537f1f5f165ac3093249f83c29d40eebe29b037cb1ad3bfe4974a069786c8a50

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/10/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
Size 243KB
Sample261007-3f5ycsfx8v
SHA256 537f1f5f165ac3093249f83c29d40eebe29b037cb1ad3bfe4974a069786c8a50
MD5 905978ce6a55ed27a5ee62ef764fb788
SHA1 2b0ecd0c91fad88bfa24d9e46bb66c9fe01f97d4
SHA512 50f383571f4409bb8b5d58210e93efe4c505ee142a482fff0b7fd1de74185e820851a60de027573a295a8fe0e3341f256fc67667b4eafa9e568f529522f62524
SSDEEP 3072:iVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:iXP7LQMa3lLNngoqRttA7n
TLSH
T103345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2440	CP.exe
1832	ytrljdbvqo.exe
3840	CP.exe
4240	CP.exe
3400	i_ytrljdbvqo.exe
3900	yvqoigdyvq.sys
6084	CP.exe
1820	qnlidaysqn.exe
2868	CP.exe
4596	CP.exe
2192	i_qnlidaysqn.exe
1216	ysqkidaysq.sys
3832	CP.exe
2376	vsnlfdxvqn.exe
4768	CP.exe
1060	CP.exe
4716	i_vsnlfdxvqn.exe
5608	xnhfaxspnh.sys
1584	CP.exe
4796	nhfzxspkic.exe
5888	CP.exe
1100	CP.exe
5136	i_nhfzxspkic.exe
5820	vpmkifzxvp.sys
5916	CP.exe
1200	vpfzxspkhc.exe
5036	CP.exe
2792	CP.exe
2316	i_vpfzxspkhc.exe
5744	spkecwupmh.sys
2592	CP.exe
4344	pmkeczusmk.exe
2908	CP.exe
4580	CP.exe
1736	i_pmkeczusmk.exe
5556	mjhezwuomh.sys
1888	CP.exe
3860	mjecwuomge.exe
4108	CP.exe
2100	CP.exe
2892	i_mjecwuomge.exe
5924	wuomhezwjh.sys
4380	CP.exe
5696	mgeywqojgb.exe
2068	CP.exe
2452	CP.exe
3680	i_mgeywqojgb.exe
3456	rojgeywqol.sys
5140	CP.exe
2588	olgebwtoiy.exe
752	CP.exe
2308	CP.exe
2248	i_olgebwtoiy.exe
248	nljdbytqlj.sys
976	CP.exe
2892	olgeywqoig.exe
4504	CP.exe
1872	CP.exe
2920	i_olgeywqoig.exe
3144	fdyvtnlida.sys
6012	CP.exe
1360	fdbvtqkida.exe
2668	CP.exe
3848	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_231855985\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_508771276\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_272656471\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_508771276\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_272656471\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_1683597046\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_1683597046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_1683597046\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_1683597046\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlidaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlidaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxrpmhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxrpmhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgebwtoiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgebwtoiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1544	ipconfig.exe
4956	ipconfig.exe
5932	ipconfig.exe
5560	ipconfig.exe
5392	ipconfig.exe
964	ipconfig.exe
2400	ipconfig.exe
5704	ipconfig.exe
4372	ipconfig.exe
296	ipconfig.exe
3284	ipconfig.exe
4800	ipconfig.exe
2328	ipconfig.exe
6112	ipconfig.exe
4336	ipconfig.exe
1460	ipconfig.exe
2848	ipconfig.exe
932	ipconfig.exe
6100	ipconfig.exe
2060	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{2A0113A5-99B9-4C47-8468-9A438D52A20D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3400	i_ytrljdbvqo.exe
Token: SeDebugPrivilege	2192	i_qnlidaysqn.exe
Token: SeDebugPrivilege	4716	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	5136	i_nhfzxspkic.exe
Token: SeDebugPrivilege	2316	i_vpfzxspkhc.exe
Token: SeDebugPrivilege	1736	i_pmkeczusmk.exe
Token: SeDebugPrivilege	2892	i_mjecwuomge.exe
Token: SeDebugPrivilege	3680	i_mgeywqojgb.exe
Token: SeDebugPrivilege	2248	i_olgebwtoiy.exe
Token: SeDebugPrivilege	2920	i_olgeywqoig.exe
Token: SeDebugPrivilege	2852	i_fdbvtqkida.exe
Token: SeDebugPrivilege	2352	i_nifaxsqkic.exe
Token: SeDebugPrivilege	2848	i_pnhfspkhca.exe
Token: SeDebugPrivilege	2600	i_xrpkhczusm.exe
Token: SeDebugPrivilege	5392	i_cxrpmhezwu.exe
Token: SeDebugPrivilege	2288	i_ywuomjecwu.exe
Token: SeDebugPrivilege	1604	i_jhbzwrojhb.exe
Token: SeDebugPrivilege	2380	i_lgdyvtoljg.exe
Token: SeDebugPrivilege	2064	i_ligaywqoig.exe
Token: SeDebugPrivilege	2408	i_nlfdxvpnif.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4260	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	89
PID 4260 wrote to memory of 3776	4260	iexplore.exe	90
PID 3776 wrote to memory of 3332	3776	msedge.exe	91
PID 3776 wrote to memory of 4912	3776	msedge.exe	92
PID 3776 wrote to memory of 3148	3776	msedge.exe	93
PID 3776 wrote to memory of 4912	3776	msedge.exe	92
PID 3776 wrote to memory of 4912	3776	msedge.exe	92
PID 3776 wrote to memory of 4332	3776	msedge.exe	95
PID 3776 wrote to memory of 4332	3776	msedge.exe	95
PID 3776 wrote to memory of 3528	3776	msedge.exe	96
PID 3776 wrote to memory of 3528	3776	msedge.exe	96
PID 3776 wrote to memory of 3528	3776	msedge.exe	96
PID 3776 wrote to memory of 1196	3776	msedge.exe	97
PID 3776 wrote to memory of 1196	3776	msedge.exe	97
PID 3776 wrote to memory of 1196	3776	msedge.exe	97
PID 3776 wrote to memory of 356	3776	msedge.exe	98
PID 3776 wrote to memory of 356	3776	msedge.exe	98
PID 3776 wrote to memory of 356	3776	msedge.exe	98
PID 3776 wrote to memory of 2696	3776	msedge.exe	99
PID 3776 wrote to memory of 2696	3776	msedge.exe	99
PID 3776 wrote to memory of 2696	3776	msedge.exe	99
PID 3776 wrote to memory of 4796	3776	msedge.exe	101
PID 3776 wrote to memory of 4796	3776	msedge.exe	101
PID 3776 wrote to memory of 3548	3776	msedge.exe	102
PID 3776 wrote to memory of 4376	3776	msedge.exe	103
PID 3776 wrote to memory of 3548	3776	msedge.exe	102
PID 3776 wrote to memory of 4376	3776	msedge.exe	103
PID 3776 wrote to memory of 4540	3776	msedge.exe	105
PID 3776 wrote to memory of 4788	3776	msedge.exe	106
PID 3776 wrote to memory of 4788	3776	msedge.exe	106
PID 4592 wrote to memory of 2440	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	107
PID 1832 wrote to memory of 3840	1832	ytrljdbvqo.exe	112
PID 3776 wrote to memory of 4268	3776	msedge.exe	115
PID 3776 wrote to memory of 4268	3776	msedge.exe	115
PID 4592 wrote to memory of 4240	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	116
PID 4592 wrote to memory of 6084	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	120
PID 1820 wrote to memory of 2868	1820	qnlidaysqn.exe	122
PID 4592 wrote to memory of 4596	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	125
PID 4592 wrote to memory of 3832	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	129
PID 2376 wrote to memory of 4768	2376	vsnlfdxvqn.exe	131
PID 4592 wrote to memory of 1060	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	134
PID 4592 wrote to memory of 1584	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	138
PID 4796 wrote to memory of 5888	4796	nhfzxspkic.exe	140
PID 4592 wrote to memory of 1100	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	143
PID 3776 wrote to memory of 968	3776	msedge.exe	146
PID 3776 wrote to memory of 3784	3776	msedge.exe	147
PID 3776 wrote to memory of 1292	3776	msedge.exe	148
PID 4592 wrote to memory of 5916	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	151
PID 1200 wrote to memory of 5036	1200	vpfzxspkhc.exe	153
PID 4592 wrote to memory of 2792	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	156
PID 4592 wrote to memory of 2592	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	160
PID 4344 wrote to memory of 2908	4344	pmkeczusmk.exe	162
PID 4592 wrote to memory of 4580	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	165
PID 4592 wrote to memory of 1888	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	169
PID 3860 wrote to memory of 4108	3860	mjecwuomge.exe	171
PID 4592 wrote to memory of 2100	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	174
PID 4592 wrote to memory of 4380	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	178
PID 5696 wrote to memory of 2068	5696	mgeywqojgb.exe	180
PID 4592 wrote to memory of 2452	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	183
PID 3776 wrote to memory of 2696	3776	msedge.exe	185
PID 3776 wrote to memory of 2696	3776	msedge.exe	185
PID 4592 wrote to memory of 5140	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	191
PID 2588 wrote to memory of 752	2588	olgebwtoiy.exe	193
PID 4592 wrote to memory of 2308	4592	2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_905978ce6a55ed27a5ee62ef764fb788_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffba19c188,0x7fffba19c194,0x7fffba19c1a0
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,6198782129731613761,12165167261176997619,262144 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,4782749441930827889,17513130114333927391,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
      4⤵
      System Time Discovery
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,5040340557502638718,10619086373934606012,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,15983800407389046542,7263957750374633405,2097152 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,3364174936363514712,7255389385229359475,2097152 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,15065814571235987386,4463152091382063620,2097152 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11025012851321498255,7453104906377632693,2097152 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3096,i,10442507440302135019,222475994138179691,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,11601113650017291179,10003926795066638106,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:3548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,8335265763832323019,14867372130772015338,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1692248407150382930,6649780741187626988,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1692248407150382930,6649780741187626988,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,14336548274961125373,15354135805084699504,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17702876016807941088,11005949770662919963,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,10246289749378585856,10636935274213413214,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,4088759276044920129,15744316790571231324,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12055281026890699908,7936898414394167644,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4483295430499772990,12531560408031561963,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,3569424667167797050,15590997134232098885,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,13167852447785117336,5969216062481463161,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,15179740274361654970,13450832290337192000,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6736,i,10835072885069842193,16406410122174032372,262144 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,5355278585543521023,4011957023107457948,524288 --field-trial-handle=2288,i,15661401952168039220,8530989297808382015,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2440
- - C:\Temp\ytrljdbvqo.exe
    C:\Temp\ytrljdbvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\i_ytrljdbvqo.exe
    C:\Temp\i_ytrljdbvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlidaysqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\qnlidaysqn.exe
    C:\Temp\qnlidaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlidaysqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\i_qnlidaysqn.exe
    C:\Temp\i_qnlidaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3832
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1060
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1584
- - C:\Temp\nhfzxspkic.exe
    C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\i_nhfzxspkic.exe
    C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpfzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\vpfzxspkhc.exe
    C:\Temp\vpfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpfzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2792
- - C:\Temp\i_vpfzxspkhc.exe
    C:\Temp\i_vpfzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkeczusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\pmkeczusmk.exe
    C:\Temp\pmkeczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkeczusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_pmkeczusmk.exe
    C:\Temp\i_pmkeczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1888
- - C:\Temp\mjecwuomge.exe
    C:\Temp\mjecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Temp\i_mjecwuomge.exe
    C:\Temp\i_mjecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2452
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgebwtoiy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\olgebwtoiy.exe
    C:\Temp\olgebwtoiy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgebwtoiy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2308
- - C:\Temp\i_olgebwtoiy.exe
    C:\Temp\i_olgebwtoiy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:976
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbvtqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\fdbvtqkida.exe
    C:\Temp\fdbvtqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbvtqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3848
- - C:\Temp\i_fdbvtqkida.exe
    C:\Temp\i_fdbvtqkida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaxsqkic.exe ups_run
  2⤵
  PID:1696
- - C:\Temp\nifaxsqkic.exe
    C:\Temp\nifaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaxsqkic.exe ups_ins
  2⤵
  PID:1144
- - C:\Temp\i_nifaxsqkic.exe
    C:\Temp\i_nifaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfspkhca.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\pnhfspkhca.exe
    C:\Temp\pnhfspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfspkhca.exe ups_ins
  2⤵
  PID:3472
- - C:\Temp\i_pnhfspkhca.exe
    C:\Temp\i_pnhfspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhczusm.exe ups_run
  2⤵
  PID:5444
- - C:\Temp\xrpkhczusm.exe
    C:\Temp\xrpkhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhczusm.exe ups_ins
  2⤵
  PID:256
- - C:\Temp\i_xrpkhczusm.exe
    C:\Temp\i_xrpkhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxrpmhezwu.exe ups_run
  2⤵
  PID:2304
- - C:\Temp\cxrpmhezwu.exe
    C:\Temp\cxrpmhezwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxrpmhezwu.exe ups_ins
  2⤵
  PID:3976
- - C:\Temp\i_cxrpmhezwu.exe
    C:\Temp\i_cxrpmhezwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomjecwu.exe ups_run
  2⤵
  PID:5920
- - C:\Temp\ywuomjecwu.exe
    C:\Temp\ywuomjecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomjecwu.exe ups_ins
  2⤵
  PID:936
- - C:\Temp\i_ywuomjecwu.exe
    C:\Temp\i_ywuomjecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzwrojhb.exe ups_run
  2⤵
  PID:4724
- - C:\Temp\jhbzwrojhb.exe
    C:\Temp\jhbzwrojhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzwrojhb.exe ups_ins
  2⤵
  PID:3372
- - C:\Temp\i_jhbzwrojhb.exe
    C:\Temp\i_jhbzwrojhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvtoljg.exe ups_run
  2⤵
  PID:1540
- - C:\Temp\lgdyvtoljg.exe
    C:\Temp\lgdyvtoljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvtoljg.exe ups_ins
  2⤵
  PID:2488
- - C:\Temp\i_lgdyvtoljg.exe
    C:\Temp\i_lgdyvtoljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligaywqoig.exe ups_run
  2⤵
  PID:4788
- - C:\Temp\ligaywqoig.exe
    C:\Temp\ligaywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligaywqoig.exe ups_ins
  2⤵
  PID:3508
- - C:\Temp\i_ligaywqoig.exe
    C:\Temp\i_ligaywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvpnif.exe ups_run
  2⤵
  PID:4160
- - C:\Temp\nlfdxvpnif.exe
    C:\Temp\nlfdxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvpnif.exe ups_ins
  2⤵
  PID:1276
- - C:\Temp\i_nlfdxvpnif.exe
    C:\Temp\i_nlfdxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1360

C:\Temp\yvqoigdyvq.sys
C:\Temp\yvqoigdyvq.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Temp\ysqkidaysq.sys
C:\Temp\ysqkidaysq.sys
1⤵
- Executes dropped EXE
PID:1216

C:\Temp\xnhfaxspnh.sys
C:\Temp\xnhfaxspnh.sys
1⤵
- Executes dropped EXE
PID:5608

C:\Temp\vpmkifzxvp.sys
C:\Temp\vpmkifzxvp.sys
1⤵
- Executes dropped EXE
PID:5820

C:\Temp\spkecwupmh.sys
C:\Temp\spkecwupmh.sys
1⤵
- Executes dropped EXE
PID:5744

C:\Temp\mjhezwuomh.sys
C:\Temp\mjhezwuomh.sys
1⤵
- Executes dropped EXE
PID:5556

C:\Temp\wuomhezwjh.sys
C:\Temp\wuomhezwjh.sys
1⤵
- Executes dropped EXE
PID:5924

C:\Temp\rojgeywqol.sys
C:\Temp\rojgeywqol.sys
1⤵
- Executes dropped EXE
PID:3456

C:\Temp\nljdbytqlj.sys
C:\Temp\nljdbytqlj.sys
1⤵
- Executes dropped EXE
PID:248

C:\Temp\fdyvtnlida.sys
C:\Temp\fdyvtnlida.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\vqfdxvpnif.sys
C:\Temp\vqfdxvpnif.sys
1⤵
PID:1924

C:\Temp\spkicaxsqk.sys
C:\Temp\spkicaxsqk.sys
1⤵
PID:1152

C:\Temp\upmkfcausm.sys
C:\Temp\upmkfcausm.sys
1⤵
PID:3616

C:\Temp\cwusmkecwu.sys
C:\Temp\cwusmkecwu.sys
1⤵
PID:3280

C:\Temp\jhbzxrpmke.sys
C:\Temp\jhbzxrpmke.sys
1⤵
PID:3064

C:\Temp\omgezwrojh.sys
C:\Temp\omgezwrojh.sys
1⤵
PID:964

C:\Temp\ljgbytrljd.sys
C:\Temp\ljgbytrljd.sys
1⤵
PID:5148

C:\Temp\nlfdyvtnli.sys
C:\Temp\nlfdyvtnli.sys
1⤵
PID:4524

C:\Temp\vsqlidavtn.sys
C:\Temp\vsqlidavtn.sys
1⤵
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxspkic.exe

Path C:\Temp\i_nhfzxspkic.exe
Size 243KB
SHA256 84e6213efb6bc44baa431a9d02122d899a94997a3903dfa66ba682f00fcc9476
MD5 f13d65834a98c5920eae045e8d6db0d7
SHA1 7c55b78669084bc801c34c97ae427c6e4088414c
SHA512 ce0e2c9359e4ece2788b92c96746084f7ecf4932654196bfeb5c5bd38ab8f221becba433b4fbdd383f909b266afe3fdba1413f134c3673a072bba79a01754f24
SSDEEP 3072:DVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:RXP7LQMa3lLNngoqRttA7C
TLSH
T1DE345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkeczusmk.exe

Path C:\Temp\i_pmkeczusmk.exe
Size 243KB
SHA256 7cda103743c79a98996540a3ec566f2eb7c3415035d5b3903d16fbca182c7357
MD5 9b8a08417ce3910eb15fa8a0d714d008
SHA1 1bfb7cb168494921091b321f100f5d84a50d9fc5
SHA512 240f44c96b3a0430f3cc8919978314edc109acaca3e2e2f452762fc9b7a38f58cf485af64f64ad2e58f7abade7c34cb17a23fe589e43a59fa0dd7d077202f356
SSDEEP 3072:3VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:lXP7LQMa3lLNngoqRttA7+
TLSH
T17B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlidaysqn.exe

Path C:\Temp\i_qnlidaysqn.exe
Size 243KB
SHA256 8520ae230b38aed658974cf902ba36cbb71f2327f90db7701f2b9fa4e6e30e5e
MD5 f743ab493ee88f8a87f82b2a9ea94630
SHA1 97ec22cb06b75012ea9c0f97d35adc69b6df90c6
SHA512 70fa57f4a015591385b25f47782cc7e8183de1ad7f54a638fac943ee2199f48a6dd7a1db44c9d2d8a27775d36a086ca4a027534dc1d36fbd94cd6b1516e92c01
SSDEEP 3072:wVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:cXP7LQMa3lLNngoqRttA7h
TLSH
T1D5345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpfzxspkhc.exe

Path C:\Temp\i_vpfzxspkhc.exe
Size 243KB
SHA256 cb195c4876b8f134d679139e2c8f1729cb224236cbc0fcb7593025fcbce2945f
MD5 7d620f1b33087396ec8edd7dc98019b5
SHA1 6606d8e58f743310ca51f53ee611f47852c22edc
SHA512 467ed60a60a045b4f3481ed5ea03dd07c9f4dc331ef2477fea7288266864e7f817db972eabbc8dec4c486dd868e46460bf0271bdbf519ce4dbfddd797498708f
SSDEEP 3072:9VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:PXP7LQMa3lLNngoqRttA7I
TLSH
T155345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvqn.exe

Path C:\Temp\i_vsnlfdxvqn.exe
Size 243KB
SHA256 dd993fdd3674aefcc82c2c10d31153b6beedb13c4f7a25d8178ce9a872ad5363
MD5 1178508415b306a80702159498347b05
SHA1 f427e95373f2022794886b1f8e80d6b12b8401b2
SHA512 00e02fbd0661bbeab1a356d33c1ed743eec93d15c538671bc15c8ba5b9e714aedc625fb728f9296031b067f8be9827889b99e2b1ad3fd010b228790987b10abf
SSDEEP 3072:zVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:BXP7LQMa3lLNngoqRttA7a
TLSH
T1E8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljdbvqo.exe

Path C:\Temp\i_ytrljdbvqo.exe
Size 243KB
SHA256 3c0a50d04bae47893bdc6f6c1ae28994ca56caabc768d904c4a9792a99116f6e
MD5 14eebc22799c9e4c517cc248dcd9e2ba
SHA1 e2bdb1b50d49be2e0d8cce9ce585f09dfd1be029
SHA512 88c3851839429cb0b992f715dde6cf4c608241812673277187f930b24c9928f7fad52550091954531da6841b2323c2186dbec9bb93ef7037b8a4faa2b8432bbb
SSDEEP 3072:yIVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y7:rXP7LQMa3lLNngoqRttA7M
TLSH
T1D4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.exe

Path C:\Temp\nhfzxspkic.exe
Size 243KB
SHA256 e316e06220c8af640a092f368ca799775fd7f85ce888467b0f3a757abd009b31
MD5 664ff755d107fbded3cc4799932fe316
SHA1 e1f4769778ec26e11a3ce7bac9589b70f82ff6a7
SHA512 6e0c9b62138291e39f0560e15182c0cb7d9149401ca4ba2cfa8f6a10ae734b74777ca2ef1235722f1e63dd4392773516d0e440b073e6058d30b95e4ab0b6f8d9
SSDEEP 3072:yVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:yXP7LQMa3lLNngoqRttA77
TLSH
T16E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkeczusmk.exe

Path C:\Temp\pmkeczusmk.exe
Size 243KB
SHA256 8fe79efea586af6d0650f40802d83e1d664b5dff719553f903a3fc38f21f3682
MD5 ee9d0684bbcaf3683cbc08bfae39c4a1
SHA1 b22f39a31d1ee647803d87a58d73a27e01d07182
SHA512 a6009b51e78dee760d554919a53f1e8a74c06453d282f2a6917ca4db4b8a265c5b4706a5afba7ff8c95ba83c039ea7aa8c3d9da4d144e7db8d1a6f59548a0e1e
SSDEEP 3072:HVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:1XP7LQMa3lLNngoqRttA7e
TLSH
T1D4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidaysqn.exe

Path C:\Temp\qnlidaysqn.exe
Size 243KB
SHA256 8530209a5e69cff2be98a3f58795f0467bc2ecfe5905d51e009c833538dc9d11
MD5 721b68bb228109fded01cefafc8a1ce9
SHA1 1519e9e36d58536261a7be1bcb41c120d4bca6d0
SHA512 4dce3bc938f0b97f103ed019d91c3a1ca52c9835595ef7f110d2eb2c0aa92b934f23727b9c9392ada1f8d84ed51cbcd597074ca619746afd46754bde98b09736
SSDEEP 3072:RWVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H5:IXP7LQMa3lLNngoqRttA7Z
TLSH
T1FA345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkecwupmh.sys

Path C:\Temp\spkecwupmh.sys
Size 141KB
SHA256 94ff586f2a1dbdbdec5f1181315e4c965df0e3e2d5ac6a4da2d381357f203985
MD5 003966d34211d95e73aed1ce7a479916
SHA1 a443f1dd0cfef8bb24ffe2f5171ff2e5d2bd559f
SHA512 dc5652c45787023837635adbb39262022e1162633dbee7543b903f0bcfde77a1c83adf86fe9169536c36b790d697b266af775fdd8005bfd24e4dd54f37ab9c00
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E4E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpfzxspkhc.exe

Path C:\Temp\vpfzxspkhc.exe
Size 243KB
SHA256 70ecebae56346fbc5a97a7c2ea64ce9d00bcc92420542f044e029e9e3f8d3526
MD5 988392cc5608220682eb6c11d7e209e0
SHA1 19c49362e9e50d6618dc2e5c60ed6f0cf42a801b
SHA512 d19183241517353ef9438aa05e50d3d0e519f44da95c911b4c04ddf8ab66044efbb57662bc0cfc277decb1758bc3b3deade9812b41f1109e58a3ced8913e86e3
SSDEEP 3072:9VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:PXP7LQMa3lLNngoqRttA7k
TLSH
T1C9345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpmkifzxvp.sys

Path C:\Temp\vpmkifzxvp.sys
Size 141KB
SHA256 2fa3a2e236157ece25bd981412c9ca3910d3b40510b10e367cf0ebddd1839d2a
MD5 4c938ff137656fe42339ed045a266943
SHA1 90191e118b36ebee5b5b96091e523dab3f2cfde2
SHA512 250dc9edb316baa0889acc92b15414c32a37a94964848d1abcbfc20703328e975e0b9e53e2cfbb17cee03e5017c3897aafbb9d54fb857df14baee2438b12506a
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 243KB
SHA256 2da051ae1319a5ba6ca9b6d33c59426c6af03be4aecdd4fe52142efba69e7869
MD5 ce5605e6a80462ebe5f0b3711a915655
SHA1 100f88006d7fe2a13ed9ee0858fa425228e03fcb
SHA512 3a0afb7637875caab1ff25085a2c00064cecac4b5325e61d6f7b5ae14395961238c5a5948b85d23fc5b72acfb17ee9e234869ff41b47798b8f61fedbe51c5bec
SSDEEP 3072:DVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:RXP7LQMa3lLNngoqRttA7e
TLSH
T151345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xnhfaxspnh.sys

Path C:\Temp\xnhfaxspnh.sys
Size 141KB
SHA256 0dd411e6a8ca3e9d1c3abd173711d6e59efdeb4dc0b6fe4b6b4d2a8e82dddae3
MD5 7bf8a3d04b5b97df4a22c0ad5c878a5d
SHA1 10c093a02fb98833070af7e0e9d31181e258eeb9
SHA512 8188f0e5f612b0e9597d9b6b89d18d9ceb71cd4388e633d8c1644b3cff7ec4d0c8839015004b689cacce327b4508e9b791897965509f8bdbe9ce4504fe544df0
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidaysq.sys

Path C:\Temp\ysqkidaysq.sys
Size 141KB
SHA256 a2f64bacfd02c9609017520aa54c1fbeee04f78249dac012a76e92c5717811b8
MD5 5a57e78b060d0b198fc87769d3365aa4
SHA1 395a0802caac98765da8a30f6a192f589fe2a179
SHA512 003a7ac5bcc6998dae74bf5049d425e8877058210b8ea879623efafe0c4f0c3ebd79a63d22562636e85bfe228bfc75768a6821b94238878ff379cf0831258c3e
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvqo.exe

Path C:\Temp\ytrljdbvqo.exe
Size 243KB
SHA256 4cdbc40b99c28ab3e623d4ac9665b43eec564d3b4fb26b89288859eba6d4493b
MD5 fb3a2e9174ce8cef3e30a7a0c44ea473
SHA1 71b77d123c884142e904c0e301a3853dceb1ac94
SHA512 1a24732f21ea521485b64ed6c1844dd6737447440a6a6faa5a20e00c09e2eed2b207537c08603a033b7492cf196ab90ee2fb620d5f253f797be0e0e7454a5bc4
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:aXP7LQMa3lLNngoqRttA77
TLSH
T1C0345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdyvq.sys

Path C:\Temp\yvqoigdyvq.sys
Size 141KB
SHA256 7fa645ce9a800841090602e335e8305610b2e0ac41d1e2317087e3a0e40b2c04
MD5 56746eb0eff32da8897b4ac068c3bd9d
SHA1 dae88887f2d5d1000b4488f28dc271979ec9be5f
SHA512 31afe4318ef31bd9ae3ed2ffebda6a3c9e87d11f57afde25562d9506a87ccfecefdf04f4f3d376c984b1786381fae93998902e3f37cb1f7637070cfa0468d930
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03a0b574-91a7-44ff-a4ed-cdb89f9d7726.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03a0b574-91a7-44ff-a4ed-cdb89f9d7726.tmp
Size 40KB
SHA256 52c350ad5b8147b50e65e192548c31d250601319423393b52bfb4ca5621a2eb8
MD5 a69c4c1b530ace445a06ba619ccaba34
SHA1 0254051b7b92453a8cf8bb831d22f1d068f641f3
SHA512 8d8b07c4e579710992ec483a69c171ed277a1ffcca3b92670e092d222a6b57a1a326399ef8e04014333de428de160c40c0e040b02aab8e136429959e373dc634
SSDEEP 768:FB/UxvxjgC+w3zoCywaSO5vwzZ3MIYNa8S5oYklnA+XVug:qZj3+w3MzvuTWRdAcIg
TLSH
T15A13B03569A5AD6398AA6385B20B6393AEF41173D4C56EFC89E80A4E05C73EE1303816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d64f9ae-e439-427a-a9ab-fe36a77f3b5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d64f9ae-e439-427a-a9ab-fe36a77f3b5f.tmp
Size 34KB
SHA256 283e3491ccd0d42335f363716f20263ddbee7bbef3ca7ee9a91d35345a81f7eb
MD5 1fe167ae9bab56d57ed6b58bfdb12dae
SHA1 28d8e6399c88bba541681513dc846af955108bdd
SHA512 bd32c51b27986953116da4a35752fd4b3f2d2f2491da158271fe7d7be7bbda2c209198d8b5db85ab1e1e220d7130463cb4417f89db6e24d9defd88088498ab9d
SSDEEP 768:zJ3JoCyIaSO5vwzZCMIYNa8S5oYklnA+XVaH:zJ3ivvrTWRdAc8H
TLSH
T10BF2BF3069A1DD7388AA93C5B20777826EF85273D4885EDCD8EC4B0E14836FF2313826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29fe142c-2932-4205-b02b-253a3c9c9040.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29fe142c-2932-4205-b02b-253a3c9c9040.tmp
Size 42KB
SHA256 9bc7bbd0edc3fa505072c1e7aebc6a41272fc76147373a492fe1da8511818902
MD5 9b4918026193c24ef3fc963113317d7c
SHA1 75d8fa20cc51a007a2219743901ce41144f932b8
SHA512 c53e08df101626fe6eb9c922041fe94f996ecccbd0a5aa87479bd80e18bd79de3b413886c2be141348c90277511bd037cc62a04d2a15e531bda461e61eee341d
SSDEEP 768:DFQf3vwg5oCygtXO5vwzZHMIYNa8S5oYklnA+XVaH:mf3YtvmTWRdAc8H
TLSH
T1741317F598D38977D8AE5387A33D6E429EBCD163B4889998B7D80D4DCC821BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

012604a5-9988-4904-a5d0-a28160b3a684.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\012604a5-9988-4904-a5d0-a28160b3a684.tmp
Size 11KB
SHA256 53dc34b3ed651096b95ca5221d87c585957bf4c38eaaff0aefc45533af0f4acf
MD5 3ec772cdb98fa7e5797957bebbf94f23
SHA1 03badc65e1a8c125134094ed4f59cba72c2d1330
SHA512 7b7a9152e69b174ebc577a5c92eac3f86ea86640d21cbeb3dc2c22a81f4e74b65b4359682444b8e4a41302a95aa846f65e357472333223ebfa45dd4ff5d9bf18
SSDEEP 192:sxRibR5Cg/fF1sFiZrQUMzoA8p9o/g6+WNCkb/YupiWGR9SIgDCeJ:sxRibag/fF1sFkrQii/5V//l
TLSH
T107429415A928A97B8CCBD21DBA557F13D6FD1032A0D11F4CAAFC8A1C14EA6DD231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

11149d89-3a06-43b3-8b3f-b247865e3db4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11149d89-3a06-43b3-8b3f-b247865e3db4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9adf7e63-217d-4c75-8e7b-85aeaa126227.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9adf7e63-217d-4c75-8e7b-85aeaa126227.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7928f4d8bbbece7bdc17922e66458976972d0d406c079e24645378cd9851b8ab
MD5 2012fd4a4450b4be0527161c11bf7b87
SHA1 72414681dd5f11be89ccefc578327e760ccd1f46
SHA512 04591d0b1066abfb40e0b74811cdce2cee0b99262dd2bfd4b47eed5b62d82eb47c4d30dc71d43961dbb1ff084435711cb1a8825654c638d5a03a2dea159ec08f
TLSH
T1CB614DB396A04F53FF9C0C31A6C71E87FE32869258CB2F5325A8D77806173FA005618A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd951245a64978eb93f61e322d048061a95b881b0c634daf062f283a234da50d
MD5 f5f7cc102b8501a4125559bb6fdd30f4
SHA1 89fd355572f5e854f6400bd6372af3e4eec9829c
SHA512 e3e8aa383624724b189083d2433e6fe3892038e30bf79b6efe4518200336c08714ca8533f3ee76d26ac2d6c9994c027d27714c2e670a337834175c5369d305e3
TLSH
T1B2613CB396A04F53FB9C0C31A6D71E87FE31869258CB2F5325A8D77806173FA005618A
MD5 SHA1 SHA512 TLSH

Submit Download

684c7ce3-72a0-4a55-a993-b14682ffd7d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\684c7ce3-72a0-4a55-a993-b14682ffd7d0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8421d403-5e28-447a-b8c6-857f0fe31014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8421d403-5e28-447a-b8c6-857f0fe31014.tmp
Size 2KB
SHA256 917ad3eebfd4136fb841e4bd3702fb5be63d9d2c17ecc6b6d82f50bf4adbd163
MD5 5540cee921bee544e1071c4d6bf393af
SHA1 a7e6adc340fc762a9d159c4f13d1f447909223cf
SHA512 0aff72034863a799eb0fbd8cfc1a876cf11cd58c29eb1bf2a5bed19f9f5447b57332facbecf6d696df2a1089db8dd8eb31a5024a71adc25a436febcb82b32420
TLSH
T16E51A0F3C2E8866D890196F4AB146E1BCE1D0954832C3D5AC9E49F6B93E3471D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

a2ba0d18-8b01-4e98-b34d-74fc963bec2d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a2ba0d18-8b01-4e98-b34d-74fc963bec2d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

aa09c58d-e11d-4ce9-93f4-0da777669a81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa09c58d-e11d-4ce9-93f4-0da777669a81.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 84be0a85266ddecf6b8f0e834c3a82be883d619dbe697764358de3067e762c3c
MD5 06719375688177a170cb11432f82f459
SHA1 5f766567b7198fc071ad91a4295ac1a2f9a21eb5
SHA512 ae37e5b2a4375c4e1522edebf556adab1f5197b4e24f3cefc94b2dc21f1597139bbf4a0c5c3fc200b6b848a2cd288b591a934d833b6926fa221e17d59447e7c1
SSDEEP 24:KSgzg4aItKghg1mStOZyXqZqFEJIvKlh4/5Z/a/5/m8/jT/1/h/vO/5/DA/mIt/0:KgVItKWgQnyhSIvKj/4IbKF6cTyR0
TLSH
T173917121717B4A0039BD370451A49A5A564231B33064BA6F7BED90A58F2FE4C8DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1466bcf-b9cf-4c14-8d7e-11a1eba928e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1466bcf-b9cf-4c14-8d7e-11a1eba928e6.tmp
Size 11KB
SHA256 a5d3ea4d6a4b734a31592cf51438d4f25355d0c5dc57fed6a0874685b33e9889
MD5 cc62f564caa97130a8310863be1a6d05
SHA1 b428824b258e281c2fe335f32c7de8e85ede7747
SHA512 7c617c860501d8063c1442e11dce8a03db91485f1537aab49532f679a4ba86a0a941055a23b5a5577b932da3a8424bd16bcf530caa5c9467f8840f11401f371e
SSDEEP 192:sxRibR5Cg/fF1seiZrQUMzoA8p9o/g6+WNCkb/YuAiWGR9SIgDweJ:sxRibag/fF1sekrQii/5V/Ur
TLSH
T12542A415AE28A97B4CCBD21DBA557F13D6FD1032A0D11F4CAAFC8A1C14EA6DD231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfe39466-a318-461e-bb2e-1c33a95371e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfe39466-a318-461e-bb2e-1c33a95371e9.tmp
Size 11KB
SHA256 e04ffb2770bc5422f78e0dfa2834325137eeffe3d79410dec0c3bab2b2d83ca6
MD5 370a2904394377be8e6063d6d329f521
SHA1 44e4a1c7034279200eeea5bb9c23357f96642250
SHA512 c2df10714d66d3c2c9befa826871347b520b9cac1de25586fe6e29d0eacd28d96ae9948edba2d645b0ef06bac49a7c634d97ebe1ab525bfd179e81d6b736ed1d
SSDEEP 192:sxRNbR5Cg/fF1sjiZrQUMzoA8p9o/g6+WNCkb/YuAiWGR9SIgVeJ:sxRNbag/fF1sjkrQii/5V/UY
TLSH
T14C32A515AE28A97B4CCBD21DBA557F13D6FD1032A0D11F4CAAFC8A1C14EA6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efcad004-d051-4656-8dbe-0f1275f4c1f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\efcad004-d051-4656-8dbe-0f1275f4c1f5.tmp
Size 29KB
SHA256 e0620e8f57c7f42b22114e9b88c85a8cf89220e0169ff16d2d7c7baad865bb15
MD5 b758ba41a31f6b83f6845d5fa82fa283
SHA1 668fd1f7960ec984e5bcdea4d26b0fe7f0637c91
SHA512 c8ed873ba8879e8a3af47f78341c48d362056a6409d90134e60f6634c3a7f0cfe590575421b82ac6d97e20a8416e03c130156a05002e607e580b78a36cbc90f2
SSDEEP 768:/jnhhH7pLuLbcJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjGlRkPWrosdsU:/jnhhBEbcJWg6cfCwu1jacGliPtAsU
TLSH
T19DD2D97B740CCA7F4F900ADDAC197E9F6DA802CB9698C98047FE945C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b94e1cca-9f55-4dee-9262-9b3beeb72ed2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b94e1cca-9f55-4dee-9262-9b3beeb72ed2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf985978-a3a9-422d-b99c-afe4bf729904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf985978-a3a9-422d-b99c-afe4bf729904.tmp
Size 38KB
SHA256 2ebf96b57f922f5dee4f739e14cc4e266397878316bbce6d7786e4a6b9ff91c9
MD5 7efc344683c6a2fc6bfc7cba9197cd1c
SHA1 3599e9c9f6707f8e8e5d7bdc86019591e9b112c3
SHA512 dd55dfc5166bb44f048c12a3c6829261262d4e5666ae4f1142965259c2b6cd46b0e12f26c1d94528b1c060ad3e6c981825fd2f02b3e2f6fb78e7c044442e6a8a
SSDEEP 768:do/UxvxjgC+23YfJSO5vwz5JMIYNa8S5oYklnAaGSH8L4:nZj3+23KNvEHTWRdABS04
TLSH
T11303C039ACE4A8778CF663C4B20AA357AEF55263D0C16AF889EC1F0E16C72BD5303455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0793225b-2b65-463d-a371-6b05f674b959.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0793225b-2b65-463d-a371-6b05f674b959.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

11b62680-7d11-411e-86da-e4e89fbd340d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\11b62680-7d11-411e-86da-e4e89fbd340d.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

f7975b5f-6f67-4809-ab85-0c365585a801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f7975b5f-6f67-4809-ab85-0c365585a801.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

faccf939-fa92-4435-8e56-44d9c28e3a48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\faccf939-fa92-4435-8e56-44d9c28e3a48.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d3852ebf-4cb8-4b5a-a401-bb4087f12092.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d3852ebf-4cb8-4b5a-a401-bb4087f12092.tmp
Size 34KB
SHA256 c2bdc39f44f40cfd45ee208102c1e8b8c0346959d9ae6e33af7e0d4fe9cdb53d
MD5 cd6069c6faf594eb02478b8f5a25d7a7
SHA1 b9f76f5b37f86b6f9cb64c638d31c86e70c5b954
SHA512 923cee3f14b24e7463e97a0b5971ba2a42793e38409ed77f1467838e0f1a18825dfd1f09ae6c39b01d1a51ae1761f51f06737f85f7f555576eb5aa50a5bf63ea
SSDEEP 768:FtJ3soCyIaSO5vwzZCMIYNa8S5oYklnA+XVaH:LJ3tvvrTWRdAc8H
TLSH
T1A4F2BF3069A1DD7388AA53C5B20777826EF85273D4845EDCD8EC5B1E14836FF2313826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43391444-6c4f-4b3f-9a8c-163362f12cad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\43391444-6c4f-4b3f-9a8c-163362f12cad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

027a6a98-dcf2-437d-872a-3ae23caabc1a.tmp

Path C:\Users\Admin\AppData\Local\Temp\027a6a98-dcf2-437d-872a-3ae23caabc1a.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1528375-bfa8-4c66-a39b-f72e6cbf1753.tmp

Path C:\Users\Admin\AppData\Local\Temp\c1528375-bfa8-4c66-a39b-f72e6cbf1753.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1039508730\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_1683597046\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_231855985\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_272656471\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3776_508771276\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/964-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1216-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1216-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3064-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3280-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3280-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3456-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3616-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-482-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5148-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5556-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5556-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5608-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5744-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5820-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5924-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download