a730c7012d9af25d449bc8244f94f8fae20d5888ad4a10b883b15586035e42f0

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261006-21ljsayvbw
SHA256 a730c7012d9af25d449bc8244f94f8fae20d5888ad4a10b883b15586035e42f0
MD5 6499ae838b3a681eb5843ce840f6ab3e
SHA1 9030d5a85871e391104f674e97ecda1fc2094719
SHA512 06436922fe0080647f1d64e7c95b6d62fb32da8655b2d2687934fe34d618b19f8f44ef22a09dd0c5f72a2c915e2fc7af7d25db46196842c1216c34392f1f78b1
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3256	CP.exe
5064	nlxvqnigav.exe
4432	CP.exe
700	CP.exe
1004	i_nlxvqnigav.exe
5592	pnlfdavsqk.sys
5696	CP.exe
4856	nlidavpnif.exe
5896	CP.exe
5868	CP.exe
1140	i_nlidavpnif.exe
5236	kfdxvpnhfa.sys
1100	CP.exe
5384	axspkicaxs.exe
1180	CP.exe
2440	CP.exe
3248	i_axspkicaxs.exe
4520	usmkecwusm.sys
5776	CP.exe
2904	usmkhczxrp.exe
1124	CP.exe
2324	CP.exe
5592	i_usmkhczxrp.exe
1932	jhczxupmhf.sys
4192	CP.exe
4024	trmhecwrpm.exe
3848	CP.exe
5400	CP.exe
1884	i_trmhecwrpm.exe
4280	ecwuomhezw.sys
5716	CP.exe
5828	ezwurmjgeb.exe
708	CP.exe
1616	CP.exe
4792	i_ezwurmjgeb.exe
1976	rojgeywuom.sys
3008	CP.exe
6044	qomgebztqo.exe
2712	CP.exe
5688	CP.exe
5108	i_qomgebztqo.exe
4820	wqoigaytql.sys
2676	CP.exe
556	ytrljdbvtr.exe
5684	CP.exe
2952	CP.exe
5736	i_ytrljdbvtr.exe
1376	lgeywqoigd.sys
5236	CP.exe
3684	aysqlidbvt.exe
5088	CP.exe
3520	CP.exe
5264	i_aysqlidbvt.exe
4816	idavtqlifa.sys
3760	CP.exe
5664	igdyvtnlfd.exe
5072	CP.exe
4180	CP.exe
4252	i_igdyvtnlfd.exe
1764	sqkicausnk.sys
4756	CP.exe
3000	qkicausnkf.exe
2504	CP.exe
936	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1932986371\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1106289118\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1106289118\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1932986371\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1962630423\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_758108763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_758108763\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1932986371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1932986371\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmhecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjebzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgebwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlxvqnigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczuspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zukecxupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgebztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlxvqnigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgebztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgebwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zukecxupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjebzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmjgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmjgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmhecwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4972	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4796	ipconfig.exe
608	ipconfig.exe
2800	ipconfig.exe
5232	ipconfig.exe
564	ipconfig.exe
6052	ipconfig.exe
2504	ipconfig.exe
4796	ipconfig.exe
3148	ipconfig.exe
5000	ipconfig.exe
472	ipconfig.exe
880	ipconfig.exe
4788	ipconfig.exe
2212	ipconfig.exe
2616	ipconfig.exe
5020	ipconfig.exe
4688	ipconfig.exe
3076	ipconfig.exe
4360	ipconfig.exe
4308	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{08638248-04D4-4FEF-AFF8-6D1BBE205657}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe
5164	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	i_nlxvqnigav.exe
Token: SeDebugPrivilege	1140	i_nlidavpnif.exe
Token: SeDebugPrivilege	3248	i_axspkicaxs.exe
Token: SeDebugPrivilege	5592	i_usmkhczxrp.exe
Token: SeDebugPrivilege	1884	i_trmhecwrpm.exe
Token: SeDebugPrivilege	4792	i_ezwurmjgeb.exe
Token: SeDebugPrivilege	5108	i_qomgebztqo.exe
Token: SeDebugPrivilege	5736	i_ytrljdbvtr.exe
Token: SeDebugPrivilege	5264	i_aysqlidbvt.exe
Token: SeDebugPrivilege	4252	i_igdyvtnlfd.exe
Token: SeDebugPrivilege	2088	i_qkicausnkf.exe
Token: SeDebugPrivilege	2772	i_mkhczuspki.exe
Token: SeDebugPrivilege	4820	i_zukecxupjh.exe
Token: SeDebugPrivilege	4592	i_urmkecwurp.exe
Token: SeDebugPrivilege	2308	i_uomjebzwro.exe
Token: SeDebugPrivilege	1104	i_wtolgebwqo.exe
Token: SeDebugPrivilege	2624	i_jgbytqoljd.exe
Token: SeDebugPrivilege	5044	i_igayvqoiga.exe
Token: SeDebugPrivilege	4636	i_ifaxvpnifa.exe
Token: SeDebugPrivilege	4868	i_mkhfzxvpnk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5164	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1096	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 1096 wrote to memory of 5164	1096	iexplore.exe	91
PID 5164 wrote to memory of 4560	5164	msedge.exe	92
PID 5164 wrote to memory of 4972	5164	msedge.exe	93
PID 5164 wrote to memory of 2748	5164	msedge.exe	94
PID 5164 wrote to memory of 2748	5164	msedge.exe	94
PID 5164 wrote to memory of 2748	5164	msedge.exe	94
PID 5164 wrote to memory of 1820	5164	msedge.exe	95
PID 5164 wrote to memory of 1820	5164	msedge.exe	95
PID 5164 wrote to memory of 3508	5164	msedge.exe	97
PID 5164 wrote to memory of 3508	5164	msedge.exe	97
PID 5164 wrote to memory of 3508	5164	msedge.exe	97
PID 5164 wrote to memory of 2160	5164	msedge.exe	98
PID 5164 wrote to memory of 2160	5164	msedge.exe	98
PID 5164 wrote to memory of 2160	5164	msedge.exe	98
PID 5164 wrote to memory of 5852	5164	msedge.exe	99
PID 5164 wrote to memory of 5852	5164	msedge.exe	99
PID 5164 wrote to memory of 5852	5164	msedge.exe	99
PID 5164 wrote to memory of 4420	5164	msedge.exe	100
PID 5164 wrote to memory of 4420	5164	msedge.exe	100
PID 5164 wrote to memory of 4420	5164	msedge.exe	100
PID 5164 wrote to memory of 2132	5164	msedge.exe	102
PID 5164 wrote to memory of 2132	5164	msedge.exe	102
PID 5164 wrote to memory of 5076	5164	msedge.exe	103
PID 5164 wrote to memory of 5076	5164	msedge.exe	103
PID 5164 wrote to memory of 5932	5164	msedge.exe	104
PID 5164 wrote to memory of 5932	5164	msedge.exe	104
PID 1324 wrote to memory of 3256	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 5164 wrote to memory of 2608	5164	msedge.exe	108
PID 5064 wrote to memory of 4432	5064	nlxvqnigav.exe	110
PID 5164 wrote to memory of 1948	5164	msedge.exe	113
PID 5164 wrote to memory of 1948	5164	msedge.exe	113
PID 5164 wrote to memory of 2396	5164	msedge.exe	116
PID 5164 wrote to memory of 2396	5164	msedge.exe	116
PID 1324 wrote to memory of 700	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 1324 wrote to memory of 5696	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4856 wrote to memory of 5896	4856	nlidavpnif.exe	123
PID 1324 wrote to memory of 5868	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 1324 wrote to memory of 1100	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 5384 wrote to memory of 1180	5384	axspkicaxs.exe	132
PID 1324 wrote to memory of 2440	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1324 wrote to memory of 5776	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 2904 wrote to memory of 1124	2904	usmkhczxrp.exe	141
PID 1324 wrote to memory of 2324	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 5164 wrote to memory of 1464	5164	msedge.exe	147
PID 5164 wrote to memory of 2704	5164	msedge.exe	148
PID 5164 wrote to memory of 5068	5164	msedge.exe	149
PID 1324 wrote to memory of 4192	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4024 wrote to memory of 3848	4024	trmhecwrpm.exe	154
PID 1324 wrote to memory of 5400	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 1324 wrote to memory of 5716	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 5828 wrote to memory of 708	5828	ezwurmjgeb.exe	163
PID 1324 wrote to memory of 1616	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 1324 wrote to memory of 3008	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 6044 wrote to memory of 2712	6044	qomgebztqo.exe	172
PID 1324 wrote to memory of 5688	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 1324 wrote to memory of 2676	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 556 wrote to memory of 5684	556	ytrljdbvtr.exe	181
PID 1324 wrote to memory of 2952	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 5164 wrote to memory of 2836	5164	msedge.exe	186
PID 5164 wrote to memory of 2836	5164	msedge.exe	186
PID 1324 wrote to memory of 5236	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 3684 wrote to memory of 5088	3684	aysqlidbvt.exe	193
PID 1324 wrote to memory of 3520	1324	2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-05_6499ae838b3a681eb5843ce840f6ab3e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa1c79c188,0x7ffa1c79c194,0x7ffa1c79c1a0
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,16818261231198049703,2472756454437335741,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:11
      4⤵
      System Time Discovery
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,11384339647981623777,7885633935761060962,262144 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:2
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2682218508154448704,17516326928145647509,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,1902517033090671781,6489925854101733614,2097152 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,7005712991120293085,11455480020550658197,2097152 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,8790329403343126984,13502987938166713208,2097152 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,16422941635478670227,16514676176174950694,2097152 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,1517032356683240904,17494900236883990595,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7920484148806009198,6587184132652659059,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,11444692273153726636,1721465692997479812,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4229395234723497068,10658641184582097886,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,4229395234723497068,10658641184582097886,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,1310913806487485773,3545705586121693289,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,11704000354410390302,10073021709182959276,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,1471998162385652429,6131269635443660267,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,7828060908237880717,12739554005229445665,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,1386525501782676941,15656288789562360623,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16606759038380246667,3055924411323933628,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,18443797108675383816,12073243284324757148,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,4811013583792563184,2466353645554506013,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,5888968061783499483,10973042208568133216,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=916,i,15744241519475990855,3608769184620814687,262144 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,11505333878077073263,5337925156816544997,524288 --field-trial-handle=3088,i,14529830977254939695,12360923227845038752,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14
      4⤵
      PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlxvqnigav.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3256
- - C:\Temp\nlxvqnigav.exe
    C:\Temp\nlxvqnigav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlxvqnigav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\i_nlxvqnigav.exe
    C:\Temp\i_nlxvqnigav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidavpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5696
- - C:\Temp\nlidavpnif.exe
    C:\Temp\nlidavpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidavpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5868
- - C:\Temp\i_nlidavpnif.exe
    C:\Temp\i_nlidavpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\axspkicaxs.exe
    C:\Temp\axspkicaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\i_axspkicaxs.exe
    C:\Temp\i_axspkicaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkhczxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5776
- - C:\Temp\usmkhczxrp.exe
    C:\Temp\usmkhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkhczxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Temp\i_usmkhczxrp.exe
    C:\Temp\i_usmkhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmhecwrpm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4192
- - C:\Temp\trmhecwrpm.exe
    C:\Temp\trmhecwrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmhecwrpm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5400
- - C:\Temp\i_trmhecwrpm.exe
    C:\Temp\i_trmhecwrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwurmjgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5716
- - C:\Temp\ezwurmjgeb.exe
    C:\Temp\ezwurmjgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwurmjgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\i_ezwurmjgeb.exe
    C:\Temp\i_ezwurmjgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomgebztqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\qomgebztqo.exe
    C:\Temp\qomgebztqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomgebztqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5688
- - C:\Temp\i_qomgebztqo.exe
    C:\Temp\i_qomgebztqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\ytrljdbvtr.exe
    C:\Temp\ytrljdbvtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2952
- - C:\Temp\i_ytrljdbvtr.exe
    C:\Temp\i_ytrljdbvtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5236
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdyvtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3760
- - C:\Temp\igdyvtnlfd.exe
    C:\Temp\igdyvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdyvtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Temp\i_igdyvtnlfd.exe
    C:\Temp\i_igdyvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczuspki.exe ups_run
  2⤵
  PID:5288
- - C:\Temp\mkhczuspki.exe
    C:\Temp\mkhczuspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczuspki.exe ups_ins
  2⤵
  PID:2240
- - C:\Temp\i_mkhczuspki.exe
    C:\Temp\i_mkhczuspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zukecxupjh.exe ups_run
  2⤵
  PID:3204
- - C:\Temp\zukecxupjh.exe
    C:\Temp\zukecxupjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zukecxupjh.exe ups_ins
  2⤵
  PID:4700
- - C:\Temp\i_zukecxupjh.exe
    C:\Temp\i_zukecxupjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwurp.exe ups_run
  2⤵
  PID:2984
- - C:\Temp\urmkecwurp.exe
    C:\Temp\urmkecwurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwurp.exe ups_ins
  2⤵
  PID:4632
- - C:\Temp\i_urmkecwurp.exe
    C:\Temp\i_urmkecwurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomjebzwro.exe ups_run
  2⤵
  PID:3376
- - C:\Temp\uomjebzwro.exe
    C:\Temp\uomjebzwro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomjebzwro.exe ups_ins
  2⤵
  PID:5284
- - C:\Temp\i_uomjebzwro.exe
    C:\Temp\i_uomjebzwro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgebwqo.exe ups_run
  2⤵
  PID:3732
- - C:\Temp\wtolgebwqo.exe
    C:\Temp\wtolgebwqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgebwqo.exe ups_ins
  2⤵
  PID:456
- - C:\Temp\i_wtolgebwqo.exe
    C:\Temp\i_wtolgebwqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytqoljd.exe ups_run
  2⤵
  PID:5184
- - C:\Temp\jgbytqoljd.exe
    C:\Temp\jgbytqoljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytqoljd.exe ups_ins
  2⤵
  PID:4824
- - C:\Temp\i_jgbytqoljd.exe
    C:\Temp\i_jgbytqoljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igayvqoiga.exe ups_run
  2⤵
  PID:5428
- - C:\Temp\igayvqoiga.exe
    C:\Temp\igayvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igayvqoiga.exe ups_ins
  2⤵
  PID:880
- - C:\Temp\i_igayvqoiga.exe
    C:\Temp\i_igayvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvpnifa.exe ups_run
  2⤵
  PID:5256
- - C:\Temp\ifaxvpnifa.exe
    C:\Temp\ifaxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvpnifa.exe ups_ins
  2⤵
  PID:6048
- - C:\Temp\i_ifaxvpnifa.exe
    C:\Temp\i_ifaxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhfzxvpnk.exe ups_run
  2⤵
  PID:3248
- - C:\Temp\mkhfzxvpnk.exe
    C:\Temp\mkhfzxvpnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhfzxvpnk.exe ups_ins
  2⤵
  PID:3320
- - C:\Temp\i_mkhfzxvpnk.exe
    C:\Temp\i_mkhfzxvpnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4508

C:\Temp\pnlfdavsqk.sys
C:\Temp\pnlfdavsqk.sys
1⤵
- Executes dropped EXE
PID:5592

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5236

C:\Temp\usmkecwusm.sys
C:\Temp\usmkecwusm.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\jhczxupmhf.sys
C:\Temp\jhczxupmhf.sys
1⤵
- Executes dropped EXE
PID:1932

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:4280

C:\Temp\rojgeywuom.sys
C:\Temp\rojgeywuom.sys
1⤵
- Executes dropped EXE
PID:1976

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Temp\lgeywqoigd.sys
C:\Temp\lgeywqoigd.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\idavtqlifa.sys
C:\Temp\idavtqlifa.sys
1⤵
- Executes dropped EXE
PID:4816

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\spkhczxspk.sys
C:\Temp\spkhczxspk.sys
1⤵
PID:3216

C:\Temp\zxusmkhcau.sys
C:\Temp\zxusmkhcau.sys
1⤵
PID:5200

C:\Temp\wusmkecwup.sys
C:\Temp\wusmkecwup.sys
1⤵
PID:2704

C:\Temp\urmjebztrl.sys
C:\Temp\urmjebztrl.sys
1⤵
PID:2688

C:\Temp\hbztrljdbo.sys
C:\Temp\hbztrljdbo.sys
1⤵
PID:6040

C:\Temp\igeywqolgd.sys
C:\Temp\igeywqolgd.sys
1⤵
PID:5200

C:\Temp\gdbytqliga.sys
C:\Temp\gdbytqliga.sys
1⤵
PID:3044

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
PID:1772

C:\Temp\vspnhfdxvp.sys
C:\Temp\vspnhfdxvp.sys
1⤵
PID:6104

C:\Temp\zxvpnkfzxr.sys
C:\Temp\zxvpnkfzxr.sys
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspkicaxs.exe

Path C:\Temp\axspkicaxs.exe
Size 226KB
SHA256 2fdc1eb7b93413d958a34f4daa17dcc40d18cf49c8a9bab9286727a709f4de45
MD5 35934a75d92e7f352761ad62d9edd67c
SHA1 e5a01da1c78550643a2854c4145f81ffbf08f4aa
SHA512 571676d5e50a9895a4f249254d6f465117b0f01a0294128f8cdd037a52060cf07a6bb80b8fad3a04f595a802f1562335329313650e9463c2f1e7133e81497825
SSDEEP 3072:YEGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:YrXY4LK+a3lLNngoqRttA7y
TLSH
T11A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezw.sys

Path C:\Temp\ecwuomhezw.sys
Size 141KB
SHA256 85dc8001ee043a4f5cba58e14712240e9514adf40676b9dc0d97d3a4f832aa89
MD5 9dab143605ac8d4d713e83d6ba863993
SHA1 2e075b8359e3965b1f9ac14ea0f66b5443cfbd86
SHA512 1a9932542e8fa796ebc5936ef2dbe86965816ea579523616aa5fedd66cc322e1c4f08ca8d6438eb0bdfda174409fb08b45fdfa1e84bc27c849efd46b52477622
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwurmjgeb.exe

Path C:\Temp\ezwurmjgeb.exe
Size 226KB
SHA256 ec23f8f03718d449ffab05145117f011378dd4a5adaaedb3b7a73d18275bd03a
MD5 683649be94b7836aae3e5199b468d3cb
SHA1 85464ce7d34f19515b5b47d9dac281616ab47e72
SHA512 ae0327a89642bbd98b1d7b9b78ca20d80a83992bbedb66f0bbc0410de6db9aefb175332a2c9546733f6e8c182bbe5bbb0707cdc9c727aee53917b34974e94195
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T14534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkicaxs.exe

Path C:\Temp\i_axspkicaxs.exe
Size 226KB
SHA256 18de4e3ce194cc814ef516e5ebe45059fae749eb4162ff73fbdbb3f47860ab3e
MD5 c4d219024a91246303dcc9be9c504a00
SHA1 cca22a96d7572cbcc8f51d26795aa5b021a72f4e
SHA512 7e4079b50414ac3454a967d8d44fcde5cddfa4d12d3836b22caca75ed8f1752c79b746d8fb177e8fdcfcd19e3805cc75b5544a32fcc5e963c0ffdca966f3204c
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwurmjgeb.exe

Path C:\Temp\i_ezwurmjgeb.exe
Size 226KB
SHA256 47823cd90c09d91f02672ea52740d94828f846897091850ea475113c22e8ad0b
MD5 417d3fa7f2ff44d4c9158d18b23f5f4a
SHA1 f2829bdc586ff0615a2182a01c1c756f194ce185
SHA512 c6623457cb42eb731aef69f9ba3b78fc2093a21f6d913880b9fd849a34639009a64b56b7e8fcaef0d97e219ac6ecf0c9e3cdf1617adbd7e8b97473a6ea02dfdb
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T11234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlidavpnif.exe

Path C:\Temp\i_nlidavpnif.exe
Size 226KB
SHA256 24e104375b80cdf70e0d56687c9126fb278f599bc54405a0fe7d2ae042ec0e4a
MD5 3f7ca0702e300bf94d2fd8a203f28d55
SHA1 5148405767aabd820b9c1de11e666ab943fd0227
SHA512 cf9577d946541eb4cea7dcdb51919500ee8c236054bfad4b08b6122a8b04ae991e55a808845123803c81553cf4b10b5c0b0335a56d9ea95ece4cf2599cc44a73
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T15634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlxvqnigav.exe

Path C:\Temp\i_nlxvqnigav.exe
Size 226KB
SHA256 d17661d4c695c144b91d802f5d45ceaa4cb9f95b2cea372b56bc67edddaa472c
MD5 be52af170a88f6391380ecc50f15d740
SHA1 2a70cabf306a1f93f2e2354d935c418a457d2de0
SHA512 cbed7e092af7cb9bedd1184c419aedb227d4f3ce0b82316ae251f1386fa94ca773b73077039e5fcc91e6afb57fde92eadc0a46d38a2317e5d1276d7c0a70cfe8
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmhecwrpm.exe

Path C:\Temp\i_trmhecwrpm.exe
Size 226KB
SHA256 5e095f3b1626e8e8a9ce6bafcb30114869954e0476ea6fab3a09d36954ed37ca
MD5 8c5f45f0c87dc74a475a3b021eadf4e0
SHA1 91d32d241851cddac13af9fb0c1f040ae45cc2c2
SHA512 d17c1093bf7068b96c9d69e65c97787c459270c2786eb3f5308ac4c114a4e63f9b6721240ed08ed67e8eb30be1b06cc72ace4f29c3632fa9996860c27ada39c1
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1F534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhczxrp.exe

Path C:\Temp\i_usmkhczxrp.exe
Size 226KB
SHA256 7cd73c93af2886d0d3ca538137615faac51c05ea15b47f10d5fa2033a01fdc10
MD5 6b5f66eb6fa912de844236eb350ce5aa
SHA1 ea758e07600bfad1e40dea456b96c8973088b0f4
SHA512 2af877f0e83927e4a3a53b44133ea275e26bee9e4f3d917a8c85f526a66247d7246ddce491ff63ea7856722086e328ea1fc6f27869fe4dd2d47f17987f851b6f
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T16A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczxupmhf.sys

Path C:\Temp\jhczxupmhf.sys
Size 141KB
SHA256 74badcd4dbf6cd48771c25a6da4df2e1b03b7d9bccd1744d07a03302b6812cde
MD5 3f52a608ca08f75cb070fb920110c23c
SHA1 80e5dbe420918bc3ce5f659b06b968df97087809
SHA512 c09855609aba4516a1f88bd22c73c59d93ca3829ddcc6bfeec3aed2487e1fd50e71151058e78556f1521510cbf6b0ca113ead4f5429d9c5efb67385a915ef193
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.sys

Path C:\Temp\kfdxvpnhfa.sys
Size 141KB
SHA256 79f72fd8256d75a75b91db5d777d79fd0f89484e6ce1f41e548d15285c0d0667
MD5 d7198b1f4f75145a2eb1b682edd73c75
SHA1 5352c3b128008938e5f8506c0bafd86f5c054382
SHA512 05ee24ad2e5033e39824bc17328842e6d48b8095e058ef7b70b14dff995d7241cf67e626e6a1717218bdd99f4f81c5b4ea17c9bc9365f76d5ae7c6340cf24fdf
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T199E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidavpnif.exe

Path C:\Temp\nlidavpnif.exe
Size 226KB
SHA256 6b8ca871605180f5dc62b497f86627bd669d2409c1d1a3b93def012d59ee42bb
MD5 23862a8340ea93c567f27c5c7a7e5ea2
SHA1 616eb83e000374721e38cc7ee58711e90a65cceb
SHA512 88d6459b986334e1d36b7164ca9104c8799230cbaab1df3da0c62af94a3424488f137680a4c47855374d151bc7adec2348f21151d829cd24197fc18ba576898d
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1B234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlxvqnigav.exe

Path C:\Temp\nlxvqnigav.exe
Size 226KB
SHA256 bcadd188088d5df439a086ddcf07fd19193f731154bce4f2d75a1df2231faa82
MD5 16716c00430a4ddd0c49c37be8e665d7
SHA1 4fa65814043f6e2dc633079efc367832108ace34
SHA512 c455b5833556a8f02b2c39ad8c3aa37da362f2ff1c30a576aefdb1a4c364d68c82e600fe2a2e0a9c16e2d56d2680af7e63f2765ecbbe9174dbe2e6579b6a343a
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnlfdavsqk.sys

Path C:\Temp\pnlfdavsqk.sys
Size 141KB
SHA256 1d4f7bc1b506dec70b504495ad391f8f76a7f35b02a0e4afe87aeede245d86f3
MD5 7ab3af37ad7fabbbd7dfdc29acc161c2
SHA1 deba17a2d9d6a7933e7678892dfb95f2c6239381
SHA512 fc66f7a712172d025898742b95b61a12fab9e232fa4048a215d1464c4311b1c585f64126bf183c9760e06df963378e92c71d9b7f25ebf7d80dbf4168b809fe32
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmhecwrpm.exe

Path C:\Temp\trmhecwrpm.exe
Size 226KB
SHA256 1f31df0aa7c08ffff7502a1cdeaf23b8186a08a521013565c78932df03d919c5
MD5 ef40e8307fd4ed177f47463bac0694e9
SHA1 99ffaec8d39828ebe3f479196674120f96d05531
SHA512 2ffb5b8eb79cca9773c895ae6203074f6adc64bd5a0f94b8d54906f944a1108251a180694495b378ba70818fc7babef23375a4431d1d27a9eecae16bb9026ca9
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwusm.sys

Path C:\Temp\usmkecwusm.sys
Size 141KB
SHA256 7790de8beb6436b89f81038323e843ef57bb705f8cd17bb8c04391949fe6161e
MD5 fa5a8141346a37ff5cf0fc07b68d0bb2
SHA1 68a189738fc5e6819bcd0b7e9ee68539f9004adb
SHA512 e4c642aa78c10f482b1ef2d02d65512c52b0c8c8dfa69426f97bfe8060c4207d33f03497992eedcaca5baf51382b5e446e94e19ca67ba0815c548072188505bf
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhczxrp.exe

Path C:\Temp\usmkhczxrp.exe
Size 226KB
SHA256 9d5337d82f640ad28afaf294f1ab807e3d3f497380007d1c0b7af7e5f0b5c994
MD5 027a7e98bf38cd891c0c05733b318a9c
SHA1 133ee99afc88d92476f75f3495fe8214aad9d6f4
SHA512 8a1735fb05b01bfe9f592d1fff4f48801ac4dc8ff88375e398e5c7296f9c1a6c4fb46f9a635502cf2995c397afda129ea06504ddab5faf880800b4ddc93c3a38
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36edb480-9cd6-43ce-9dd4-096a4414c3e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36edb480-9cd6-43ce-9dd4-096a4414c3e7.tmp
Size 34KB
SHA256 8a62429d536d28a070c7d4fba733f43a60f13170fca8cac973b4d7fc6804728d
MD5 417ce7712db6e273ff6f649d4ab81e8f
SHA1 16654c2a098ed69e2bc3fce6137d0b95d312905b
SHA512 e67029b22c52c276de95c202bf256c4dd67f26ce3d8b68752871f49f5235d681a6a49aef2057f2c1912114d6da08799b93093b45a455ed5acb9be0846bb9d01a
SSDEEP 768:F43+EMzKXaIbE57Y0GZxJsXBdK8ZDdphvd:F43+Oy70/JsXf7FTtd
TLSH
T16CF2BF30E8B5DE7799BED3807A0633C3AEB452B3C5C44E58D9E99B0D00476AE170792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6db1ff7a-77e2-4166-9cc5-d97d1d1911a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6db1ff7a-77e2-4166-9cc5-d97d1d1911a9.tmp
Size 42KB
SHA256 c840e1de8818d43e2bdbac45fa9a9419e74b8a4f4612c9f9a67a6057dfed8f6d
MD5 a66ba846e4c5e2f02ed17ecb7ddb0b41
SHA1 c59752f976e80ea78d7a6eef1ce5ea3ec82b4e41
SHA512 0a96cd70819aed1a9b95a1c81a1fdde904f4c8f739667f1169d6dffc639a8a8ba866d4d8ec82f4b6c2fcd4cbb6e9ff030271ba08783cec559e98e5fb0ba5e1a4
SSDEEP 768:HFQ+3hwgo+MwgaI/E57Y0GZxJsXBdK8ZDdphvd:a+3I9e70/JsXf7FTtd
TLSH
T1C21318F098E39A76D9AE8783673D2E469ABCC163B5888994F7D55E0CCC421BFC307815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

0505656b-91f3-4e0a-beaf-be1a6b81b367.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0505656b-91f3-4e0a-beaf-be1a6b81b367.tmp
Size 11KB
SHA256 6fbe4c4e4f1b6a23fcacccf3face9dcd04e094c48303ece0f7ca8c3c7224eb0a
MD5 fdd8a039287671935d5ddcf149590d6e
SHA1 6d793a4b03d410d71d31bfba28d5af78218d0538
SHA512 bb85baf360ececff9fc8c95296b959d75a50e38313e238a26beb9b19fde0a4d161f55124bbe6b5e4ac8d70cd3f66223a3380e5ab91e5de126f267e872c8ed070
SSDEEP 192:sxRwRaCu/fvsWKZkyzzoA8p94/g6+WNCsi/YU2P3BSGqIgVkJ:sxRwbu/fvsWcXiO/5Q/92
TLSH
T11D42C759AD28A97B8CCBD21DBF557F53D2F95032A0912E08EAFC891C04E66DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14f94b4e-4628-4d00-8342-b86e95ae42ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14f94b4e-4628-4d00-8342-b86e95ae42ab.tmp
Size 12KB
SHA256 63de8a49ae3243c3fb5461a78aa04ccb21bbbe89a5ef762592fa66d82425428f
MD5 98c63f288e3d585b6f9290b1ab32d380
SHA1 9186681ac1bbe5490cc0959ab4d32a971ed1ad35
SHA512 f5da21c0517d0bd6d8cf8e3f0f97dc4b8d76a5493cc0a2fa1432c4b5378c4772efd3b40a28565ce023b6843f68e9fce6642e2b6cbd4a1f2aa19da37f2edfef09
SSDEEP 192:sxRzRaCu/fvsSKZkyzzoA8p94/g6+WNCsi/YU2PsBSGqIgDxkJ:sxRzbu/fvsScXiO/5Q/8O
TLSH
T1B642D859AD28AD7B8CCBD21DBF557F53D2F95032A0912E08A6FC8A2C04E76DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

15c7d774-e0c2-41ac-b681-b704eec6aa69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15c7d774-e0c2-41ac-b681-b704eec6aa69.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

333c421d-a121-480b-b0e0-e3beaaa1b473.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\333c421d-a121-480b-b0e0-e3beaaa1b473.tmp
Size 29KB
SHA256 13eb1975052d4ce30f5ac2734e40b38c24016920501507bf6adabae69e359e40
MD5 8865c40d16acd2306a3b8420978bcc2a
SHA1 4ac0202be7c1b2dd27686870eba57d2c9e64ffa3
SHA512 6154130731863ee6b214049f559cfc8a90ac3222bd4a5587ea1a68b797ba5870f3599c04218dc10ba5570964702e5f3f868fcdfde6d822a57e156bc30b79cfe7
SSDEEP 768:6Jaj5+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkTgomB1ro6OM:6Jaj5+Eb/KWgm0fbbu1jaXTghBOm
TLSH
T1D3D2CA7B640CCB7F4F900ADD9C197E9B6DA802CB9698CD8047FE941D02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55b46a69-2024-4141-8bc8-a517c98c248e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55b46a69-2024-4141-8bc8-a517c98c248e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1ec3694447c73cf4152bfdc64ce7f5752e2ce9b899cf413cdc01dea5d7168c0c
MD5 bf864547a1deaca6b5d652a3c0e616b5
SHA1 4fff57a2e64003f8f83483ddc07d41f81b93065f
SHA512 ccd7bbf3ff03278a7fa5fa0d4de5d474150988dbb90105bfa039600c3bb17ba89fe5f63ae52dddfe4cfce6296c1cbf29d681b71667e01efe3a247a29f564d00e
TLSH
T16A511CA1539A8957CF7C0472BFC53E8732FA31BC91CF2E9C2695D4B9664271C07541A4
MD5 SHA1 SHA512 TLSH

Submit Download

4446421e-d529-4873-b835-b46f0d54963a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4446421e-d529-4873-b835-b46f0d54963a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0a3059b3-9cbe-4854-9ff9-9d48677cdcc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a3059b3-9cbe-4854-9ff9-9d48677cdcc0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

59a3cc44-97f6-42c8-98f4-2ea0a060d181.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59a3cc44-97f6-42c8-98f4-2ea0a060d181.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b825eee2-4358-4c96-a163-a4b4aacaeb77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b825eee2-4358-4c96-a163-a4b4aacaeb77.tmp
Size 2KB
SHA256 2cac95fb63f39368a89acc50083303fe5fcf880031952581f47f8f6428599cee
MD5 d6abd1a459229db58403d33daed49317
SHA1 9d78bbda13eaff6f52ca403e51cabca6ace8221a
SHA512 6a6226fde30fda3eeb88410aa6acf94b9fa7723804ed649905f7543d21f0fb0b6e9e4ad3e9a3a3dcb161cbdc4896761a4eaca143733310748456ee6f4d8bffda
TLSH
T1FD519DF3C3E8866D8A0156F4AA186E1BDE1D0925432C3D5AC8E4EE1B93F24B1D54199F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 773473915fd353631e470d67c4634886aad07df644585aff4f4576ad21caee4b
MD5 5b47d6c16b6ed03ef1b253345e907aff
SHA1 5137f4065431e348ed95231287da09b66e55f269
SHA512 0a4e8bdac255c2fad6c8ebadd15a4568f822be9d0d830e9de6ea0437fb4300b62f67901ea297364e0ef982e9cf8194b961811c67a78ab08cd3e649be5c32ce3f
SSDEEP 24:KFfITETIDKfh61iSmFryXSpa1k5IfK1hi1ySgDPQA4BVTaK77+9LOflIcd+Kbthi:KM4IDK560nyBKIfKziUnOI3KPqEry5z
TLSH
T17E91F194317B4200397D350842DCE75BB65275A33039E92F7BAA91935E2BE884EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed7831e9-1bb3-4a44-b76f-4542e4c34602.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed7831e9-1bb3-4a44-b76f-4542e4c34602.tmp
Size 12KB
SHA256 9d128b0826d767d9a2d3a4e188f257cd0c84cdd335bd83c226f5c0e814dac416
MD5 7ee935686ddbfacaba09caa55592cad6
SHA1 25f4a894e63e3b8923df7c64a6d76c09f6032fb0
SHA512 348d84a4a420f977615369a8ef3feeda6379ada18f89a5bad59af2e20cfd3a5e9c0f92200ad75e582fb25dc513bb7c159b00f56af9b1f10e0cb480a7d1dfe3db
SSDEEP 192:sxRzRaCu/fvsdKZkyzzoA8p94/g6+WNCsi/YU2P3BSGqIgDTkJ:sxRzbu/fvsdcXiO/5Q/9g
TLSH
T12642D859AD28A97B8CCBD21DBF557F53D2F95032A0912E08A6FC892C04E76DD231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f03423e7-300e-4604-b500-4b2304305dee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f03423e7-300e-4604-b500-4b2304305dee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a42f76a2-975a-4827-ad83-e9af95daf764.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a42f76a2-975a-4827-ad83-e9af95daf764.tmp
Size 37KB
SHA256 c4af821d9b3ddc163d53210e0f6f6f93f2ae0cf98fd11110d008f306b5540762
MD5 e75100385a96a8718ac75935273a3f8c
SHA1 2a9351b7260255301201f6d448e753d8502ebee2
SHA512 06913faa65d4b75d2a8037f14cdbe1b46adbf7137d13422cca6ec91108041193a83700f156d1ecdefd37bb9fcc3271024c9abbe02b0b19b27cad848d8566d294
SSDEEP 768:A/UxvxjgC+I3K7KXyE57Y0GZxJsXBdK8lDSHUPpMs:tZj3+I3N70/JsXf75Sfs
TLSH
T13003C034E8A19D775DFB9390360A7387EEF445B3C5C54EA48AED6B0D028B2AD034395A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9a7402d-ac52-40c7-9b0e-df85e8af80ce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9a7402d-ac52-40c7-9b0e-df85e8af80ce.tmp
Size 34KB
SHA256 6f3624bb2fafc78202a403f4b38fea0ad4e26cd46d4aca8e9c89cdb7f6fdfdc2
MD5 d53104d4626d536c3cc8bba8e8b0836e
SHA1 b9612f0df488eaf1d466353960aea86d2f288a45
SHA512 95d393ef64fbfbc933261ddf1a29efe7f8e6683abd0c87e9cf312e1bcd6f56ebb9a56afc71b82a1f9796560a30216a8daebd56b9d953726b263bf63f4e12c234
SSDEEP 768:343XEMzKXaIbE57Y0GZxJsXBdK8ZDdphvd:343XOy70/JsXf7FTtd
TLSH
T166F2BF30E8B5DE7799BED3807A0633C3AEB456B3C5C44E58D9E99B0D00476AE170791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17626d7b-78a9-430b-823e-676670e2f2f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\17626d7b-78a9-430b-823e-676670e2f2f1.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

1fce4a92-2d5b-4dc0-9772-9d9ce0c5074a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1fce4a92-2d5b-4dc0-9772-9d9ce0c5074a.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7a84fa98-cad9-4d4f-b285-22e3bc91d942.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7a84fa98-cad9-4d4f-b285-22e3bc91d942.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

cc178a50-605a-43c5-913f-ade9ad72f1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\cc178a50-605a-43c5-913f-ade9ad72f1c9.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

36c57b8a-7803-4faa-9392-4387de9ec31a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36c57b8a-7803-4faa-9392-4387de9ec31a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fdcd7652-17fc-4ea5-8da6-b7feccea42b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fdcd7652-17fc-4ea5-8da6-b7feccea42b4.tmp
Size 40KB
SHA256 54f5d226c654f9efec446c4d27ca58ea9982d28f770a68bcde27a7b3c2f6cf2a
MD5 4544886a4a59cdcab7174aa8cb2996c7
SHA1 31ec442187e880edd4c89fe42409749a45483554
SHA512 fc4cd1613c67f498c59c36e8a13fc43c19aba2186faa30c456942fbaa5ab769ad9840915c55ace5101fd8b64699209a6bc00ca49fd6319a6d16aca9b65968f35
SSDEEP 768:7/UxvxjgC+N3W4kzKXaI1E57Y0GZxJsXBdK8ZDdph2YI:uZj3+N3WUc70/JsXf7FTU7
TLSH
T17913C030F8A5AD3399BBE390760A33D7EEB416B3C4C54EA8D9E99F0C044729D170791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

664e9c2f-0417-4e48-ace5-4a964548c6c0.tmp

Path C:\Users\Admin\AppData\Local\Temp\664e9c2f-0417-4e48-ace5-4a964548c6c0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a10d405e-d9a4-4c51-92d9-d1a8e1091459.tmp

Path C:\Users\Admin\AppData\Local\Temp\a10d405e-d9a4-4c51-92d9-d1a8e1091459.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5164_853376356\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1106289118\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1932986371\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_1962630423\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5164_758108763\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1376-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1764-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1932-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1976-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2688-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3044-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3044-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3216-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4280-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4520-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4820-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5200-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5200-391-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5236-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download