacec73fef9ae4a866884a57422bbf892f5a72e48657dc517918195f72ee064b2973b8e6b12a759c
SSDEEP 192:sxRLRYC8/f/sWRZ9kHFzoA8p9G/g6+WNCMg/YEClGtIgVNJ:sxRLN8/f/sW/iIA/5y/JV
TLSH
T12132B815AE28A97B8CCBD21DFB657F53E7F91032A0941E48E6FD8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 dbcbe960f2d2ec0f97714bd7fc549947025ee705c63d357092905b8037239376
MD5 50ce088fb001f421bb93ef55c9fb9b5d
SHA1 1b64af7106caa9be7e2a424af641b1ea7ff1c621
SHA512 4b1471f9438a21302d8be447feb928de40a88982aa713ade216bf199287de5ca6bfee79e6e223c0b3d88f95b7633ca51a74a369bccc1b0fcbd204c8640dafed3
TLSH
T13C4170239E53E963FBFAC53144C930873BB14C82E9079DC28968D47D8CAFF217A85498
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 74644c75082b1ed35c02d9d5f32f20cf92293903c52203cc8484877b0bbee861
MD5 37f5fbc21d0a00c08078bc4e6b1ff507
SHA1 ce4b2d9b2e5fb7b12617bede72f143b2302ba2a2
SHA512 a4dafdd8e2312fe36ad58df6b891d47cad26a44ffc4f81359409562cd7cef6b1065cc7fe74549cf768680ef8f6586129b16c2db627b007cad9454b38298cd0d4
TLSH
T1E04170239E43E963FBFAC53188C930873BB14881E9475DC28968D47D8CAFF217A81098
MD5 SHA1 SHA512 TLSH

Submit Download

5085f7e1-6d51-46d7-84bb-e425b6edaaa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5085f7e1-6d51-46d7-84bb-e425b6edaaa0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

03f56527-4484-491a-a037-22a4b59d4522.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03f56527-4484-491a-a037-22a4b59d4522.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

558e51b8-2c3a-477e-bce7-04ee4c01ab1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\558e51b8-2c3a-477e-bce7-04ee4c01ab1f.tmp
Size 2KB
SHA256 d13380e70246eb84f76b58f4c35da8cd0a912f462fae1dc16309b7078da15f0f
MD5 78f3b17349fe02160f02763fb454183d
SHA1 635757ee41421e590c4811a07fc3db51703f1e79
SHA512 0614148c592a557a926486a77b643e509d6a44336d84eb7bdae9885473efc81f2f1c077e06ac6f74e37a4803e1845b0d2b748f64c152d3fee3975fe9cab2507f
TLSH
T12651B1F3C7E8866D890156F0AB187E1BCE1D0954432C7D5AC8E49F5B93E24B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

ba21f9cd-9423-4ba1-ad91-60ec5bfc95cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba21f9cd-9423-4ba1-ad91-60ec5bfc95cb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dfc7fc98-0dd3-4343-a222-18759ae0fcbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dfc7fc98-0dd3-4343-a222-18759ae0fcbc.tmp
Size 11KB
SHA256 6e23f3c48bf5a91e195ad1915cb5f872c1f107a001536aee3f0e200402793af1
MD5 af2d21d33ae66140f935695d07efa2c8
SHA1 08eb3332a241a97f2dab295409a7750f3c3ed4db
SHA512 e08405e607124540ff33b84a741ad9f6fdffd962f080a0cc6e347575a066c048850740533ae39473b0f275ce12ad8540cf7994c871cc3ecc6d0b515f0fe26414
SSDEEP 192:sxR0RYC8/f/s+RZ9kHFzoA8p9G/g6+WNCMg/YEClGtIgD/NJ:sxR0N8/f/s+/iIA/5y/J7
TLSH
T1F842B915AE28A97B8CCBD21DFB657F53E7F91032A0941E48E6FD8A1C04E76DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec547e0d-9aeb-417e-adb4-c7e330f4e5aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec547e0d-9aeb-417e-adb4-c7e330f4e5aa.tmp
Size 29KB
SHA256 6f5a1fec4e32111023bf20f9f31d109f8cb3af77c33513df0c64c890017fc2cf
MD5 2f15b8f8eca4984e97f5df67d0c355f5
SHA1 9b331e051111631082edbde7c50a67c63107e2fb
SHA512 39ef55c93d48e37a259e4aa39d48928eb397adb5c99dd6c0c14e07ed3b78c260c2dfac394301653974627b1d538fbd812f524f43e6976ef7568bafc86ea95746
SSDEEP 768:U/pCxx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcruyhpProJaq:U/pCxnEbLmWg8KfrLu1jafru8pcJ
TLSH
T131D2D97B740CCA7F4F804ADDA8197ADB6DA902CB9A98CD4047FE941C02C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f764335e-a575-4d08-aae3-49c65f0af6bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f764335e-a575-4d08-aae3-49c65f0af6bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6c2bb34-7461-4c24-aaf4-4d6cbc8fb70f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b6c2bb34-7461-4c24-aaf4-4d6cbc8fb70f.tmp
Size 37KB
SHA256 6f4146f5c724c151c410014727005b75b391380ecea831fe745ddead653429c0
MD5 1605b4c22de8c6f3c135120354edab62
SHA1 81bcf6049598035f09b3f53f902c78699f986e31
SHA512 6b976d5a3ae40639e2a74adc440f05678421ed8153ff554ff64bc6899bd1ab797506af367fd913a9d07dd7d61e29019c8ceba778b9711bce943a9fb2afa3d3cc
SSDEEP 768:R/UxvxjgC+W3MZac7fZrKop5XSwQs88uBkiTCCN/P84g:kZj3+W3MLtrTILNBtHg
TLSH
T16303C039EC946863ACF39385375A275BAFF06063C0C41B9849EE7A1E038B35D6707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c49c94cc-bd64-46f9-bdb2-ee37747b814f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c49c94cc-bd64-46f9-bdb2-ee37747b814f.tmp
Size 33KB
SHA256 41418913bb136eccaa537e39de8e6ecf931fca1ef97043af7c06b5e47adc15fe
MD5 c2eee06516094852a1e9335faf01350c
SHA1 6cc44b578ef9420e8b8d1912b08f2a21ae524ad5
SHA512 6fab7d9421aa422a9b0093436af1e2f673d30a894925d3d5379c286c59ad100b9aefe5f49d1c422dc631ae0ca7f3830238605773d1430bffc536af6d408f2de3
SSDEEP 768:M53VBRyc7fZrK2p5XSwQs88uBkiT2l4YGHMqm:M53VB7trNILNBU4YU9m
TLSH
T165F2B075EC959873ACBAE3817B563B026FF06053C4C80E44D9DEA61E018775E3B4B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e143d50-a167-43f3-9de5-dfad09353d48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5e143d50-a167-43f3-9de5-dfad09353d48.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

6fa29628-c00b-4a2b-85e1-7195ed8e8ac7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\6fa29628-c00b-4a2b-85e1-7195ed8e8ac7.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

80dd72f2-2305-44a7-97ea-d16bd00070a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\80dd72f2-2305-44a7-97ea-d16bd00070a5.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e42edc75-4f17-401c-87d7-01d6ddab039a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e42edc75-4f17-401c-87d7-01d6ddab039a.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

9a0324c7-998a-4e07-8ce1-582206775cdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9a0324c7-998a-4e07-8ce1-582206775cdf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fe09af7a-bf32-4176-af84-04c9290c5b5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe09af7a-bf32-4176-af84-04c9290c5b5f.tmp
Size 40KB
SHA256 3838b1faedbdb9d188fc011fe507591365d8aef161e79a969091d1050424ffed
MD5 f3a5ff2ec145200d6e04b21f6606b892
SHA1 cecd962b069ce1ce1dc2bc63481647f1713bfcd7
SHA512 8d35fb7b811726a191fda5ff81a4a528d91515e4d2e258ce855d8180c49c7e33253170b7d4f123bce6247bc759a5f43a0d5cdab9307ecda19c650addaa4f296f
SSDEEP 768:j/UxvxjgC+Q3KBzyc7fZrKRp5XSwQs88uBkiT2l4YGHMi1:2Zj3+Q3KB1trKILNBU4YUx1
TLSH
T19F03C039F894AC63ACB6E3417B5B2757AFF06063C4C50E5889DE6A0E028735D2B4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14eb9ad7-a0d6-413d-b8eb-6e7d69d34886.tmp

Path C:\Users\Admin\AppData\Local\Temp\14eb9ad7-a0d6-413d-b8eb-6e7d69d34886.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5686b500-75a5-456a-8a4b-77c412ead754.tmp

Path C:\Users\Admin\AppData\Local\Temp\5686b500-75a5-456a-8a4b-77c412ead754.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5752_910347894\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1048981939\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1059482940\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_1172660590\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5752_324388751\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1152-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1424-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2168-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2404-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3852-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3980-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4116-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4288-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4568-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4676-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4700-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4700-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5188-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5452-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5500-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5676-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5696-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5964-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download