3517d20af705312c5c3efe2ea6d276a66146457f5a43fa241e2ad337536236f5

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261003-2aaplayare
SHA256 3517d20af705312c5c3efe2ea6d276a66146457f5a43fa241e2ad337536236f5
MD5 ff890587810b89409f367fc1522107ed
SHA1 33fdafc423430729b6302acee6aaa10c1bf92487
SHA512 95af09340f999ded1668b080801ef84941ef86743038dc61e0fd601d0cbf698f8c2649dfcf8d605623911ada9f70057ecf970aadc1360d302f7da8bf290d30f1
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
572	CP.exe
1956	pnhfzxrmhc.exe
5844	CP.exe
1484	CP.exe
4596	i_pnhfzxrmhc.exe
2928	pmhfzxrpjh.sys
5608	CP.exe
4224	wuomgezwrm.exe
1560	CP.exe
6088	CP.exe
3548	i_wuomgezwrm.exe
2500	rmjebwuomj.sys
3096	CP.exe
5612	mjhbzwromj.exe
4172	CP.exe
5456	CP.exe
4684	i_mjhbzwromj.exe
6108	rojgbztrlj.sys
3352	CP.exe
692	oljdbwtolg.exe
3952	CP.exe
4728	CP.exe
476	i_oljdbwtolg.exe
2568	wtgdyvtnlj.sys
4364	CP.exe
5872	ljdbvtnlgd.exe
2976	CP.exe
3724	CP.exe
1152	i_ljdbvtnlgd.exe
3452	vqoigaytql.sys
5172	CP.exe
4684	olyvqoigay.exe
4436	CP.exe
4412	CP.exe
4992	i_olyvqoigay.exe
6120	nlfdxvpnif.sys
3284	CP.exe
1516	kifaysqnid.exe
1356	CP.exe
3180	CP.exe
5604	i_kifaysqnid.exe
4212	kfcaxvpnki.sys
1420	CP.exe
5452	nkfcxvpnhf.exe
2508	CP.exe
3116	CP.exe
2944	i_nkfcxvpnhf.exe
5920	axspkicaup.sys
2264	CP.exe
4968	pnhfzxrpkh.exe
3164	CP.exe
3700	CP.exe
1888	i_pnhfzxrpkh.exe
4204	pmhfzxupnh.sys
2132	CP.exe
5140	kecwusmkeu.exe
5412	CP.exe
3404	CP.exe
2260	i_kecwusmkeu.exe
2084	hecwuomhbz.sys
1216	CP.exe
3292	ebwuomgezw.exe
2980	CP.exe
2456	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1723057318\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_2030718108\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1284981536\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_943868571\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_943868571\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_2030718108\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1284981536\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_943868571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_943868571\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aynlidayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkiaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkecauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwusmkeu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkiaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aynlidayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysqnid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkecauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwusmkeu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2656	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3036	ipconfig.exe
5064	ipconfig.exe
1052	ipconfig.exe
5372	ipconfig.exe
3464	ipconfig.exe
708	ipconfig.exe
4676	ipconfig.exe
2928	ipconfig.exe
2312	ipconfig.exe
5500	ipconfig.exe
2948	ipconfig.exe
5368	ipconfig.exe
1708	ipconfig.exe
1868	ipconfig.exe
2372	ipconfig.exe
5452	ipconfig.exe
5000	ipconfig.exe
4204	ipconfig.exe
260	ipconfig.exe
3768	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{FF67810D-62A5-4ECC-9EBE-EE8273BE338A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5652	msedge.exe
5652	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	i_pnhfzxrmhc.exe
Token: SeDebugPrivilege	3548	i_wuomgezwrm.exe
Token: SeDebugPrivilege	4684	i_mjhbzwromj.exe
Token: SeDebugPrivilege	476	i_oljdbwtolg.exe
Token: SeDebugPrivilege	1152	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	4992	i_olyvqoigay.exe
Token: SeDebugPrivilege	5604	i_kifaysqnid.exe
Token: SeDebugPrivilege	2944	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	1888	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	2260	i_kecwusmkeu.exe
Token: SeDebugPrivilege	2628	i_ebwuomgezw.exe
Token: SeDebugPrivilege	2324	i_bwtrojgebw.exe
Token: SeDebugPrivilege	2144	i_tqoigbytql.exe
Token: SeDebugPrivilege	5860	i_aynlidayvt.exe
Token: SeDebugPrivilege	932	i_gaysqkidav.exe
Token: SeDebugPrivilege	1308	i_aysqkiaxvp.exe
Token: SeDebugPrivilege	3928	i_pnhcausmke.exe
Token: SeDebugPrivilege	2152	i_xusmkecauk.exe
Token: SeDebugPrivilege	2296	i_wurmhezxrp.exe
Token: SeDebugPrivilege	4440	i_zwrpjgeywr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4208	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4208 wrote to memory of 4100	4208	iexplore.exe	90
PID 4100 wrote to memory of 464	4100	msedge.exe	91
PID 4100 wrote to memory of 5132	4100	msedge.exe	93
PID 4100 wrote to memory of 2656	4100	msedge.exe	94
PID 4100 wrote to memory of 5132	4100	msedge.exe	93
PID 4100 wrote to memory of 5132	4100	msedge.exe	93
PID 4100 wrote to memory of 1480	4100	msedge.exe	95
PID 4100 wrote to memory of 1480	4100	msedge.exe	95
PID 4100 wrote to memory of 1480	4100	msedge.exe	95
PID 4100 wrote to memory of 5480	4100	msedge.exe	96
PID 4100 wrote to memory of 5480	4100	msedge.exe	96
PID 4100 wrote to memory of 3044	4100	msedge.exe	97
PID 4100 wrote to memory of 3044	4100	msedge.exe	97
PID 4100 wrote to memory of 3044	4100	msedge.exe	97
PID 4100 wrote to memory of 248	4100	msedge.exe	98
PID 4100 wrote to memory of 260	4100	msedge.exe	99
PID 4100 wrote to memory of 248	4100	msedge.exe	98
PID 4100 wrote to memory of 248	4100	msedge.exe	98
PID 4100 wrote to memory of 260	4100	msedge.exe	99
PID 4100 wrote to memory of 260	4100	msedge.exe	99
PID 4100 wrote to memory of 1748	4100	msedge.exe	100
PID 4100 wrote to memory of 1748	4100	msedge.exe	100
PID 3148 wrote to memory of 572	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 1956 wrote to memory of 5844	1956	pnhfzxrmhc.exe	105
PID 4100 wrote to memory of 3304	4100	msedge.exe	107
PID 4100 wrote to memory of 3304	4100	msedge.exe	107
PID 4100 wrote to memory of 2944	4100	msedge.exe	108
PID 4100 wrote to memory of 2944	4100	msedge.exe	108
PID 4100 wrote to memory of 4640	4100	msedge.exe	111
PID 4100 wrote to memory of 2264	4100	msedge.exe	114
PID 4100 wrote to memory of 2264	4100	msedge.exe	114
PID 4100 wrote to memory of 5272	4100	msedge.exe	115
PID 4100 wrote to memory of 5272	4100	msedge.exe	115
PID 3148 wrote to memory of 1484	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3148 wrote to memory of 5608	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4224 wrote to memory of 1560	4224	wuomgezwrm.exe	122
PID 3148 wrote to memory of 6088	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3148 wrote to memory of 3096	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5612 wrote to memory of 4172	5612	mjhbzwromj.exe	131
PID 3148 wrote to memory of 5456	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 3148 wrote to memory of 3352	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 692 wrote to memory of 3952	692	oljdbwtolg.exe	140
PID 3148 wrote to memory of 4728	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4100 wrote to memory of 4212	4100	msedge.exe	146
PID 4100 wrote to memory of 2672	4100	msedge.exe	147
PID 4100 wrote to memory of 2704	4100	msedge.exe	148
PID 3148 wrote to memory of 4364	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5872 wrote to memory of 2976	5872	ljdbvtnlgd.exe	153
PID 3148 wrote to memory of 3724	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 3148 wrote to memory of 5172	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4684 wrote to memory of 4436	4684	olyvqoigay.exe	162
PID 3148 wrote to memory of 4412	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3148 wrote to memory of 3284	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 1516 wrote to memory of 1356	1516	kifaysqnid.exe	171
PID 3148 wrote to memory of 3180	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 3148 wrote to memory of 1420	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5452 wrote to memory of 2508	5452	nkfcxvpnhf.exe	180
PID 3148 wrote to memory of 3116	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4100 wrote to memory of 3796	4100	msedge.exe	185
PID 4100 wrote to memory of 3796	4100	msedge.exe	185
PID 3148 wrote to memory of 2264	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4968 wrote to memory of 3164	4968	pnhfzxrpkh.exe	193
PID 3148 wrote to memory of 3700	3148	2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-03_ff890587810b89409f367fc1522107ed_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7fff65cec188,0x7fff65cec194,0x7fff65cec1a0
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,5219473898015024637,12300436039792158084,262144 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:2
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,14838993007900204714,11528724765037557731,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:11
      4⤵
      System Time Discovery
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,13294171800406893174,13147957038777720784,2097152 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,8682252400256096123,15909813006162477839,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:13
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3344,i,4649304876936248947,14712319640377766881,2097152 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11170445164935648831,1735166295680035503,2097152 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3601857185488464981,1745334496687149647,2097152 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,12243265743854249613,4096243874037885565,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,8456089981645089571,3119358595613334478,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,10408636616603322469,6625379420223823122,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10513438542795613432,12527367318408892662,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,10513438542795613432,12527367318408892662,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,12770927885206841080,16198910869006983430,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15909073352723251376,10886931722419109204,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1248,i,12757367347790988025,2926267758722240666,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1336,i,9811440634773936996,7133842428372108829,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,16078531028916981441,17827800966833012146,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2263468345489539983,2700915481317181549,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,4506335609697628184,11643327710805865032,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,10315238899274754294,17327351772399186813,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,13736279965137779688,113697642823815810,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6004,i,1689673306560957942,9821413997646558867,262144 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,12141750999211077514,5317558039316249711,524288 --field-trial-handle=2748,i,18102585031817470153,8084781599443821176,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:572
- - C:\Temp\pnhfzxrmhc.exe
    C:\Temp\pnhfzxrmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1484
- - C:\Temp\i_pnhfzxrmhc.exe
    C:\Temp\i_pnhfzxrmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5608
- - C:\Temp\wuomgezwrm.exe
    C:\Temp\wuomgezwrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_wuomgezwrm.exe
    C:\Temp\i_wuomgezwrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzwromj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3096
- - C:\Temp\mjhbzwromj.exe
    C:\Temp\mjhbzwromj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzwromj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5456
- - C:\Temp\i_mjhbzwromj.exe
    C:\Temp\i_mjhbzwromj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljdbwtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\oljdbwtolg.exe
    C:\Temp\oljdbwtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljdbwtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Temp\i_oljdbwtolg.exe
    C:\Temp\i_oljdbwtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3724
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olyvqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5172
- - C:\Temp\olyvqoigay.exe
    C:\Temp\olyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olyvqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4412
- - C:\Temp\i_olyvqoigay.exe
    C:\Temp\i_olyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaysqnid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3284
- - C:\Temp\kifaysqnid.exe
    C:\Temp\kifaysqnid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaysqnid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3180
- - C:\Temp\i_kifaysqnid.exe
    C:\Temp\i_kifaysqnid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3116
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3700
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwusmkeu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\kecwusmkeu.exe
    C:\Temp\kecwusmkeu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwusmkeu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\i_kecwusmkeu.exe
    C:\Temp\i_kecwusmkeu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1216
- - C:\Temp\ebwuomgezw.exe
    C:\Temp\ebwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Temp\i_ebwuomgezw.exe
    C:\Temp\i_ebwuomgezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtrojgebw.exe ups_run
  2⤵
  PID:2928
- - C:\Temp\bwtrojgebw.exe
    C:\Temp\bwtrojgebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtrojgebw.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_bwtrojgebw.exe
    C:\Temp\i_bwtrojgebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqoigbytql.exe ups_run
  2⤵
  PID:2320
- - C:\Temp\tqoigbytql.exe
    C:\Temp\tqoigbytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqoigbytql.exe ups_ins
  2⤵
  PID:1744
- - C:\Temp\i_tqoigbytql.exe
    C:\Temp\i_tqoigbytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aynlidayvt.exe ups_run
  2⤵
  PID:2408
- - C:\Temp\aynlidayvt.exe
    C:\Temp\aynlidayvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aynlidayvt.exe ups_ins
  2⤵
  PID:3532
- - C:\Temp\i_aynlidayvt.exe
    C:\Temp\i_aynlidayvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  PID:3196
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
  2⤵
  PID:2260
- - C:\Temp\i_gaysqkidav.exe
    C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkiaxvp.exe ups_run
  2⤵
  PID:1984
- - C:\Temp\aysqkiaxvp.exe
    C:\Temp\aysqkiaxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkiaxvp.exe ups_ins
  2⤵
  PID:5124
- - C:\Temp\i_aysqkiaxvp.exe
    C:\Temp\i_aysqkiaxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhcausmke.exe ups_run
  2⤵
  PID:2448
- - C:\Temp\pnhcausmke.exe
    C:\Temp\pnhcausmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhcausmke.exe ups_ins
  2⤵
  PID:1076
- - C:\Temp\i_pnhcausmke.exe
    C:\Temp\i_pnhcausmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkecauk.exe ups_run
  2⤵
  PID:4592
- - C:\Temp\xusmkecauk.exe
    C:\Temp\xusmkecauk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkecauk.exe ups_ins
  2⤵
  PID:3400
- - C:\Temp\i_xusmkecauk.exe
    C:\Temp\i_xusmkecauk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurmhezxrp.exe ups_run
  2⤵
  PID:4988
- - C:\Temp\wurmhezxrp.exe
    C:\Temp\wurmhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurmhezxrp.exe ups_ins
  2⤵
  PID:5112
- - C:\Temp\i_wurmhezxrp.exe
    C:\Temp\i_wurmhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjgeywr.exe ups_run
  2⤵
  PID:3036
- - C:\Temp\zwrpjgeywr.exe
    C:\Temp\zwrpjgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjgeywr.exe ups_ins
  2⤵
  PID:4380
- - C:\Temp\i_zwrpjgeywr.exe
    C:\Temp\i_zwrpjgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5980

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Temp\rmjebwuomj.sys
C:\Temp\rmjebwuomj.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\rojgbztrlj.sys
C:\Temp\rojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:6108

C:\Temp\wtgdyvtnlj.sys
C:\Temp\wtgdyvtnlj.sys
1⤵
- Executes dropped EXE
PID:2568

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
- Executes dropped EXE
PID:3452

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:6120

C:\Temp\kfcaxvpnki.sys
C:\Temp\kfcaxvpnki.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\axspkicaup.sys
C:\Temp\axspkicaup.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\pmhfzxupnh.sys
C:\Temp\pmhfzxupnh.sys
1⤵
- Executes dropped EXE
PID:4204

C:\Temp\hecwuomhbz.sys
C:\Temp\hecwuomhbz.sys
1⤵
- Executes dropped EXE
PID:2084

C:\Temp\gebwuomgez.sys
C:\Temp\gebwuomgez.sys
1⤵
PID:3036

C:\Temp\rljgbztroj.sys
C:\Temp\rljgbztroj.sys
1⤵
PID:4188

C:\Temp\aywqoigdbv.sys
C:\Temp\aywqoigdbv.sys
1⤵
PID:6116

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
PID:1344

C:\Temp\caysqkicav.sys
C:\Temp\caysqkicav.sys
1⤵
PID:5404

C:\Temp\causqkiusm.sys
C:\Temp\causqkiusm.sys
1⤵
PID:4380

C:\Temp\xusnkecxus.sys
C:\Temp\xusnkecxus.sys
1⤵
PID:4112

C:\Temp\wurpjhbzxu.sys
C:\Temp\wurpjhbzxu.sys
1⤵
PID:3336

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 226KB
SHA256 0b46bcf422748c3a76b4e51bfcf65e0ca12c96cda4688f13df7c1717700e96d5
MD5 4b37c4b740a6a0f9f069f1af0a0333f0
SHA1 456a85657901c123b7e24aed01f3c031aaa66fe9
SHA512 94b4f7f1c800627c8c4b7e96b12b31da7d731022d002516584b2fc535d5f7829762625307244684c0c4579864b78a298d1e9fd032941f871164a2e589b08637f
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T18634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhbzwromj.exe

Path C:\Temp\i_mjhbzwromj.exe
Size 226KB
SHA256 8c22d1d5d95b7237212a8cc09c7ae427f1feda95311ef1cbdb37416a2e6ff0cc
MD5 50c84b1ac0a230fb1dc926899980df23
SHA1 f6b79d5a000a4f8240831e0d9e4d995c3681a31b
SHA512 fa7fc3c25d842502fcf73530bb9de3554901283435c3f92d0c797786d8a5b689ba10cade9ecd7fa00067be1f1db38721c577ee348954b143c2fa1a4ed7a431bc
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1B934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljdbwtolg.exe

Path C:\Temp\i_oljdbwtolg.exe
Size 226KB
SHA256 eb00debd2635d56b9908c9f234c63fe7d45aa72d0ec937004cd8d6aa4b6833cf
MD5 b3e9c660a5130318807fac44c89e9171
SHA1 774b16e2a5354a22e58ebe439bf33c1354be1d8d
SHA512 f3614e503d6a80ef2d51a825ca1daf4b37de8fd00b9ef6e4639ca2dc6f0fb98e74661ca652cfc574141b27e845f92dd3ced6bfd2e4044636a79c7819da4dd49b
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1D034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olyvqoigay.exe

Path C:\Temp\i_olyvqoigay.exe
Size 226KB
SHA256 ce24896ecd6b0f937b2ec8a87a4e3347176eb1abac732d126cbb889ab4c1243b
MD5 71d8c28e537e668d2ebb7a181c476713
SHA1 199bf075fa1b8a518b4f86ba2a0cc9c7e666039f
SHA512 22a9cd1a4ca3fcb14814aa3765eaedd19f30ebfb4d2f6cf5108261a1a680bac6ceee1d023897886b3da0cdb0abc7d15538b1003a1d01112dd7670319c9e5aac2
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxrmhc.exe

Path C:\Temp\i_pnhfzxrmhc.exe
Size 226KB
SHA256 9f1fb66253cb6e38fe89858ee9223924f62f6e88217997e7d6de04fb303a8556
MD5 e40de60cf8cbb72149dc1327bec4c607
SHA1 f364a43a4e6fe12045b085697ae055175a16859c
SHA512 42b5a90fce1b630bd31973ca747351d372542fa14a7ed6d027566994e71873df3bf2f12fbb32c77d8c9bbb101bd3364f013b713d77e8b4dc752355c2c856e276
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwrm.exe

Path C:\Temp\i_wuomgezwrm.exe
Size 226KB
SHA256 8a2defe41eb529edf5332d21ee2639609029ddac1adc1b859656fa7bed186c7a
MD5 a4286c0feecd8e78584b020a5254effd
SHA1 07e185ab79e77661cbb4757015bf1b51a6fbca40
SHA512 4424e71977dfb2802df28011a36633d36cf605c83166bc4b69fcd4990ebf06ed0e4309229dd8ae5e61e7aadc7edaf09d0ace7724506b1e95c7714d3ce76526ca
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1E834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 226KB
SHA256 cd198102c1237875b47f6f6d76a4d5d76a6f190a8f8b555fc2adce4ca9ff7b25
MD5 889e4e8e2eed752719051a8fc43318f2
SHA1 00b3665e628f11f2bdff803f9e07fdbd38c7b84e
SHA512 d544488e8aceab8a48f6c982d5ba4e76ff287b231d19f856a3ba331734eadfb6c4dce2d661749705a29fd464d2f6399ef41e5b58d96928b9d324e7a765e9a9d7
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T19B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbzwromj.exe

Path C:\Temp\mjhbzwromj.exe
Size 226KB
SHA256 7ecd84331427359eff02da3dbf8d4d46dc0f2ffeb7f290264a56069d97e32068
MD5 c7a2ade552dfc90e2b3948647dd31845
SHA1 c53bfb3b1ee392d692537a4506042e89e6b71f8e
SHA512 ebc710098dba882af567ee4dfe1542c694c2f8adce758a551b1459d9f9dadfbeab4f3909cf722e94d46686e0092c05dede5b4ac203527715af468bc157c26aea
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvpnif.sys

Path C:\Temp\nlfdxvpnif.sys
Size 141KB
SHA256 354aa717f9f415bca767d113bdab12173d9c07cc67e89f172fe7fce3acc7af36
MD5 0f99f8ff3be7015dedc0a7703deafc78
SHA1 a2631999ef3f1518f71085d21e6dd8e05cd35708
SHA512 3f8ef2156ddfcece5d49bf632393c1bfbcf8ec2335e82066911688cac0201782c4d9f3140788563ed12e1b5924b547b31af90fb06444a4a9eca6f9496e196103
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbwtolg.exe

Path C:\Temp\oljdbwtolg.exe
Size 226KB
SHA256 8c152247595c1dbc98bcde43b118ab1a875c2a4dc986fa1cef2845029032f291
MD5 cbbaa3c4a1840037261615bf05bb7d71
SHA1 704b007296b2494ebff88075715df258cd8e6bd8
SHA512 ea95d86ed97d658eb9b4f42a977578bf7a41e1f10afc226650219ce482e2f0ed81545f05f64df6f10502aefe92ca9d6e0a6f38a28ff38e5e8c236c749941c09e
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olyvqoigay.exe

Path C:\Temp\olyvqoigay.exe
Size 226KB
SHA256 13d64e1ff3c7e598a3d21bdb61117e1fbbe8527cad6b166dbfb96ec18e2fc7fd
MD5 cd6e21c330b1ee2e8a8a560b77e42577
SHA1 d646de3fb9f9b1e1f99812f804eb490947cfd969
SHA512 bec7ed1a31f91934f358ee88af5e9f87bfb88a4aabb5af589e85278138169559a42b3eba09b3f97e47e161d268095424b2ab2904e6f7effbe7fad59c43db2896
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 5e4c701c0e409ac272716bf4a118604f12640489cc75de74c6b9c8e81ad43852
MD5 e342fdfe53b40ea56306fb367117d0f4
SHA1 8fe946740798e1e916532bcbb5af88283c7d14f7
SHA512 2ff4b9945976f16c3b6e7b325afee155e7b8d16fc48008e1f3e586fcb898319a241e1849a4f701baff750dca27aa939f87a86c881a17206e148ae1dc70512b94
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T141E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrmhc.exe

Path C:\Temp\pnhfzxrmhc.exe
Size 226KB
SHA256 8a3daac983f26f94a188c13f4387695a2f9d5d12f0f2e6070263deea7933a3db
MD5 49aa9a8ab1624ead9fcfafda6d1af2a9
SHA1 932fc4e66bf41f118383c6c3cd11fcdd0bfdf5e8
SHA512 263be0961b8cb2d927d8ed2ae461f3412192758bad44ece5068b5cbe12ecd96e22c4678293acb895047aa0c691b74d8852b59b2121bbf04e1d7de7017d9cdee1
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebwuomj.sys

Path C:\Temp\rmjebwuomj.sys
Size 141KB
SHA256 ccebb0d1a86a933108feccd66690c678d85af3f738a9f5ff60909b2958eb4ac5
MD5 01ff6d50cc1df3d3ddbba2b1e38c1092
SHA1 39ed19970de9d1663adf3ace467eabd323a27d52
SHA512 337f64310f3fd9b459aab5309616e1ed96a0639d9945f4507cf0d91586b6c4ca6d2dfeceab5b5c3054fdf216a1b3f2f8d8a7a6652d457e415ee9ea5e22eef272
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EBE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbztrlj.sys

Path C:\Temp\rojgbztrlj.sys
Size 141KB
SHA256 0d29f70fc7f374fafc20f2fabe17a7b61dfb42e897148c544c3172e2ae42ff96
MD5 e481e6e6b8e260760249bdfb4ad6aa86
SHA1 46ed852a07a489f4ad438052244b8e4b40182c2a
SHA512 affd892fa9bc1fe47e74714a3583149b68839bc646d0f7e38d2da694fd186c482365a908efc81160afca30e949b3feb2dd1f4491fa85ce75b5b6f1627ace8c27
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytql.sys

Path C:\Temp\vqoigaytql.sys
Size 141KB
SHA256 c45733d2bfdb4218684966f7227b80bf3c534d52cb1fdae5385aea65963bcea7
MD5 9cba78322566060a4fff93719fc4574c
SHA1 75ac9ca6e724261b80faedd174ba982b928a397b
SHA512 708000840c557ddd81dd5446076fa3471ed9d0107a8bc1275537d9b648b66302035d790f7cba6762fddd66145fb47d9adda59d7928e5e76f1cce542af07fce1a
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtgdyvtnlj.sys

Path C:\Temp\wtgdyvtnlj.sys
Size 141KB
SHA256 a51fe6ea52871fe1a13724057db35b161420b0363e1fb7e7a0acde3b6a567966
MD5 5bd6cda3f8679940022fe1f0a9663620
SHA1 45baa82368d33a1c2e246d1afd52506859cb0b9f
SHA512 35504506b9143cca72b2a806d4406eaca87e4507771c518e3ad04ae1fa8acaf140d4d85daac132e543e42faf7076935f799b9d118eb680133773675a63c4c8f4
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrm.exe

Path C:\Temp\wuomgezwrm.exe
Size 226KB
SHA256 7623e9e62096b3c33ee6f8906fe9cd95d1863b47b4528b674b6baaf2588f122a
MD5 1dad7b41ebf7364f9461169fc95b2927
SHA1 7732f40d5a883767858ffbee922ff3b87143db88
SHA512 08f845333f394089292e34094112accb538b1c29a5b675ae255cba487dda7d3f0acda19d0fd8d0ba1cd0d0e9e5c2ace92315741bff454fb6344abd098f95d6b4
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1C434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ccb1ff7-436b-4828-b01b-0e2572264a3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ccb1ff7-436b-4828-b01b-0e2572264a3c.tmp
Size 42KB
SHA256 cab7191b18928a3a529116812bb5085116f61d6b9ec1ecec1ab0708a0c72b919
MD5 37431cd9435cd7870f7e0889e403cfc2
SHA1 f0c8f3d31e04e8949a5931bbfa87ec0bf4f8f306
SHA512 f4009623cafcb916be366ba77da52bc57eb108485f7e8f93928911fc8ee36784dd4de7f63d8b02a997aa950600e8caa0c9e959e6fbec7a552e0e891cc75c8cee
SSDEEP 768:ZFQd3Zwgc8ePglajkKvtyPSnqMwQi5BgK5/CwYcZx2sXK:Yd3ZsaPSVmBg8/dr2sXK
TLSH
T17E1329F598E38AB7D8AD4743A77D6E469EBCD163B4884484B7C55D0CCC825BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45f25e1a-6205-477f-92e6-f801a2e00c21.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45f25e1a-6205-477f-92e6-f801a2e00c21.tmp
Size 38KB
SHA256 357bcf62eee12c49cb197b277ec77669ed0431a8753a3454172dc40cbf5e44a9
MD5 2a6f4b5e8c76233e7125ac65f60a95a5
SHA1 84725acdbca34c0a76722f4e5854c9fcc4ce21b7
SHA512 10a11c1891ba46d980e855ddb737a044b84c0a6d2b97a756f775b8073f410868902a5d3c4d0bb85411f4e95b231e9e53d39ba19ebbce8c3304c4a36466414d8b
SSDEEP 768:j/UxvxjgC+E33/PSFajkKvtyfnqMwQi5BgK5/CwYcZxKEl:2Zj3+E33FafVmBg8/drLl
TLSH
T12A03BE35B8B59DB34CF9A204B68A37C7EFF06573C88408A885DA5E0E45876EE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

557e9bcd-dd34-4df6-9c2e-bbe2a0bf1409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\557e9bcd-dd34-4df6-9c2e-bbe2a0bf1409.tmp
Size 33KB
SHA256 4e04c1b0b3b91f9e81147a81472721aeee507e5885acc5e4dda90a7c4eec6fe0
MD5 19d98efe311ab6d9a1e5ce7558ffb235
SHA1 7472ba54e9b27897f5529adba97987e0acd76a3c
SHA512 1dcb61b052a94445170b3cffc2a1ac6fbcbbe6ecfcd3de75933d7f5c645a86aca92128e0827b2ab45a6eac0ddbdddac48b40898608d24144e84d04f9ad8af9e7
SSDEEP 768:/p3t8QPSFajkKvty1nqMwQi5BgK5/CwYcZx2sXK:/p3Ska1VmBg8/dr2sXK
TLSH
T1B9F2BE31ECB58EF70CF99144B2867786AFF46163C8984948C4DA9B0E05879EE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be113961-5319-4e9d-80fa-0d7a4130563a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\be113961-5319-4e9d-80fa-0d7a4130563a.tmp
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

3e4ac384-d73f-4016-9949-d7625da0e256.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e4ac384-d73f-4016-9949-d7625da0e256.tmp
Size 11KB
SHA256 7f8c1c3e2cce46e8a2bd9f8206d46b82d48863e14e44c20b3b8278d1877eb220
MD5 4d158c8e2ea1d40c9f722cb1f54c418d
SHA1 e848f56fefdf122f4106d64417013778f15a7107
SHA512 f3d3a42809858840df6b0e466e961c6753e34f4755aec9baed3dff365fe25ba7760dd6b206c50ff338928782023bd30f2345fc61e41fa7ddf4164bbf8cbb8987
SSDEEP 192:sxRhRICm/fDsBoZ61TYPzoA8p96/g6+WNCBH/YlaclSGIIgDARJ:sxRhVm/fDsBWsTYmg/5M/BS
TLSH
T17942C855AD28AD7B4CD7E61DBA657F53D3F95032A0D41E48A6FC8A1C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

681fe6bc-f80b-4fda-b0d2-4e0a82f31773.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\681fe6bc-f80b-4fda-b0d2-4e0a82f31773.tmp
Size 12KB
SHA256 b5077a2accb7b4551e471bb742d07e7e06263dc4c51fc0d0444acf28595125fd
MD5 bc53d1bcd20fa4279675bfca986b556a
SHA1 bdb7fa0882f7b718860e6751cf1e77a8949fb88f
SHA512 b5eccaeb14ea8efed069241e764bd4538ceba980c5dc3b9908e23a19ebd1e945b033d29edebdddb25186df8beda4eb061c07d57f16a5e457b1f09b1280213645
SSDEEP 192:sxRhRICm/fDseoZ61TYPzoA8p96/g6+WNCBH/YlacGSGIIgDSRJ:sxRhVm/fDseWsTYmg/5M/Ig
TLSH
T1FB42C855AD28AD7B4CD7E61DBA657F53E3F95032A0841E48A6FCCA1C04E76CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8494e54b-558c-40e2-94f2-42d8f2796817.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8494e54b-558c-40e2-94f2-42d8f2796817.tmp
Size 11KB
SHA256 78b5617318ed3fcd747be316a9db6dd6b69eca834575a4fe458c7c035e212c8f
MD5 4a3eb004a12bbf64ab43ba8369a3dcc8
SHA1 7bcc06115bf21394400a8edabe4b37fc8bf62bf8
SHA512 9aacae788277ff0ccc7b38bd7158f516b262eefa97a9d9613b6c10dc78f2707c440d824c39dd22d3df63e763d09dadc95ddfb6f2ac8a8eac4d6eef7a6540fa42
SSDEEP 192:sxRaRICm/fDs2oZ61TYPzoA8p96/g6+WNCBH/YlaclSGIIgVRJ:sxRaVm/fDs2WsTYmg/5M/BN
TLSH
T13342C855AD28AD7B4CD7E21DBA657F53D3F95032A0D41E48AAFC8A1C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 0044a90afbc41dcfc70b373869e9bd852d9f95b515d8aa23abd0223d19e18018
MD5 3d4172cf1ad30e1b9a41fd71281d47e7
SHA1 fdbfeb10bdd51becbfd4ac12fc09bea6663937ea
SHA512 6bbd3c085e7259d86894481cd7139758a8441433f71b33ed0749419d4e1e1fd1064c99675cdbbaac4685ec66e5dd569c0c3a84596acaa7a28873ad27f30396e7
TLSH
T1AA515E8C8D434E8CE3A8FB72DDE130CF3A2063B8B5C31E4E3065D47877A6748618421A
MD5 SHA1 SHA512 TLSH

Submit Download

27194e1c-3552-4ea8-8784-5d3f877c7b9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\27194e1c-3552-4ea8-8784-5d3f877c7b9e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2f656fe0-ecf8-494f-95ab-cb1b5e49ce5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f656fe0-ecf8-494f-95ab-cb1b5e49ce5a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

351487b3-295c-4f67-a42d-0f67e5b56ad5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\351487b3-295c-4f67-a42d-0f67e5b56ad5.tmp
Size 2KB
SHA256 1cef5a75e47cf34e343f4fc3cd89678a6e4ed5639a2f38dfd027208e6d149ec0
MD5 e57b84259028afb2eeec9a8179d00c0e
SHA1 bd520dfa697a387f190db638a456e1779f3e26c8
SHA512 c993e84f8690e7fa22e44c6479894a015cf976c3a7c167b4d40b30542fc970ef1c9d06eac1fb34b8699a55282bbf0726d7abc925ea55ebd4125704afb06c792b
TLSH
T12A51CFF3C2E8C66D890156F4AB186E1BCE2D0914832C7D5AC8E4EF1B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

6241037c-8631-43b7-b53f-22ff3d632e52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6241037c-8631-43b7-b53f-22ff3d632e52.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 af19acabc18ae1d94c9e2657b02ae95410ad808aafbba4f5a07bf44975eed7e6
MD5 9756c7a20f070645b018e1f1966c1ecf
SHA1 e8115226f4bc49adb0932511491bf9fac75537d8
SHA512 0a86f535fbed3d18ac0c8e0ffe40a71f8130a72d70070219332d3dc2a39e6babb3380f88b34424aaea44bbde549078fb7e0df2146508678ff76d88980ca04488
SSDEEP 48:K010JF3jXYbLuLISdYK991vYxdIY+vF1yL5IVpz3Lkb3SPISBkK9B1rkxJ0Yyzrg:KUGsKzSmSycK3q0nCKEI6MYxCmgm
TLSH
T15D919010B0BB060039BD6A5C51A8876B469132B37459B9BFBFB900559D2FE098DFDDCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a91064e2-bf30-469a-9a76-1c6158135af9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a91064e2-bf30-469a-9a76-1c6158135af9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c4e0ad0c-066b-469e-a5f5-d9d0e1125c9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4e0ad0c-066b-469e-a5f5-d9d0e1125c9b.tmp
Size 29KB
SHA256 65e1b0ec9c2154e1889df3e7eec3fb9b1686b86a3fdeebae39dc780c70d7da83
MD5 febbb1ef7ae99b2471100565c55c2151
SHA1 a2bd9b1e481eacf5120468478bb8650667d45a22
SHA512 9a6bdd82c8ec95afc5244c121959ee074dea10aabbc16f15d1d3278d5ec52d0ffafdcbe50ca36e26d2aafaefcb7e95e3b5fd371322f8e68c9d95879ed79a09db
SSDEEP 768:ksRdxG7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVq+p2+gIroe2IiC:ksRdxmEb0JWgSwffTu1jaZ+prgze2XHi
TLSH
T10ED2D97B680CCB7F4F814ADD9C197A9B6DAC02CB9698CD8047FE841C02C67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2e26602-8fff-4d90-b773-816e0feb7bd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2e26602-8fff-4d90-b773-816e0feb7bd0.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1aaacdc1-74a8-412a-8cf1-10d71debaabd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1aaacdc1-74a8-412a-8cf1-10d71debaabd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

bee5433f-3b6d-4c88-9275-cd06acd28371.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bee5433f-3b6d-4c88-9275-cd06acd28371.tmp
Size 37KB
SHA256 12a02b7f6d06a2cf3c57f7320e14c72d02ae6be0cd045a2360fe0c7885b3db7c
MD5 522d5c3b4b72de4b8382fba1e5832532
SHA1 73bc704fb755bcc08f257975b3dd8f6fa35110cf
SHA512 4596809ee3984973801f926e111fd45c1b90945d7854b0879402aecf51432471538e68fe3f0291bd7aa6604a98e01086180cc234751026f9e02f557fda729989
SSDEEP 768:O/UxvxjgC+Ft3EzbSFajkknqMwQi5BgK5/CwYcl4A8Dea:DZj3+Ft3EdrVmBg8/dSA8Sa
TLSH
T1AC03D036ECB49EB78CFA9644764A638BEFF45163C484089885EE1E0E06D79EC530BC57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

616b564b-7d77-410e-a6f6-eebbe709d8ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\616b564b-7d77-410e-a6f6-eebbe709d8ce.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

81cc16bd-69d0-4975-a0fe-e55f3dd04c98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\81cc16bd-69d0-4975-a0fe-e55f3dd04c98.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

dfd5360f-3f17-436f-a5e1-12f5fb83d24d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dfd5360f-3f17-436f-a5e1-12f5fb83d24d.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d5519c83-ed6d-4926-9434-2cdd58e953a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5519c83-ed6d-4926-9434-2cdd58e953a9.tmp
Size 33KB
SHA256 a6ea1131e20c58975704afe6b9d6f5d194b30bf3d06b774583136512d39d4525
MD5 33c12beaa604efa199ed569d522b60f4
SHA1 4ec6861f71bee9555f431fb04ebc022a2ecff954
SHA512 90debac93dba413468e1841a4893dff37ed45cdaee8074ad67d0a651428333a832f3753e4bab86c3f95bf1c163abf1639fb755975421b9806e338dc975274a7c
SSDEEP 768:Cp3y8QPSFajkKvty1nqMwQi5BgK5/CwYcZx2sXK:Cp3Xka1VmBg8/dr2sXK
TLSH
T193F2BE31ECB5CEF74CF99144B2867786AFF46167C8980948C4DA9B0E45879EE130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7196d33-b32f-44c5-a072-b0e5fe7156e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d7196d33-b32f-44c5-a072-b0e5fe7156e1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5d7b7e60-3312-49c2-a96e-8680cac0e0d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\5d7b7e60-3312-49c2-a96e-8680cac0e0d1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

9787f034-2995-407f-807f-f9a2d4a2d4a4.tmp

Path C:\Users\Admin\AppData\Local\Temp\9787f034-2995-407f-807f-f9a2d4a2d4a4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4100_1153695264\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1284981536\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_1723057318\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_2030718108\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4100_943868571\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2084-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-239-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2568-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2928-190-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3336-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3452-289-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3620-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4204-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4212-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5404-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6108-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6116-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6120-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download