364222e77908986e6d972acb3abbe291f971d97cd3a6c14708bb895678ad3098

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
Size 243KB
Sample261002-wj81vstepf
SHA256 364222e77908986e6d972acb3abbe291f971d97cd3a6c14708bb895678ad3098
MD5 27308cd63e18fdb3fb222abf6a0dd4ca
SHA1 e4b0853b3489493f0e669d14215617a7c5b39004
SHA512 88fdea599a00b12a5e1b91e407ca51b9aa1808998a17e6d376776bd6572fd6a900c38f9a896be9e253542f1f01b971cad26f16260c51b1a566e0698ef1e754c1
SSDEEP 3072:YhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:giA7nLtm/ka3lLNngoqRttA7S
TLSH
T16E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3444	CP.exe
1028	xrpjhczusm.exe
5004	CP.exe
5972	CP.exe
6028	i_xrpjhczusm.exe
5748	wuojhbzxup.sys
3736	CP.exe
3348	hbzuomjebw.exe
5504	CP.exe
4680	CP.exe
4480	i_hbzuomjebw.exe
4152	wuojhbzwuo.sys
2748	CP.exe
5320	rljetrojdb.exe
4616	CP.exe
1236	CP.exe
4352	i_rljetrojdb.exe
3104	eywqomgeyw.sys
5272	CP.exe
5084	jdbwqojgby.exe
4584	CP.exe
3492	CP.exe
1084	i_jdbwqojgby.exe
5448	wtoigaywqo.sys
1532	CP.exe
1624	tnlfdywqoi.exe
4480	CP.exe
2992	CP.exe
2872	i_tnlfdywqoi.exe
5948	tnlyvqnifa.sys
2484	CP.exe
1732	fdxvpnifdx.exe
3848	CP.exe
3012	CP.exe
804	i_fdxvpnifdx.exe
2512	fdyvqnifdx.sys
5872	CP.exe
5820	caqnifaysq.exe
2000	CP.exe
3036	CP.exe
3824	i_caqnifaysq.exe
1184	icaxvpnkic.sys
3152	CP.exe
3396	hfaxspkica.exe
2588	CP.exe
3384	CP.exe
468	i_hfaxspkica.exe
4984	urpkecwusm.sys
700	CP.exe
2448	pkhczuspke.exe
5748	CP.exe
5360	CP.exe
716	i_pkhczuspke.exe
4592	rmkecwuspm.sys
1184	CP.exe
1084	hezxuomjec.exe
2700	CP.exe
3788	CP.exe
2116	i_hezxuomjec.exe
5508	uomkebzuom.sys
1492	CP.exe
5752	omgecwupjh.exe
2380	CP.exe
6088	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_460497252\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1824111104\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1068975051\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_976106362\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_460497252\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1824111104\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1824111104\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1824111104\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_976106362\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczuspke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxuomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiczusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kiczusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmkfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdywtoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqfdxspni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljetrojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxuomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdywtoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqfdxspni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljetrojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczuspke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgecwupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgecwupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmkfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3780	ipconfig.exe
2272	ipconfig.exe
3212	ipconfig.exe
3492	ipconfig.exe
4284	ipconfig.exe
3584	ipconfig.exe
2344	ipconfig.exe
2404	ipconfig.exe
4156	ipconfig.exe
5672	ipconfig.exe
3956	ipconfig.exe
2544	ipconfig.exe
3824	ipconfig.exe
4740	ipconfig.exe
4940	ipconfig.exe
1660	ipconfig.exe
4252	ipconfig.exe
3308	ipconfig.exe
200	ipconfig.exe
2760	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{33B6337E-9565-4E72-841A-BA62F94F1E39}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	msedge.exe
1224	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6028	i_xrpjhczusm.exe
Token: SeDebugPrivilege	4480	i_hbzuomjebw.exe
Token: SeDebugPrivilege	4352	i_rljetrojdb.exe
Token: SeDebugPrivilege	1084	i_jdbwqojgby.exe
Token: SeDebugPrivilege	2872	i_tnlfdywqoi.exe
Token: SeDebugPrivilege	804	i_fdxvpnifdx.exe
Token: SeDebugPrivilege	3824	i_caqnifaysq.exe
Token: SeDebugPrivilege	468	i_hfaxspkica.exe
Token: SeDebugPrivilege	716	i_pkhczuspke.exe
Token: SeDebugPrivilege	2116	i_hezxuomjec.exe
Token: SeDebugPrivilege	5096	i_omgecwupjh.exe
Token: SeDebugPrivilege	3796	i_ztrljdbywu.exe
Token: SeDebugPrivilege	3808	i_jdywtoigay.exe
Token: SeDebugPrivilege	2512	i_daysqkidav.exe
Token: SeDebugPrivilege	460	i_xvqfdxspni.exe
Token: SeDebugPrivilege	4800	i_spnhfaxsqk.exe
Token: SeDebugPrivilege	4644	i_kiczusmkfc.exe
Token: SeDebugPrivilege	3376	i_zurpmkfcwu.exe
Token: SeDebugPrivilege	5548	i_pjhczurmcw.exe
Token: SeDebugPrivilege	1996	i_omgeywrojg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4568	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	89
PID 4568 wrote to memory of 4340	4568	iexplore.exe	90
PID 4340 wrote to memory of 1956	4340	msedge.exe	91
PID 4340 wrote to memory of 3892	4340	msedge.exe	93
PID 4340 wrote to memory of 4212	4340	msedge.exe	94
PID 4340 wrote to memory of 3892	4340	msedge.exe	93
PID 4340 wrote to memory of 3892	4340	msedge.exe	93
PID 4340 wrote to memory of 876	4340	msedge.exe	95
PID 4340 wrote to memory of 876	4340	msedge.exe	95
PID 4340 wrote to memory of 3916	4340	msedge.exe	96
PID 4340 wrote to memory of 5440	4340	msedge.exe	97
PID 4340 wrote to memory of 3916	4340	msedge.exe	96
PID 4340 wrote to memory of 3916	4340	msedge.exe	96
PID 4340 wrote to memory of 5440	4340	msedge.exe	97
PID 4340 wrote to memory of 5440	4340	msedge.exe	97
PID 4340 wrote to memory of 2804	4340	msedge.exe	98
PID 4340 wrote to memory of 1516	4340	msedge.exe	99
PID 4340 wrote to memory of 2804	4340	msedge.exe	98
PID 4340 wrote to memory of 2804	4340	msedge.exe	98
PID 4340 wrote to memory of 1516	4340	msedge.exe	99
PID 4340 wrote to memory of 1516	4340	msedge.exe	99
PID 4340 wrote to memory of 3172	4340	msedge.exe	101
PID 4340 wrote to memory of 3172	4340	msedge.exe	101
PID 5604 wrote to memory of 3444	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	102
PID 1028 wrote to memory of 5004	1028	xrpjhczusm.exe	105
PID 4340 wrote to memory of 576	4340	msedge.exe	106
PID 4340 wrote to memory of 2316	4340	msedge.exe	107
PID 4340 wrote to memory of 576	4340	msedge.exe	106
PID 4340 wrote to memory of 2316	4340	msedge.exe	107
PID 4340 wrote to memory of 5444	4340	msedge.exe	111
PID 4340 wrote to memory of 4112	4340	msedge.exe	112
PID 4340 wrote to memory of 4112	4340	msedge.exe	112
PID 4340 wrote to memory of 2168	4340	msedge.exe	113
PID 4340 wrote to memory of 2168	4340	msedge.exe	113
PID 5604 wrote to memory of 5972	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	116
PID 5604 wrote to memory of 3736	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	120
PID 3348 wrote to memory of 5504	3348	hbzuomjebw.exe	122
PID 5604 wrote to memory of 4680	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	125
PID 5604 wrote to memory of 2748	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	129
PID 5320 wrote to memory of 4616	5320	rljetrojdb.exe	131
PID 5604 wrote to memory of 1236	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	134
PID 5604 wrote to memory of 5272	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	138
PID 5084 wrote to memory of 4584	5084	jdbwqojgby.exe	140
PID 5604 wrote to memory of 3492	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	144
PID 4340 wrote to memory of 2520	4340	msedge.exe	146
PID 4340 wrote to memory of 1432	4340	msedge.exe	147
PID 4340 wrote to memory of 4988	4340	msedge.exe	148
PID 5604 wrote to memory of 1532	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	151
PID 1624 wrote to memory of 4480	1624	tnlfdywqoi.exe	153
PID 5604 wrote to memory of 2992	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	156
PID 5604 wrote to memory of 2484	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	160
PID 1732 wrote to memory of 3848	1732	fdxvpnifdx.exe	162
PID 5604 wrote to memory of 3012	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	165
PID 5604 wrote to memory of 5872	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	169
PID 5820 wrote to memory of 2000	5820	caqnifaysq.exe	171
PID 5604 wrote to memory of 3036	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	174
PID 5604 wrote to memory of 3152	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	178
PID 3396 wrote to memory of 2588	3396	hfaxspkica.exe	180
PID 5604 wrote to memory of 3384	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	183
PID 4340 wrote to memory of 1464	4340	msedge.exe	185
PID 4340 wrote to memory of 1464	4340	msedge.exe	185
PID 5604 wrote to memory of 700	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	191
PID 2448 wrote to memory of 5748	2448	pkhczuspke.exe	193
PID 5604 wrote to memory of 5360	5604	2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_27308cd63e18fdb3fb222abf6a0dd4ca_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffaeef8c188,0x7ffaeef8c194,0x7ffaeef8c1a0
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,14975521254629301102,16805658767388624218,262144 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6832430344250709206,2054569043627525663,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:11
      4⤵
      System Time Discovery
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,6084971260414009951,15732911463388853371,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
      4⤵
      PID:876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3524,i,16578596685178787402,496264600082697996,2097152 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,14520521243355476261,3001513281106379476,2097152 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5575786655386174128,4852538101566233401,2097152 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,6402117760352035162,1391885981870539142,2097152 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,2237399270984111191,3748210759772281333,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1393292803728168657,12665853105285404795,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8979875097047822028,16696415858514605657,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13194993469601731742,12686083427900517539,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,13194993469601731742,12686083427900517539,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1905532939385394223,8184823000562408837,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,13788058196823388713,7152753430690651646,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,2904043656846291859,8835130632263636724,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,4778801090288081045,11826685628794667442,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15932734778445380280,6761415121459907241,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10852094010487405713,16006463004166848932,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,10354763098719587911,16608488427859292035,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6377054243125607857,11329683858657428140,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,1090861307971246499,14930111074381307733,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4972,i,6724112998099023472,13386332186395071362,262144 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10247011875913677849,9647792418321230803,524288 --field-trial-handle=2084,i,15254000051357444068,4421771296123548817,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3444
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5972
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzuomjebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3736
- - C:\Temp\hbzuomjebw.exe
    C:\Temp\hbzuomjebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzuomjebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4680
- - C:\Temp\i_hbzuomjebw.exe
    C:\Temp\i_hbzuomjebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljetrojdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\rljetrojdb.exe
    C:\Temp\rljetrojdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljetrojdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_rljetrojdb.exe
    C:\Temp\i_rljetrojdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwqojgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\Temp\jdbwqojgby.exe
    C:\Temp\jdbwqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwqojgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3492
- - C:\Temp\i_jdbwqojgby.exe
    C:\Temp\i_jdbwqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Temp\tnlfdywqoi.exe
    C:\Temp\tnlfdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\i_tnlfdywqoi.exe
    C:\Temp\i_tnlfdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Temp\fdxvpnifdx.exe
    C:\Temp\fdxvpnifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\i_fdxvpnifdx.exe
    C:\Temp\i_fdxvpnifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caqnifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5872
- - C:\Temp\caqnifaysq.exe
    C:\Temp\caqnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caqnifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\i_caqnifaysq.exe
    C:\Temp\i_caqnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\hfaxspkica.exe
    C:\Temp\hfaxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Temp\i_hfaxspkica.exe
    C:\Temp\i_hfaxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhczuspke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\pkhczuspke.exe
    C:\Temp\pkhczuspke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhczuspke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5360
- - C:\Temp\i_pkhczuspke.exe
    C:\Temp\i_pkhczuspke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxuomjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\hezxuomjec.exe
    C:\Temp\hezxuomjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxuomjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\i_hezxuomjec.exe
    C:\Temp\i_hezxuomjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgecwupjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1492
- - C:\Temp\omgecwupjh.exe
    C:\Temp\omgecwupjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgecwupjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_omgecwupjh.exe
    C:\Temp\i_omgecwupjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbywu.exe ups_run
  2⤵
  PID:3472
- - C:\Temp\ztrljdbywu.exe
    C:\Temp\ztrljdbywu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbywu.exe ups_ins
  2⤵
  PID:5008
- - C:\Temp\i_ztrljdbywu.exe
    C:\Temp\i_ztrljdbywu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdywtoigay.exe ups_run
  2⤵
  PID:4624
- - C:\Temp\jdywtoigay.exe
    C:\Temp\jdywtoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdywtoigay.exe ups_ins
  2⤵
  PID:1260
- - C:\Temp\i_jdywtoigay.exe
    C:\Temp\i_jdywtoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daysqkidav.exe ups_run
  2⤵
  PID:5184
- - C:\Temp\daysqkidav.exe
    C:\Temp\daysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daysqkidav.exe ups_ins
  2⤵
  PID:4360
- - C:\Temp\i_daysqkidav.exe
    C:\Temp\i_daysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqfdxspni.exe ups_run
  2⤵
  PID:2976
- - C:\Temp\xvqfdxspni.exe
    C:\Temp\xvqfdxspni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqfdxspni.exe ups_ins
  2⤵
  PID:3780
- - C:\Temp\i_xvqfdxspni.exe
    C:\Temp\i_xvqfdxspni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfaxsqk.exe ups_run
  2⤵
  PID:3264
- - C:\Temp\spnhfaxsqk.exe
    C:\Temp\spnhfaxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfaxsqk.exe ups_ins
  2⤵
  PID:3632
- - C:\Temp\i_spnhfaxsqk.exe
    C:\Temp\i_spnhfaxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kiczusmkfc.exe ups_run
  2⤵
  PID:4956
- - C:\Temp\kiczusmkfc.exe
    C:\Temp\kiczusmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kiczusmkfc.exe ups_ins
  2⤵
  PID:3004
- - C:\Temp\i_kiczusmkfc.exe
    C:\Temp\i_kiczusmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpmkfcwu.exe ups_run
  2⤵
  PID:4428
- - C:\Temp\zurpmkfcwu.exe
    C:\Temp\zurpmkfcwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpmkfcwu.exe ups_ins
  2⤵
  PID:3424
- - C:\Temp\i_zurpmkfcwu.exe
    C:\Temp\i_zurpmkfcwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmcw.exe ups_run
  2⤵
  PID:4592
- - C:\Temp\pjhczurmcw.exe
    C:\Temp\pjhczurmcw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmcw.exe ups_ins
  2⤵
  PID:2624
- - C:\Temp\i_pjhczurmcw.exe
    C:\Temp\i_pjhczurmcw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run
  2⤵
  PID:832
- - C:\Temp\omgeywrojg.exe
    C:\Temp\omgeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins
  2⤵
  PID:3448
- - C:\Temp\i_omgeywrojg.exe
    C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2784

C:\Temp\wuojhbzxup.sys
C:\Temp\wuojhbzxup.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\wuojhbzwuo.sys
C:\Temp\wuojhbzwuo.sys
1⤵
- Executes dropped EXE
PID:4152

C:\Temp\eywqomgeyw.sys
C:\Temp\eywqomgeyw.sys
1⤵
- Executes dropped EXE
PID:3104

C:\Temp\wtoigaywqo.sys
C:\Temp\wtoigaywqo.sys
1⤵
- Executes dropped EXE
PID:5448

C:\Temp\tnlyvqnifa.sys
C:\Temp\tnlyvqnifa.sys
1⤵
- Executes dropped EXE
PID:5948

C:\Temp\fdyvqnifdx.sys
C:\Temp\fdyvqnifdx.sys
1⤵
- Executes dropped EXE
PID:2512

C:\Temp\icaxvpnkic.sys
C:\Temp\icaxvpnkic.sys
1⤵
- Executes dropped EXE
PID:1184

C:\Temp\urpkecwusm.sys
C:\Temp\urpkecwusm.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\rmkecwuspm.sys
C:\Temp\rmkecwuspm.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\uomkebzuom.sys
C:\Temp\uomkebzuom.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Temp\wromgeywro.sys
C:\Temp\wromgeywro.sys
1⤵
PID:1936

C:\Temp\olgaytqoid.sys
C:\Temp\olgaytqoid.sys
1⤵
PID:4332

C:\Temp\oigayolfdy.sys
C:\Temp\oigayolfdy.sys
1⤵
PID:2956

C:\Temp\dysqkigavs.sys
C:\Temp\dysqkigavs.sys
1⤵
PID:1392

C:\Temp\sqkicaxvpn.sys
C:\Temp\sqkicaxvpn.sys
1⤵
PID:264

C:\Temp\pkicausmkh.sys
C:\Temp\pkicausmkh.sys
1⤵
PID:4740

C:\Temp\hczukhfcwu.sys
C:\Temp\hczukhfcwu.sys
1⤵
PID:4636

C:\Temp\mjhezxromk.sys
C:\Temp\mjhezxromk.sys
1⤵
PID:4704

C:\Temp\omgeywuomg.sys
C:\Temp\omgeywuomg.sys
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqomgeyw.sys

Path C:\Temp\eywqomgeyw.sys
Size 141KB
SHA256 dc2f5317ff774144280ed9089e0ea72d32d40c2afe24cc95666fd314b8a9204c
MD5 87da7f8c7a7b3a3f6df2b35a72b2eba4
SHA1 6fdff3c6d9de29e9879e516b67e4e4a212e3ee69
SHA512 5947851684989ad793e9bd396d5c4af1e2b7e2cef5b189c36425038252ca9ac49a40759398b24fd40251606894a2296f0ea67c937d86b28e07ed50bfaca27391
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltN:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifdx.exe

Path C:\Temp\fdxvpnifdx.exe
Size 243KB
SHA256 450e248b66ddd031c042648f2338325c0a9c78d9021a3d36028ec757460cdd92
MD5 14daa804777d88145dd788392e12cda3
SHA1 79e3facaaa32dcd27f8e88d16d62c20bd5312428
SHA512 11d297bafe231e84f763832fe742b2f0000abb8e339b10e0a46f9daa5f6fbe5ed89019d8f31362f0b9ae7368a992b02d56220703a25a1f5ac94728c3d68b283a
SSDEEP 3072:ZhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:XiA7nLtm/ka3lLNngoqRttA7L
TLSH
T10E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqnifdx.sys

Path C:\Temp\fdyvqnifdx.sys
Size 141KB
SHA256 efb89ca77245c97bc3f9d7ec5f22b87afbeaee54774c3778a952e60747e186e2
MD5 822a93b7b73f58bb568f5360b7ac78d4
SHA1 9818ae87576ef2f63c753d35c6b9346b16d1b094
SHA512 a89dbf8ca6fc990a5d50bcaba4eeed059a1c01d226e42d6c6eec63adff586f3fb92a8b2e83f72fc94ad6c9b8af4c29577f907b29a82ab5cb81da50a3de2a1b93
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T118E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzuomjebw.exe

Path C:\Temp\hbzuomjebw.exe
Size 243KB
SHA256 02bff89e9be090b4805201c711d9ceac0a118b07e5256079b16197a07195e530
MD5 10a4c93bf8511c9bdb3fdd38ed61c9c5
SHA1 1c4b8cfb6209f39f3f5ff6813a300e3b64765aa2
SHA512 1ccdc51bd9dfe49185545fac6e525462e1dee97e413a1688448b51b12ccb60e01ac1306c8001c663f5c551d8aa4d448db23a7e3aaf32bb40493117f0f911931e
SSDEEP 3072:ShiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:OiA7nLtm/ka3lLNngoqRttA7o
TLSH
T113345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvpnifdx.exe

Path C:\Temp\i_fdxvpnifdx.exe
Size 243KB
SHA256 f647f103c7c42abb2a8eada339fc583901d773e02a874cea549b7d74bd28bf08
MD5 a817f9bc7b9bdfed10d5255912dad646
SHA1 875d77dcaa259a6ccbb7ab6f68ed37bad782c075
SHA512 9cad9606091f458382e5ce04cd8beaedd7caab017d45aad7afbed1487bda6843989b9829b5df7d2d0035d6089cb6b12b45b21ea1b6af534ff38d784254cc50f1
SSDEEP 3072:JhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:HiA7nLtm/ka3lLNngoqRttA7f
TLSH
T1FE345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzuomjebw.exe

Path C:\Temp\i_hbzuomjebw.exe
Size 243KB
SHA256 0789e8f666046158a0726d98a4f3196f312724d759f12d70b2f25f154c1ce85c
MD5 9f39af9d13cdfd45ca9518b3b6736688
SHA1 4c377413e1cbae806f427dccc332d0b5ae65e9e0
SHA512 8cc18e91c1a90e2d4060da1b383287f36ee243cc803326c63dc2be9985a5fb3346d4f42d52c46303c58678ba34b71f273d1642118ce4f64950aa1c12e3d0dbd5
SSDEEP 3072:AhhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Oh:2iA7nLtm/ka3lLNngoqRttA7k
TLSH
T1FF345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbwqojgby.exe

Path C:\Temp\i_jdbwqojgby.exe
Size 243KB
SHA256 dff4f7cf4980afa19dfe48714e3df51b93fadc36af7a1c6d1fcd734ca30643da
MD5 a88d116c4d574d9aa5731346ac254581
SHA1 4583d8db01352b2efd74dca80700a71480dee27c
SHA512 0f42a5f633f608d254fc2d8a40a068bfc3f4231fd0ab6bf59c417baefbe64405431cf59b5940636e3ad899532d2f107e3462f73356cfeabacfdd395b17ea087e
SSDEEP 3072:OhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:yiA7nLtm/ka3lLNngoqRttA7k
TLSH
T10D345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljetrojdb.exe

Path C:\Temp\i_rljetrojdb.exe
Size 243KB
SHA256 29be1062d23a10d31105808d82838182dc686a2d8b6e8552d935935adcf445b0
MD5 31367af416c5243134f84b7b48408f48
SHA1 b3371a60be848ef2f1a1f8ebe127da97cadf2d57
SHA512 4b01d1d022d7802a146dd0a6b5ce10f43c48c50398de0e8795d7ddab792d29dedea3e6e915cdaa645e0387fa05be9b8af9190598f408b15dcad6eef31a7a2da4
SSDEEP 3072:LhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:NiA7nLtm/ka3lLNngoqRttA7V
TLSH
T153345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdywqoi.exe

Path C:\Temp\i_tnlfdywqoi.exe
Size 243KB
SHA256 8d1cbb45ed58b253b5fbbb1f8dda806a88070caf949853dbaeabab21088ae7d9
MD5 099a7c7181d557b9c4c3c834d931d136
SHA1 4ae29a7120b5e8dde84f54578d259180a66fab2f
SHA512 a33104a26b844fdfa6b13031c1b0f501c629568d431412740542dcaf2a238efc0619edbab0f6ab33d459d363aad3377da42c8b7b721b8afd9dd2df8d536e5170
SSDEEP 3072:whiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:oiA7nLtm/ka3lLNngoqRttA7W
TLSH
T16A345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhczusm.exe

Path C:\Temp\i_xrpjhczusm.exe
Size 243KB
SHA256 6d0ec8b0dd010b65d7c3f8df210a5a03a8fffd37c64de9ab8b88e3da878f1531
MD5 7dbaf9fb371b7ac402ecfb58261e9f72
SHA1 205c0df26e82072d1ee749f126f5b7378dbb56e3
SHA512 ade082e62113c16e8d610ff72ead61a92640ba861e8bf9d83af1f34fff5215df0628d891c4f2d3282187d31a62792988df9d3f43dd7e1814efadd2040c453b01
SSDEEP 3072:ChiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:+iA7nLtm/ka3lLNngoqRttA70
TLSH
T102345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwqojgby.exe

Path C:\Temp\jdbwqojgby.exe
Size 243KB
SHA256 110e19c6d3c6865d1dbd38169eb6c4ca9ff4e1a81909ca822b83fc524cb11bc5
MD5 c24db77a1951ec2fcb8ef5f9e1cde609
SHA1 5d57d1cb81cbf7b30f1d10eea270c2c9fd7b5a40
SHA512 82d8d3d4b41014b373fcf449f4db1193caf603f59b305e6f97a3db5eae04f0a55129a3fdf2d0bd9dc069f55fb30996d403b50b6846dca7e13a45ed73569fee7d
SSDEEP 3072:EhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:UiA7nLtm/ka3lLNngoqRttA7u
TLSH
T1FB345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljetrojdb.exe

Path C:\Temp\rljetrojdb.exe
Size 243KB
SHA256 aa19bf09ee348af2c8ca272bad3473fde96352325e54632ced6e5bd9d6f018fc
MD5 508453a566c14fa2c5a24f7ed7dfa94e
SHA1 0ab177532255e924013af0a945fa7d888bc5c1b0
SHA512 4878a7bec9a7407c6c47aa52b6320973adde2ab6f54a3d1bd68b1b94a45605b645595f12666e4a110544afae13beffa6b167495c717012a0d35a0c4dd8722acd
SSDEEP 3072:5hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:3iA7nLtm/ka3lLNngoqRttA7f
TLSH
T1BD345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdywqoi.exe

Path C:\Temp\tnlfdywqoi.exe
Size 243KB
SHA256 fa4870b4db9780063b8c7682aef0697a48258d1eff51b2127c19b32374be08bf
MD5 2ad97aad8a6c3856ac71709ff59c674c
SHA1 bc78435c4f3085a4bd288aa9818a43910bc87b6f
SHA512 8dde55629eb959c83bb8ca9841b1d69f1ed1cf912cdc32f5ae48bd5b20ce2c9d892ebcf4372487ad022014f51e7b09ff1fb62acef1b5ccec8e19675c57148bd4
SSDEEP 3072:fhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:JiA7nLtm/ka3lLNngoqRttA7p
TLSH
T18E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlyvqnifa.sys

Path C:\Temp\tnlyvqnifa.sys
Size 141KB
SHA256 81ee7b57cb051d3d1b2c9868471f0ee08a5371042e329ba3b614f75e70cc6e0b
MD5 6ab6aba565a27d62d6d11f263a0ee475
SHA1 6557373248738574787a43affd0c0b607b8a27fc
SHA512 9f50c3f57bbe96f4a1624bfa8474215b31431ee069573c5d359f3c25af3ad583a75d85f953bb1ed2601d40e670298506e1eb1997739405355f5745048239d7df
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoigaywqo.sys

Path C:\Temp\wtoigaywqo.sys
Size 141KB
SHA256 ef6d57c9bd394b6d769a7203e2a63c6bb94371865b283fea62aeff80e61152ec
MD5 c89801aae47b8259c45f60e2e2ac9a49
SHA1 eff7f7f178ec812c8e8459f66a017f87f28b370f
SHA512 093e2de1ffb37217ecda7c16d0e84b7db838ed73ef77bd0299c9bfddc623ba060603fe1a864d6b151e562ae3800441dc86a83c4d75ba893c585b862d3803facc
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuojhbzwuo.sys

Path C:\Temp\wuojhbzwuo.sys
Size 141KB
SHA256 8160f6919b422af70ab2bac13453c486d73b79caf5e5eb9b937492d39834fa4a
MD5 83b47f999a7d56cb2367dc95af856434
SHA1 8f62e866eeb824f48f3e569e2207b133e09b7cad
SHA512 a688d2a40ca7ef9ce5e949cff00cffaafd57b1ba9af95a1f7a583f509530ce68bb2f8b1fe59b31c7ddb6d04b224c8203fcbaf49178647cc5f795893508663b74
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuojhbzxup.sys

Path C:\Temp\wuojhbzxup.sys
Size 141KB
SHA256 4c27a8766eb88ede46f9c96b9064ca4db63c2c77bc7e60214fb180d84905df02
MD5 76f13c41b4eeb6620e8631c22b4b074d
SHA1 87754ab7e034e361cb61b9620e42cf019687ff2e
SHA512 26ca1db24d6d2946c4b48625acb3439d8d0fe1dbbfaa33a35c6de76abb4909a23599342556884fe8fba7e5cad6f71e0102b975f2bef20e88422ed4083b56e468
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczusm.exe

Path C:\Temp\xrpjhczusm.exe
Size 243KB
SHA256 edf26d91dc5eaf65dc93e172c0bcc52f7b6fc99a50b906541e441919fa46ed36
MD5 e9dcd29567686fcdfe891ebd921ccd59
SHA1 59cc8369e7af9401a8599f3b24827cdc7678c019
SHA512 2f04516f273b5854bca5839cb5c35a76088def315d2260b1e705d64c8c02b52aab586ebbb9dd920ff6f98e740425cc7fd1d021e9d00d9fbc47b48146a98e6b1a
SSDEEP 3072:chiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:8iA7nLtm/ka3lLNngoqRttA7C
TLSH
T1FB345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

097be317-16be-42c2-a281-bfa11944df66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\097be317-16be-42c2-a281-bfa11944df66.tmp
Size 34KB
SHA256 b850ad8265da4ee618535f4044126da150a0ff734752258165ff69636ac81878
MD5 d3fa3cbb12a2172fd0e3bc1f37624365
SHA1 a565505eb87012556335d3a32c78f3ccd378067d
SHA512 c06952ac6f53b22622ef55e9d3810316954d78701a70ff77a07bcfe29ee105c7fadfd81c2459b3f292b2ed965de9e2bf4d804f9bdbc68ff7e1f8e5155951ac4d
SSDEEP 768:3zK3VtisieOT93xGbnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sQ/3:3zK37tCIbwQpYoimeoR4ccFFR2sC3
TLSH
T168F2BEB0E9A8DEB36CFB928577593342BFF41563A8C54E48D9EE1B0D01436AA071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d488a11-912c-4379-a900-04914cbe0b5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d488a11-912c-4379-a900-04914cbe0b5a.tmp
Size 37KB
SHA256 eb71fe70208b12299f1ce9eafe38c750ca5a8928e14f24e5d64107188cf55ddb
MD5 458a8bc4e96e2098a4533902e9ef8180
SHA1 963c62a6519582eb975d24aef1e2db97aa9cbd12
SHA512 19b1af71011fc09015d7a91bd2fcf3f4d69afa2f2641ecc298754ffd0e1d168a0f8c741972b89631177f9343817ea559e2051382637eab30af27bfb21765b31d
SSDEEP 768:vw/UxvxjgC+5j3wVNL8lieOT9TjFnUPO4Qp7cPAiSm2eo4w4cciGrTF56AgZbCMc:vdZj3+5j3wTLyCTjFwQpYoimeoR4ccF1
TLSH
T10803BE75A8A8AE77DCF39784365D6342EFF1416395C22AA4CAED1E0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5270576c-9c5e-41ea-bb87-f1e16f8530bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5270576c-9c5e-41ea-bb87-f1e16f8530bf.tmp
Size 42KB
SHA256 be5c37f7d258a4e3a07f86c43aa4f4d925116c413ac1d9ab3ff98565fc68f6bf
MD5 7c599f2221b2a536032ea48306899b32
SHA1 d2e8aa7b59938aaa2688646261d5d4433a451f89
SHA512 399e586b9a498fb3f248129809cb174d66236d9d809f449d694de79f9d0505a28cf15887862b47d8cee42911dd20eb8185f16cd69f368988050009797f67112b
SSDEEP 768:GFQa3TwgI8iOuOT93xXGnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sQ/3:Na3zTVGwQpYoimeoR4ccFFR2sC3
TLSH
T16B1317F598D79A76E8AE5783673C6E429EBCC163B4845984F7D91E0CCC421BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a66de72-f024-4751-9d92-f287dddf04e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a66de72-f024-4751-9d92-f287dddf04e8.tmp
Size 34KB
SHA256 d9a11d1795c08a4c4133bc8ee99acd4d1f0c01d2ee5599b1cfc71b258548ad5c
MD5 1612fa5a3dbc9d29d3dbc7727995ba43
SHA1 38a63f2ed863ef0410e8c5457708a2c5dd6bbe89
SHA512 6ccf7fe8d3642a70fa7276719e292546d0c9eb53eb0bc1ea34b76dc0c9f91624bbed5203b06043f693a7fc2e3c02f4177de85d5998ea1a8009e72d26e22021d2
SSDEEP 768:aK3spisieOT93xGbnUPO4Qp7cPAiSm2eo4w4cciGrTFl/2sQ/3:aK3ctCIbwQpYoimeoR4ccFFR2sC3
TLSH
T1D9F2BEB0E9A8DEB36CFB928577593342BFF41563A8C54E48D9EE1B0D01436AA071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

242a39dd-b730-43b6-a40c-9874ad7d23b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\242a39dd-b730-43b6-a40c-9874ad7d23b6.tmp
Size 29KB
SHA256 e52a257d6a1773d6310fd249a263b42043e8ccd4ace964dcdadafb5c0a0215e9
MD5 72e2b17037502146b1976a308c84bfa8
SHA1 532401e954babdba1c63c693db56c987fb740042
SHA512 d55c6cfd45bbc5486c3285c778edd337c864f1182823419c7f1e323d62e8015d264466c02b63a32d0c42920ed355cde12203246db46e52d7c45ee88395ef3820
SSDEEP 768:DFakr4yG7pLuLbs5Wg1Bf9t8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuhJ97guroMFe:DFakr4ymEbs5Wg1Bf9tu1jaNhJxglMFe
TLSH
T10AD2FB3B744CCB7F4F804A9DEC197E9B6DA802CB9598C94047FE941D03C6BEA521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bae3496-63d8-4a91-a41b-3b64053dea36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3bae3496-63d8-4a91-a41b-3b64053dea36.tmp
Size 11KB
SHA256 4e70ae9d72d4d4cedbb2324413964219e45bdbd479bbc0a9b29fc02944418ef0
MD5 06288b8d05a18abcdc02c885ddd41308
SHA1 db7963e5f769ed3751c14883fe870de078039318
SHA512 7c2ba05e37c10b4a027192c7dd9b00200d8393f51dd7b8cc76088c631a636f23a0bb8ca154482af17caf85dbd1c62c009ae197e0e8e77f59f416ec5c1313f547
SSDEEP 192:sxRgRJC4/fe2s+ZIZHXKzoA8p9Z/g6+WNCMa/YcJXtiT4GfIgDkTJ:sxRge4/fe2sw2HXHb/54/p9iTrU
TLSH
T10342D755AD28AD7B8CCFD60DBB557F53E2F91032A0951E48A6FC8A1C14EB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6cef3b37-9494-4c8f-953a-1583994d54d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6cef3b37-9494-4c8f-953a-1583994d54d0.tmp
Size 11KB
SHA256 d999ea3a6921d5fab0ece7f398341fa5979a5b8b9a189fe2b08aec7793518876
MD5 9615a2b5f25d47e468695d597b9fc8ff
SHA1 d590ac265a93e623f066160865ca31454376c954
SHA512 d1aa013171e0fdc99714cb8df8bf4874dc22dc49797eb8b49e44a338d1a04d50b2fd997fb66f98ff8d0996477315a8170103338e3fab54bae2745cfc4f8eb13d
SSDEEP 192:sxRgRJC4/fe2sIZIZHXKzoA8p9Z/g6+WNCMa/YcqXtiT4GfIgD+TJ:sxRge4/fe2se2HXHb/54/K9iTra
TLSH
T10A42C855AD24AD7B8CCFD20DBB557F53D2F91132A0D51E48AAFC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95c6a3bd-4942-4093-8f84-72b0727f73db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95c6a3bd-4942-4093-8f84-72b0727f73db.tmp
Size 11KB
SHA256 334dd043e1fea933bac3790dc91def4f447e065a5cd58132dcae1a944abee351
MD5 8fbd62fa5e22ecea601f733db4286f84
SHA1 b46d7ccd7603d8c0ecb578205d160f1330fa49c4
SHA512 9be6b61fc556e0f4eab3a8bf3088d8fe17220c0fb38ebb3540433aebb8d80ef8ef4467665e89f487fdd9ba649f0c79df63f91302ce22e646eb3e6083c9ee31cb
SSDEEP 192:sxRrRJC4/fe2sAZIZHXKzoA8p9Z/g6+WNCMa/YcqXtiT4GfIgVTJ:sxRre4/fe2sG2HXHb/54/K9iTrv
TLSH
T19432D815AD24AD7B8CCBD20DBB557F53D2F91132A0D51E48AAFC8A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 55f7176674f98d6d774ae6dcca4f14f71ef2eec2358104ecceb0aa8175163172
MD5 8dbd19c4ce3e623c6d8147118c2047af
SHA1 b88a2d23813a54e7cb717814a7cda27122ef7061
SHA512 bc7030e84293f2501497dc5149a5c1ce0cd417071f215a2838e3434f101aaa8cdda330ff436289f3cc36da965e902430073517a5c884ab15aad329a51c08e5c7
TLSH
T1366160B848808241FF7E407DD7D09CC336B34AAB52432E612A58FF7C64463D1B25781E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 407fbc740989fe700e21458a209191ae3babff7f69e21b88e6196ac203b8d8d4
MD5 fbf38e5d7dcfb1a647f12ddcd0da7bd2
SHA1 c543c6c5b38335d48cba0ffe38987404f11c4e42
SHA512 06054c0208c90da6dc7a30e8292c933eae980c4d1776d940771d8f5373f81ff4d99db3cde8760fced0da229ac6a56a7905cd222e009b434c71e450e9fb3d5ef6
TLSH
T1A8615E7859808245FFBE407DD7D09CC336B34AAB52932E612A58FF7CA4463D1B29781E
MD5 SHA1 SHA512 TLSH

Submit Download

dc1c6e54-baf2-4422-b7e2-2547b8c0421b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dc1c6e54-baf2-4422-b7e2-2547b8c0421b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4c71a251-1850-4b88-920c-12e338d07ffc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c71a251-1850-4b88-920c-12e338d07ffc.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9bf6dd14-bcf9-4f50-8122-1f4c291b5e04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9bf6dd14-bcf9-4f50-8122-1f4c291b5e04.tmp
Size 2KB
SHA256 8d4a126374b79ffff34f57e32e802644b3880fd9a17f13620c39a6c60d7b7eb3
MD5 824c8e410576abc77e52db1e028ef34b
SHA1 6a0f55cc2b24d576635af498ecc83782fc018cf8
SHA512 7fd7b80df7cac99447dda6de40fae89e385a8ae166a18a64fd416d9ca9cc004579457ce3c974f4d33f7d721d76f7fb11e5872830479f2a821401003205a041bd
TLSH
T10F51ADF3C3E8866D890156F4AB147E2BDE2D0965832C3D9AC8E4DE1B93F2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

9eb09ebc-8e06-42e6-a365-e4ddb184acd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9eb09ebc-8e06-42e6-a365-e4ddb184acd5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ad7d583680afc752715a21f9be175bdaf033dd43633bbdc5f39448d13590d53b
MD5 4ede2ff847ea18859be65561c7c198f3
SHA1 fb789b786c0ff9ea1d46d5002825820a7a6975e8
SHA512 6f0b1c1d48f758e5d16d97f555363c37416c0c3ec7f83565c4fb6c2ddc21b5c65214d159e0583e35490f253bd35ecec0b93bb388ef6b7394100122e1939c5484
SSDEEP 48:KMLGnrFNdWTNYdIarWKVz9BWRjGoQRLHyDC9ocC4IpTM7kIakpKVg9ypRa5oj026:KsYoKRqmuZ+KqcRxSK6IiF
TLSH
T1F891A72179A70350383E3D1D52D49A6E435236A37028F93F3BE954668E6BE004DFDAED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c62ded85-2a30-4b79-9c45-01e83acdac40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c62ded85-2a30-4b79-9c45-01e83acdac40.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2997e980-63dc-4bf6-be86-296c86e64a06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2997e980-63dc-4bf6-be86-296c86e64a06.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c428635-849b-42a4-bffb-2bd1fd4ddb5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\4c428635-849b-42a4-bffb-2bd1fd4ddb5b.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

7fc7ac6c-d306-4213-85ac-0a5e80f90c72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7fc7ac6c-d306-4213-85ac-0a5e80f90c72.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ab10b1b9-6b30-4342-9746-271ffd7906c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ab10b1b9-6b30-4342-9746-271ffd7906c1.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

f3ee5269-9089-4498-8e07-0b68a88d7094.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f3ee5269-9089-4498-8e07-0b68a88d7094.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

f6c71057-3417-44ce-ab90-420a0e0ccb4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f6c71057-3417-44ce-ab90-420a0e0ccb4a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

097b693c-bff1-4afc-98ca-d6d6b494d71a.tmp

Path C:\Users\Admin\AppData\Local\Temp\097b693c-bff1-4afc-98ca-d6d6b494d71a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

143ff24f-536f-4b83-9cac-b4db94e7ef6b.tmp

Path C:\Users\Admin\AppData\Local\Temp\143ff24f-536f-4b83-9cac-b4db94e7ef6b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4340_295141725\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1068975051\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1824111104\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_460497252\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_976106362\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/264-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1184-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1936-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2512-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4152-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4152-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4704-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4984-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5508-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5748-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5748-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5948-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download