18b015bf8cd24d37200857c2316828daf8818a9e7aeb9fdfd6bcf7a469fa51aa

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe
Size 243KB
Sample261015-182ejady2x
SHA256 18b015bf8cd24d37200857c2316828daf8818a9e7aeb9fdfd6bcf7a469fa51aa
MD5 f9a0070f6b711fde639e4f8af1f72fdd
SHA1 430e653e1a8702deb375db40fdfaa9357866b161
SHA512 9406564ca8a5519852558e3ce25a96e5130bf8186b1e0fa7cf40accdfe287c6e07b18269ea5bfdb88eee3a22a140d8d2113b22744bf076aa1d3fdc49027e9248
SSDEEP 3072:+hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:iiA7nLtm/ka3lLNngoqRttA70
TLSH
T1AF345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1752	CP.exe
1804	pnhfzxspki.exe
5656	CP.exe
4404	CP.exe
3520	i_pnhfzxspki.exe
916	czusmkecwu.sys
4116	CP.exe
8	urpjhczxrp.exe
3740	CP.exe
5912	CP.exe
4488	i_urpjhczxrp.exe
4180	pjhczurpjh.sys
3244	CP.exe
1104	cwuomjhbzw.exe
4340	CP.exe
2184	CP.exe
5704	i_cwuomjhbzw.exe
5128	hbztrpjhec.sys
3036	CP.exe
3520	jhbzwromge.exe
2988	CP.exe
2436	CP.exe
4452	i_jhbzwromge.exe
1072	tolgeywqoi.sys
1260	CP.exe
3640	dbztolgeyw.exe
1324	CP.exe
464	CP.exe
2628	i_dbztolgeyw.exe
1952	igeywqoigd.sys
1940	CP.exe
4720	lgdyvqoigd.exe
4860	CP.exe
6120	CP.exe
4284	i_lgdyvqoigd.exe
1544	lfdbytqoig.sys
3696	CP.exe
5368	yvqoigaysq.exe
2376	CP.exe
4812	CP.exe
5492	i_yvqoigaysq.exe
860	nlfdxvpnif.sys
6056	CP.exe
5996	lfdxvpnifa.exe
2424	CP.exe
5664	CP.exe
3296	i_lfdxvpnifa.exe
3608	pnkfcxusqn.sys
3748	CP.exe
1204	kicaxsqnhf.exe
5468	CP.exe
3960	CP.exe
3972	i_kicaxsqnhf.exe
3524	snkfdxvpfa.sys
4840	CP.exe
1300	zxupnhfzxs.exe
2656	CP.exe
4952	CP.exe
3124	i_zxupnhfzxs.exe
3208	eczxupnhfz.sys
940	CP.exe
2368	eczurpmheu.exe
3472	CP.exe
1344	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1924494321\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1084312767\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1084312767\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1924494321\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1924494321\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1924494321\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_370987904\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_383186286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_383186286\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgbywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurpmheu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurpmheu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgbywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5600	ipconfig.exe
2460	ipconfig.exe
3424	ipconfig.exe
3164	ipconfig.exe
5632	ipconfig.exe
2696	ipconfig.exe
2784	ipconfig.exe
5560	ipconfig.exe
5664	ipconfig.exe
3008	ipconfig.exe
4260	ipconfig.exe
5752	ipconfig.exe
2188	ipconfig.exe
4724	ipconfig.exe
4188	ipconfig.exe
3532	ipconfig.exe
5100	ipconfig.exe
3448	ipconfig.exe
3964	ipconfig.exe
5968	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{6F5531BE-4D5C-4DC9-8EB6-A6B5A426083F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	i_pnhfzxspki.exe
Token: SeDebugPrivilege	4488	i_urpjhczxrp.exe
Token: SeDebugPrivilege	5704	i_cwuomjhbzw.exe
Token: SeDebugPrivilege	4452	i_jhbzwromge.exe
Token: SeDebugPrivilege	2628	i_dbztolgeyw.exe
Token: SeDebugPrivilege	4284	i_lgdyvqoigd.exe
Token: SeDebugPrivilege	5492	i_yvqoigaysq.exe
Token: SeDebugPrivilege	3296	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	3972	i_kicaxsqnhf.exe
Token: SeDebugPrivilege	3124	i_zxupnhfzxs.exe
Token: SeDebugPrivilege	2720	i_eczurpmheu.exe
Token: SeDebugPrivilege	3660	i_mkecwuomhe.exe
Token: SeDebugPrivilege	6112	i_jdbwtrljdb.exe
Token: SeDebugPrivilege	6048	i_lgbywqoigb.exe
Token: SeDebugPrivilege	4196	i_tqljdbvtol.exe
Token: SeDebugPrivilege	3700	i_davsnlfdxv.exe
Token: SeDebugPrivilege	5324	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	2444	i_mkhfzxspki.exe
Token: SeDebugPrivilege	4960	i_usmkecwupm.exe
Token: SeDebugPrivilege	5612	i_xrpjhbzxup.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 4712	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	89
PID 4712 wrote to memory of 1604	4712	iexplore.exe	90
PID 1604 wrote to memory of 4204	1604	msedge.exe	91
PID 1604 wrote to memory of 4732	1604	msedge.exe	92
PID 1604 wrote to memory of 1772	1604	msedge.exe	93
PID 1604 wrote to memory of 1772	1604	msedge.exe	93
PID 1604 wrote to memory of 1772	1604	msedge.exe	93
PID 1604 wrote to memory of 4408	1604	msedge.exe	94
PID 1604 wrote to memory of 4408	1604	msedge.exe	94
PID 1604 wrote to memory of 4140	1604	msedge.exe	97
PID 1604 wrote to memory of 2904	1604	msedge.exe	96
PID 1604 wrote to memory of 4140	1604	msedge.exe	97
PID 1604 wrote to memory of 4140	1604	msedge.exe	97
PID 1604 wrote to memory of 2904	1604	msedge.exe	96
PID 1604 wrote to memory of 2904	1604	msedge.exe	96
PID 1604 wrote to memory of 5932	1604	msedge.exe	98
PID 1604 wrote to memory of 6116	1604	msedge.exe	99
PID 1604 wrote to memory of 5932	1604	msedge.exe	98
PID 1604 wrote to memory of 5932	1604	msedge.exe	98
PID 1604 wrote to memory of 6116	1604	msedge.exe	99
PID 1604 wrote to memory of 6116	1604	msedge.exe	99
PID 1604 wrote to memory of 2920	1604	msedge.exe	100
PID 1604 wrote to memory of 2920	1604	msedge.exe	100
PID 2152 wrote to memory of 1752	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	102
PID 1804 wrote to memory of 5656	1804	pnhfzxspki.exe	105
PID 1604 wrote to memory of 4772	1604	msedge.exe	108
PID 1604 wrote to memory of 1688	1604	msedge.exe	109
PID 1604 wrote to memory of 4772	1604	msedge.exe	108
PID 1604 wrote to memory of 1688	1604	msedge.exe	109
PID 1604 wrote to memory of 4188	1604	msedge.exe	111
PID 1604 wrote to memory of 1468	1604	msedge.exe	112
PID 1604 wrote to memory of 1468	1604	msedge.exe	112
PID 1604 wrote to memory of 1640	1604	msedge.exe	114
PID 1604 wrote to memory of 1640	1604	msedge.exe	114
PID 2152 wrote to memory of 4404	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	116
PID 2152 wrote to memory of 4116	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	120
PID 8 wrote to memory of 3740	8	urpjhczxrp.exe	122
PID 2152 wrote to memory of 5912	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	125
PID 2152 wrote to memory of 3244	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	129
PID 1104 wrote to memory of 4340	1104	cwuomjhbzw.exe	131
PID 2152 wrote to memory of 2184	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	134
PID 2152 wrote to memory of 3036	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	138
PID 3520 wrote to memory of 2988	3520	jhbzwromge.exe	140
PID 2152 wrote to memory of 2436	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	143
PID 1604 wrote to memory of 3380	1604	msedge.exe	146
PID 1604 wrote to memory of 2696	1604	msedge.exe	147
PID 1604 wrote to memory of 3376	1604	msedge.exe	148
PID 2152 wrote to memory of 1260	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	151
PID 3640 wrote to memory of 1324	3640	dbztolgeyw.exe	153
PID 2152 wrote to memory of 464	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	156
PID 2152 wrote to memory of 1940	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	160
PID 4720 wrote to memory of 4860	4720	lgdyvqoigd.exe	162
PID 2152 wrote to memory of 6120	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	165
PID 2152 wrote to memory of 3696	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	169
PID 5368 wrote to memory of 2376	5368	yvqoigaysq.exe	171
PID 2152 wrote to memory of 4812	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	174
PID 2152 wrote to memory of 6056	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	178
PID 5996 wrote to memory of 2424	5996	lfdxvpnifa.exe	180
PID 2152 wrote to memory of 5664	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	183
PID 1604 wrote to memory of 2592	1604	msedge.exe	185
PID 1604 wrote to memory of 2592	1604	msedge.exe	185
PID 2152 wrote to memory of 3748	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	191
PID 1204 wrote to memory of 5468	1204	kicaxsqnhf.exe	193
PID 2152 wrote to memory of 3960	2152	2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f9a0070f6b711fde639e4f8af1f72fdd_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcc396c188,0x7ffcc396c194,0x7ffcc396c1a0
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,14743220682335637852,268500444481212341,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3179714638776939745,15394712639055259021,262144 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,3086616771912330668,17623559877620007064,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,15476353266862291467,3270412472593820117,2097152 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,9196356318960484607,15805519516279673789,2097152 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,8391308224665721266,9509657611241002057,2097152 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,13452147373836277052,7868940653792447260,2097152 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:9
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,5651078638907777691,8256171106721925835,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,10056895092685643229,17064596144967415345,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,7208135582694979380,309331891915249378,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15352195401386339714,8926235124044844837,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15352195401386339714,8926235124044844837,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,7146319740856350707,17593635159139693758,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,13279466336877284984,13663981584601852154,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,6732728661033126119,12642757774364649865,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,6279983956011478937,6279883349960728014,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,15239759285804572696,12849242391001567480,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,11226377329542217156,3498625343618321540,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,8331313291646207949,15040038407732158218,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,13129798035619536089,13133906939240188738,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,15387846348955541264,5369493520192764086,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6212,i,3718912813970868862,756885381763485779,262144 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14044520294069652656,10645358202627991927,524288 --field-trial-handle=2264,i,9781380306592933431,12163493581321374741,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1752
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhczxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\urpjhczxrp.exe
    C:\Temp\urpjhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhczxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5912
- - C:\Temp\i_urpjhczxrp.exe
    C:\Temp\i_urpjhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomjhbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\cwuomjhbzw.exe
    C:\Temp\cwuomjhbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomjhbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2184
- - C:\Temp\i_cwuomjhbzw.exe
    C:\Temp\i_cwuomjhbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzwromge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\jhbzwromge.exe
    C:\Temp\jhbzwromge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzwromge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2436
- - C:\Temp\i_jhbzwromge.exe
    C:\Temp\i_jhbzwromge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\dbztolgeyw.exe
    C:\Temp\dbztolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\i_dbztolgeyw.exe
    C:\Temp\i_dbztolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvqoigd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\lgdyvqoigd.exe
    C:\Temp\lgdyvqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvqoigd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\i_lgdyvqoigd.exe
    C:\Temp\i_lgdyvqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3696
- - C:\Temp\yvqoigaysq.exe
    C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4812
- - C:\Temp\i_yvqoigaysq.exe
    C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6056
- - C:\Temp\lfdxvpnifa.exe
    C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5664
- - C:\Temp\i_lfdxvpnifa.exe
    C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxsqnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3748
- - C:\Temp\kicaxsqnhf.exe
    C:\Temp\kicaxsqnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxsqnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3960
- - C:\Temp\i_kicaxsqnhf.exe
    C:\Temp\i_kicaxsqnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupnhfzxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\zxupnhfzxs.exe
    C:\Temp\zxupnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupnhfzxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Temp\i_zxupnhfzxs.exe
    C:\Temp\i_zxupnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczurpmheu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:940
- - C:\Temp\eczurpmheu.exe
    C:\Temp\eczurpmheu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczurpmheu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1344
- - C:\Temp\i_eczurpmheu.exe
    C:\Temp\i_eczurpmheu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run
  2⤵
  PID:2500
- - C:\Temp\mkecwuomhe.exe
    C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins
  2⤵
  PID:4724
- - C:\Temp\i_mkecwuomhe.exe
    C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtrljdb.exe ups_run
  2⤵
  PID:4832
- - C:\Temp\jdbwtrljdb.exe
    C:\Temp\jdbwtrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtrljdb.exe ups_ins
  2⤵
  PID:1036
- - C:\Temp\i_jdbwtrljdb.exe
    C:\Temp\i_jdbwtrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgbywqoigb.exe ups_run
  2⤵
  PID:3524
- - C:\Temp\lgbywqoigb.exe
    C:\Temp\lgbywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgbywqoigb.exe ups_ins
  2⤵
  PID:2808
- - C:\Temp\i_lgbywqoigb.exe
    C:\Temp\i_lgbywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run
  2⤵
  PID:4184
- - C:\Temp\tqljdbvtol.exe
    C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins
  2⤵
  PID:916
- - C:\Temp\i_tqljdbvtol.exe
    C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdxv.exe ups_run
  2⤵
  PID:1476
- - C:\Temp\davsnlfdxv.exe
    C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdxv.exe ups_ins
  2⤵
  PID:4132
- - C:\Temp\i_davsnlfdxv.exe
    C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  PID:2320
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  PID:3852
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhfzxspki.exe ups_run
  2⤵
  PID:2784
- - C:\Temp\mkhfzxspki.exe
    C:\Temp\mkhfzxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhfzxspki.exe ups_ins
  2⤵
  PID:4156
- - C:\Temp\i_mkhfzxspki.exe
    C:\Temp\i_mkhfzxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:6024
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:3704
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbzxup.exe ups_run
  2⤵
  PID:1336
- - C:\Temp\xrpjhbzxup.exe
    C:\Temp\xrpjhbzxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbzxup.exe ups_ins
  2⤵
  PID:4912
- - C:\Temp\i_xrpjhbzxup.exe
    C:\Temp\i_xrpjhbzxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4692

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
- Executes dropped EXE
PID:916

C:\Temp\pjhczurpjh.sys
C:\Temp\pjhczurpjh.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\hbztrpjhec.sys
C:\Temp\hbztrpjhec.sys
1⤵
- Executes dropped EXE
PID:5128

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
- Executes dropped EXE
PID:1072

C:\Temp\igeywqoigd.sys
C:\Temp\igeywqoigd.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\lfdbytqoig.sys
C:\Temp\lfdbytqoig.sys
1⤵
- Executes dropped EXE
PID:1544

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:860

C:\Temp\pnkfcxusqn.sys
C:\Temp\pnkfcxusqn.sys
1⤵
- Executes dropped EXE
PID:3608

C:\Temp\snkfdxvpfa.sys
C:\Temp\snkfdxvpfa.sys
1⤵
- Executes dropped EXE
PID:3524

C:\Temp\eczxupnhfz.sys
C:\Temp\eczxupnhfz.sys
1⤵
- Executes dropped EXE
PID:3208

C:\Temp\hecwtrmjec.sys
C:\Temp\hecwtrmjec.sys
1⤵
PID:4892

C:\Temp\ojdbwtomge.sys
C:\Temp\ojdbwtomge.sys
1⤵
PID:2452

C:\Temp\omgebwtrlj.sys
C:\Temp\omgebwtrlj.sys
1⤵
PID:2200

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
PID:2940

C:\Temp\igaysqkiga.sys
C:\Temp\igaysqkiga.sys
1⤵
PID:3972

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
PID:4552

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
PID:4332

C:\Temp\usmkhczxvp.sys
C:\Temp\usmkhczxvp.sys
1⤵
PID:5604

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomjhbzw.exe

Path C:\Temp\cwuomjhbzw.exe
Size 243KB
SHA256 b0e4dbc5dafc6cd1f80932f66fbff4add0300b3d8ff26eb8462b781d864c163e
MD5 ce2fcdb8d3772bbe7e17816cecc9e152
SHA1 91525f34f759a144cc26ecadfa5e28f0da986192
SHA512 5e81e268ae7d695d23ebc6fdb2a25c6f9bbd92ac70b3d62c643d7f62a1b7aa92715e1c27cd0b174bda07edc982bb672d805b84b1cb488ac64940cd43d6cf7658
SSDEEP 3072:9hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:DiA7nLtm/ka3lLNngoqRttA7X
TLSH
T1C7345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwu.sys

Path C:\Temp\czusmkecwu.sys
Size 141KB
SHA256 8dcf25e515eff66e7dd35a48b3ba3881cef05dbbbc934502348f246e766a7525
MD5 ed995a87763040fbf27bd4e744e93735
SHA1 23113bb56addca54eb80f1492fe10cb2caddde39
SHA512 495188288a433739d0bab947e2b11ef60f547c394280d325662889275bd03933c81fc715faf3e500aeb786a65caacaec0814ddeaeaee6e48769fd540e3030ac7
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T198E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E643D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztolgeyw.exe

Path C:\Temp\dbztolgeyw.exe
Size 243KB
SHA256 be11613566179af09b078baabea1ed8ed28c0c3b717da6f72cbb3e059528ab16
MD5 dbaa437cf91319aa1a5fde66999260bb
SHA1 aa1ca2d5a0065bb02c040c617d8bc2a3db9ffeab
SHA512 1f7cfc41f4295acf30af04789f4f7f18f5a7d44131d694943c78881bb88607504f20b4c6aeb94faa9d531e1dbea5c6a0c6da036c99806816daf765ccab2d08ad
SSDEEP 3072:ehiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:CiA7nLtm/ka3lLNngoqRttA7A
TLSH
T1DA345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrpjhec.sys

Path C:\Temp\hbztrpjhec.sys
Size 141KB
SHA256 d3e36900dc31a89229ddcf2311d00d8d4d067899f7b5034d55638296b98b3ce4
MD5 738272e81b3730be4dc1d82aaf686048
SHA1 3bb9da2d80fc0293e2461112f9cf325deea03d9a
SHA512 2aecb579fbc632789c61a5ada3b6c90089195f0569ec183200ca24a956f680b31f3085abd96fcc3a1ac150698bd0a4ba9ca3bd4452dab1633253e440b550693c
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomjhbzw.exe

Path C:\Temp\i_cwuomjhbzw.exe
Size 243KB
SHA256 80094ad5e2b95195893595190f6283a7b8f45fd04bdae3156c9655764c860003
MD5 d3635e09940e594f3beb551650837dd6
SHA1 14f3da2df84936972a10fc5d83854751ba7a6fbe
SHA512 54fcaf95a82c34d79984e73c71e6c0eb6f9e6e60cecb0ee343e5e12f32db22a43d0f0438a56e0dd6b406730e518c347e0adfbe68cdb07b5b55b3b4b9be18c47e
SSDEEP 3072:hhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:viA7nLtm/ka3lLNngoqRttA7/
TLSH
T10E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztolgeyw.exe

Path C:\Temp\i_dbztolgeyw.exe
Size 243KB
SHA256 701780f6f6b35cc1c6a6742e7a6e3152bfa0b599c9edea12947380e667edc7ef
MD5 0e622d6e49ffb26d0c7c902641cf618a
SHA1 461699e3d54702a5c5405f0c64394a96a3260f2c
SHA512 4d17ae54af50e089efde2a23ff0ffda752514d7e82b43a6eb8a972f6b451ba8c00f8e84ac15a13e37a35fccb3d1edfe99ddcae0f1b8778d47433636134484267
SSDEEP 3072:KhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:WiA7nLtm/ka3lLNngoqRttA7k
TLSH
T1FE345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzwromge.exe

Path C:\Temp\i_jhbzwromge.exe
Size 243KB
SHA256 1662019099a7c0c63e0ad80d0a6f12025154f39e6c391e389001602495103a6e
MD5 a54bd29aa1be7f08aab26e44e5bf3610
SHA1 c706db625327b8fb3adf6db5990829ae7737d7df
SHA512 0ba9b7d82cc66a2eb2fb5e22556d52469a890ce7ca354c99cce1be784f76480de5924214f5bdb53162bb4a80d0a0a7994dd0c98ec7b655fa5eafbe4d71b16894
SSDEEP 3072:NhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:TiA7nLtm/ka3lLNngoqRttA7f
TLSH
T1D6345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvqoigd.exe

Path C:\Temp\i_lgdyvqoigd.exe
Size 243KB
SHA256 e8ca98dda1cf4d308d319b3d11553022ab93daa08b83f44358ed8296af9d1e2b
MD5 7beff8f592112cb41336aeb91171797c
SHA1 6ab1cb090ca5a7f57636bc95fe976efac5557dd8
SHA512 d49dcd869288cceec25c46580bf31d651388bcd0d57e95c2729e053061f00bb793c5e82c35770b4921f825d2cab6a0728c47d1d828a2d32ca932ca5ed07effc6
SSDEEP 3072:whiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:oiA7nLtm/ka3lLNngoqRttA7y
TLSH
T14E345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspki.exe

Path C:\Temp\i_pnhfzxspki.exe
Size 243KB
SHA256 b9d1c2157005cd6628fe873356de296387d10c1ed97ea605b2fc2be193a47108
MD5 d5aa0aac585469be34d526f6d6c6f2a1
SHA1 6b513e4eebadb4f3939ac2def444f5df5dbf2a23
SHA512 a8261ea525a41276b0b835dafbd4d87ba819d81092f0afd2d5fd2802f6ac0b9ebac172db6b841d350b0a2eda55799db44c47eba8e26601c506da1414a7756e91
SSDEEP 3072:0hiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:EiA7nLtm/ka3lLNngoqRttA7K
TLSH
T128345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhczxrp.exe

Path C:\Temp\i_urpjhczxrp.exe
Size 243KB
SHA256 6aec326b68995effdf63cfd23beb4696e99f790c2c665bcda6203809bc750a63
MD5 012abd2339fd5be9446e42ac9424c85d
SHA1 08979780d77a3df0e4484bb26c31de4f63bdba9c
SHA512 c26fee05891ed90b85ac94d409245faf5bc2260607d902588304450edf26d176e982cc35903ed449e23d70d618c9ee1658988e7a51d717a6d940f2b29552568d
SSDEEP 3072:mhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:6iA7nLtm/ka3lLNngoqRttA7w
TLSH
T1F8345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeywqoigd.sys

Path C:\Temp\igeywqoigd.sys
Size 141KB
SHA256 821bcd9f3fb459a5595fe3c50ad1124b088ec86b1daee905b44b085eb43e6a26
MD5 8c4f53feb818b9f4f3acfe0328f382d7
SHA1 553dca63f40bd2599c18bcd7420e4fa2cfe3aeff
SHA512 330cf03c93593d20c8fc63849b5494cf043d010170db0e0c70bdcddc6acfe8dee835aa757310efb755f76ee4e7061db73b3c7d21d56bba25728eb1dd16431fc7
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzwromge.exe

Path C:\Temp\jhbzwromge.exe
Size 243KB
SHA256 534c6e540e9b7618ad15e1aac871faa485d46a09119831086a2aa62668dae91e
MD5 e10ddda3492babc15f553d4fe5f5d1f8
SHA1 b50f558aacb1732e323744931f7e59fcc34ab728
SHA512 87baf60155c0b1b259421b483c01867412a0384f5e6a0f7b9aa4267816200510712752244965db61a6a94ab6fbb875e0f0f934d92a2c630a0062772e3fd7039f
SSDEEP 3072:chiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:8iA7nLtm/ka3lLNngoqRttA72
TLSH
T12D345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdbytqoig.sys

Path C:\Temp\lfdbytqoig.sys
Size 141KB
SHA256 6fb7d6c4529ccaa6230fa98dcc83b52ddbfd1a38e554e56cf8530e322ae9528d
MD5 f4f08c60866a01640c2ffddbd33d4e65
SHA1 3fcb69fa99b420fc92b642d744a1330625d395c4
SHA512 38a80c4b000481487642893e2b7b0e7dad41b3c2f4fee5f941428348c7e8fd09ab4afafb0aba482423b8265fcc537fd6595b23e7088a6f8f3fd5bff92546e2ec
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoigd.exe

Path C:\Temp\lgdyvqoigd.exe
Size 243KB
SHA256 e1d6949c912e2d76d31bcc09fcb7b794d2288ebbaa7c89c6ff5a478cd1a2a8a2
MD5 14e105bba9b24fb267ab20afe6191598
SHA1 adece0d3df7e9f166c80d82eb1f630d2e2dbae29
SHA512 d37d0a8964c1c1fcbe3e2a6ab9a7793f03269a9e72b35a2893117a4ddcf7c4e3217abd042e37f1a7368ec68b45d630c1043f66cc7c17defce04fd7fff286ccfd
SSDEEP 3072:AmhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+u:JiA7nLtm/ka3lLNngoqRttA7t
TLSH
T178345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurpjh.sys

Path C:\Temp\pjhczurpjh.sys
Size 141KB
SHA256 f869372ed66053d6be18b1f7ed1dc4b8ec6bf339af553c5ad7fc728dde22f844
MD5 69879015eca3c7822ee877b05dc44c69
SHA1 22fae9d7692c0d43a906a0859f221dc3d6440ce9
SHA512 1d316230108a22b9fad278873984a9852f1528d228fca39736ec3feb43aff0362e4690c7fe9d16201c2c92f31bcebf1c93ebd03a2c6fc004040179338d500c07
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.exe

Path C:\Temp\pnhfzxspki.exe
Size 243KB
SHA256 f6a0cf8c8e17d3e094b8d8a014a409063c0c5ada90112cb6a1e5f1feeb5773c5
MD5 d114ba4c7095bad02064bf822a73a68a
SHA1 76e1791dd9772d230915d9fc90fa670a1f9b1256
SHA512 1a11f5fb13ea6974c8f659e34da0175b01096f478607f56762c5be001f61ec6c94b61e847dbdad0deac2fc4e87dfdd280c6962395a697a6f6fcee39cd9261180
SSDEEP 3072:MhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:siA7nLtm/ka3lLNngoqRttA7+
TLSH
T195345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoi.sys

Path C:\Temp\tolgeywqoi.sys
Size 141KB
SHA256 21eb5730c35a130f3acbb9a0ad9b461ab3434957efd0465ed05d8c2d2be5d3b9
MD5 3fb3f4836f351f43eaeb6534ee4a56af
SHA1 2d895e04a10ea8f1e52d94b601d312d9f5db8538
SHA512 90e88c31d2b421527f11e7241a6a56cc9b49b34b63a9659b5d03039bdad834365db6e306e790395e0726bcb7416005d77a4a48e928357a0a996ca30ea160ae5d
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhczxrp.exe

Path C:\Temp\urpjhczxrp.exe
Size 243KB
SHA256 b9a7d03d7bd4067248db29692ce86766691a1501acfb35b84a1b1812af8f2582
MD5 c154a5d4abc68b1e764637081167ed1e
SHA1 46a48a5d25f0b753bf6555f6f6b6e87ddc7a4f79
SHA512 143ad9509e33252e12fb17db8bf1729a650b2e92bdfa616d7f3e53d1d4288b935a1c91fc9daea5c59f8a6a798123e801bc2d3e4aab722bc56a7bd81dc54f4fde
SSDEEP 3072:JhiA7nLtmcKJhr7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:HiA7nLtm/ka3lLNngoqRttA7b
TLSH
T181345A0272818031EB560B78045AE7A196BE7C344BA5E5CFF7683B791E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07a4cd0d-4b65-4752-a22a-9a32d6b4e936.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07a4cd0d-4b65-4752-a22a-9a32d6b4e936.tmp
Size 33KB
SHA256 944d018826169453fab3ad91bd48aa15664d776c32f2a9230da8d74f1bb56d5d
MD5 8796cbecc6cfc8a88242a1678f3d09ed
SHA1 b1a4fd62c76c59114dc2ff3df1e6a7206efd7b7f
SHA512 6f04ea5043382840c2561fb4251a148d39b544511c709936daf4c08e5e6b0fabf53e8e6cd6c4091c743dbdf0f9b348471c3c55db4fb9f6515fdb85aa3ec310c4
SSDEEP 768:Hy3Ha6U9TOfqfdlzLfdxzgyJYe1ELsAvC8/YE/cLm:Hy3HaCfqf7zLf7zJYe1EQujYmcS
TLSH
T1CEF28D71ACB5DE775EE66244B28A2793FFF4411398C84B54D6C92B0C04C72DE274F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18a9bcd7-ad61-418e-bae8-42b638acc1fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\18a9bcd7-ad61-418e-bae8-42b638acc1fc.tmp
Size 37KB
SHA256 48352f3e1557d836f91294b7adf86bf8694ad2b51b10d0fdc89cceb4331c4e4c
MD5 de340d19800bd4dc72589dc5d0775925
SHA1 de454b9cbb608f27e1c33ba97c670aef8e4342ae
SHA512 e81126ff6683adbdc2e2a2a7f2b2d5607d17f92587a934d53cd323792fbd0ec6626b7f0014392666b480412f6fe6819545f57c159a0b99372cb2aa1a8b8b1e74
SSDEEP 768:h/UxvxjgC+i3SQ9TOfqfdlzwKJYe1ELsAvC8/YM/HOSHrkw:0Zj3+i3Kfqf7zNYe1EQujYzS4w
TLSH
T16803CF36ECB48D375DF2A288778A5753FEF4812395C45BA486DD2B0D06C72AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42e3ec1a-1f09-4849-80de-93698e3c52a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42e3ec1a-1f09-4849-80de-93698e3c52a9.tmp
Size 33KB
SHA256 63796ef10d87d518adfdd807ce2b80e0400734967f05b0a6e90535f7fabd79c8
MD5 dca52903c6769283748697154b7d4bc8
SHA1 25c1e6035bb4acc8852ed5f84365dcd87786aa38
SHA512 64e39c78cd14875a12d8848ed28e40d00bfb152ab4fd65338808648b4571c76c0c1ae604e880a01e274d07511f64db526282d3c6ecbed7f45b909023396263ba
SSDEEP 768:Ly3SbU9TOfqfdlzLfdxzEyJYe1ELsAvC8/YE/cLm:Ly3S3fqf7zLf7zVYe1EQujYmcS
TLSH
T1EEF28D71ACB5DE775EE26644B28A2793FFF4412398C84B54D6C92B0C04C72DE274F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bc54818-d97d-4094-aa7d-667ae592d391.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\0bc54818-d97d-4094-aa7d-667ae592d391.tmp
Size 105KB
SHA256 faa1d17dbaa7275c5bf9f5f85c56bfd5886f17e7f8b00784101de8f5c039c356
MD5 d8b17b6bb640bff8fe28ad44a747f3d3
SHA1 42af3c2e122da92ce166cc222fcb6c05cc8e472e
SHA512 bb4055fb646199a59be3e4d455909dff93e1c0cb13653477973c3a58336f13da6f23290ae834b4b70337e52f6ad5c4ba63776e096e692279fc99eb7436a85abb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T1D7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

32c2553f-a1f6-489b-b311-8e73a7b10589.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\32c2553f-a1f6-489b-b311-8e73a7b10589.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

89ecdd0e-4add-4e8d-94cc-49f8cb07217d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89ecdd0e-4add-4e8d-94cc-49f8cb07217d.tmp
Size 11KB
SHA256 cd98d2abeb6b52f09ff349d7d99a23aab336ed43f69d9aff18c53b8ae3360bc8
MD5 6e4def452dd87ee0af72f5b8da386d53
SHA1 feeb0306c6eaf1aa214632b5130655b52847a2a9
SHA512 2e23d8786a7eb4b16d80b545ef1187104aeadf0d3366e8ec98f26b67baa0a89f182b140839ebf5680543a5b7e11f4f8d3eea4aa67a805c4c3facdc5a1306e275
SSDEEP 192:sxRGJRmCp/feGsncZdqzoA8pi/g6+WNIYxU4qU+GVIgVk1J:sxRUPp/fbsnidni/5IHU7E
TLSH
T145329715AE38A93B8CCBD21DBB65BF53E2F95032A1D51A58E6FC8A1C04E66DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1756998df0a4b824fb303ccea12ce68de61ee097f716ff162ae03f5b5a87f1ed
MD5 c4e64d905352015cc039666c09a46d3b
SHA1 f4a69fcf80969327e53d71af5a3f8afcb11d9885
SHA512 14b7de5eded10ab1e961a37472e310b42e68833b371c0eed99168a014be87b4d569c092910fdf7588509c0c397e1caf3dc324dafa25a2a0e077d005c4a1f0646
TLSH
T1D6613C88E722D451F37E843281CDA8D7363096B95947DE60BAA5ECF67862BFE40418C7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 892e5a28fe5cf3f888b279476128c4f2544035ba2f0700d11f5db4275842f4c5
MD5 352a3dea1a01b07977be497e8ed45139
SHA1 8c7620a95ecf2be449fb4f392b9397e125fa0822
SHA512 2dfad7a2b48fb5b089364d8efd5d32026b7b06fd4432e57367d0493f0eb62c6b9a771dd2c4145b9f6e5efc711caecccfa2e02b2ede28c232cd86ab95c1cd2299
TLSH
T1A8613E88E722D451E37E843281CDA8D7363096BD5847DD61BA95ECF67862BFE40418C7
MD5 SHA1 SHA512 TLSH

Submit Download

e1a1619f-3a9e-4efc-9a38-21abed50c623.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e1a1619f-3a9e-4efc-9a38-21abed50c623.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

46c2bfea-63e1-4156-863c-71eeef548862.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\46c2bfea-63e1-4156-863c-71eeef548862.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

6d724172-bbb2-4876-93cb-4d59eaa25164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d724172-bbb2-4876-93cb-4d59eaa25164.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fd143a54-02f9-4409-95da-5a0d5bffe1d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd143a54-02f9-4409-95da-5a0d5bffe1d7.tmp
Size 1KB
SHA256 95eb3121a8aee331ca40bc169abfcdffe6aa56b8454204f8fd3c37ba5b46848e
MD5 bdee2e71afc758843ea4e84b0ec08b9a
SHA1 54d4f439079a04ba305bc576c910c02a784364a5
SHA512 f88bfe6ccce52a74210b8c35bbffee51c48386e51418fb4c45421ee2a14a2615c45feee285d26bca0fdd5c0fac73ab2163ede621f33e14f815747efb347d5947
TLSH
T1D241ADF787F4856E8A0196F0AA14AE2FCE1D0515832C7C5AC5E4AE2793E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2c1f4e459485668be6e6d274153458bf99957805a6db20acd9a9d4d72eaf2207
MD5 4422346b2bd89c5a62f67521c88c6c3e
SHA1 1092b6f714a6715073d9ea94bc6b76620216e99b
SHA512 d1c70d57661396ef614703a43c3454d59ee134e042b97e31ed6d1203029cf68bcaaf123e4d10f27cc718a4dfc8996d18ac9808e1a503fbee72a2a62d23b0daeb
SSDEEP 24:KKwbQYaIVK4hQ1GS9mRyXQvA74rIXKnhm1qSOJV6N64AIZKWhY1SS/odyXWBa2:K49IVKuQonyRkIXKhmkRLIZKAY8jyS
TLSH
T13B916764713AA640387F251C80E8A66A956173633518E9AF37DD80A64F3BF444DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4e55bce-cd06-474a-910a-d73ae1abfa8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a4e55bce-cd06-474a-910a-d73ae1abfa8f.tmp
Size 11KB
SHA256 f66cde05c0179215409dfa17d5707bb586c4db8b99e2efc1cce4d93835cef24f
MD5 2a24cd658405d8a6947d22d4fe119573
SHA1 7a6f04ae6d0fa03f84c4e87ebdccf57c6d726973
SHA512 ac5c56f7be6db6d4abbfb33364fa5e9bfadf5b309eb341c01fec8485eac5183eb5ef0353a5c36e35f44c9971941397d8166572ae7da96344fe4ac16e6feb22f7
SSDEEP 192:sxR9JRmCp/feGsSGcZdOzoA8p9s/g6+WNC7f/Yxf4qU+GVIgD4k1J:sxRfPp/fbsSGidzS/5o/KU7n
TLSH
T16642A915AE38697B4CCBD21DBBA5BF53E2F95032A1D51E48A6FC8A1C04E66DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aff37fb1-150d-46a2-9d6a-7c7437a6cc82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aff37fb1-150d-46a2-9d6a-7c7437a6cc82.tmp
Size 11KB
SHA256 bc2d0263ce149b08549c880d1a8ec39966a1030193df00b8ad13084fb3ca6566
MD5 e4ce0d42eaf704be9935df68f97a3d6c
SHA1 562fd19eaab46abf28c9f91da73a143f55c92129
SHA512 9b5195c0f4ac58dce76b8bb44c8b94ee66932df8f28fea49a948b062e44cbdcbc2f33b0a3477e26529ee8200ce83a183d460e23cce31d8e8659d1188408b7e34
SSDEEP 192:sxR9JRmCp/feGsSucZdOzoA8p9s/g6+WNC7f/YxsSqU+GVIgDak1J:sxRfPp/fbsSuidzS/5o/JU7B
TLSH
T13F42A915AE38697B8CCBD21DBAA57F53E2F95032A1D51E48A6FC8A1C00E76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbcaa681-1c05-422c-957a-80cacc45d264.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bbcaa681-1c05-422c-957a-80cacc45d264.tmp
Size 29KB
SHA256 2f8d3579d8b0bb6851620d636442e99fff3df1d67b07aa6dbb30be34f4bd65df
MD5 ef76afaacee0dfe8af44e5c599b8e06d
SHA1 b8ba6624f71cc46cdda52d64c1025d0bfaafba4b
SHA512 780cd1a54b9619ae32341153097d6fc4b68c10126c7d52c85d701f4c9da9db93983cd77a5da2363a2a79be758800cb40cec3b5a221ae77ee99081145abe73cf7
SSDEEP 768:zBDnDx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZDZBK3hro3T0:zBDnDnEbYFWgbjfkWu1ja2DZ03aD0
TLSH
T170D2D97B780CCB7F4F804A9DAC197E9E6DA802CB9698CD4047FE945C02C67EE52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f42e52f8-635d-4903-b6bb-9dacc6194c1c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f42e52f8-635d-4903-b6bb-9dacc6194c1c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

616e65d9-5769-42ee-8617-f5a5f82fc4e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\616e65d9-5769-42ee-8617-f5a5f82fc4e5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8b9cdb8-d7b5-486e-8dd3-b4b6f0cf12e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c8b9cdb8-d7b5-486e-8dd3-b4b6f0cf12e2.tmp
Size 38KB
SHA256 aab04af89e02a0436036ee6393a2001232c7464c101a596e250941c8fed246d1
MD5 fff39a9ebfc05929651481b3663dc38f
SHA1 e17482c841b591a8bf236b032ac9d3f815ff1d21
SHA512 aa2f763e3448fb907c4ff4624fe2e5552047e99bb58d5af34d7bb3c6ef47cbf432565ddec374ca1e3a842248f9a326f0728a7bb77d71cd4fac83f156aefd6e18
SSDEEP 768:P/UxvxjgC+i3hi9TOfqfdlzLfdxzRyJYe1ELsAvC8/YN/SHrkw:iZj3+i3nfqf7zLf7ziYe1EQujYNS4w
TLSH
T1E403BE35EC79DD371EF26288728A5797EEF4412398C55AA8C6DD2B0D05C33AD270F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e2b047b-307b-4f6d-8cb9-82c90061e556.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1e2b047b-307b-4f6d-8cb9-82c90061e556.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

5631c34d-d08b-4221-b5d4-1fb9ec21b360.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5631c34d-d08b-4221-b5d4-1fb9ec21b360.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

5dd240e2-a832-4fe5-abdf-5124ea407714.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5dd240e2-a832-4fe5-abdf-5124ea407714.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d8cf0e95-552b-4fd4-abc6-b5d8b2066c72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d8cf0e95-552b-4fd4-abc6-b5d8b2066c72.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3ec19618-5070-40d2-a36c-48997b3a89dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3ec19618-5070-40d2-a36c-48997b3a89dd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f12a2a56-76de-450d-b378-5464e7bba040.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f12a2a56-76de-450d-b378-5464e7bba040.tmp
Size 42KB
SHA256 62a07874daf28870a02c64128039517b3244ef7a38692c6c30b33aa27488b68b
MD5 ebaf1ef7c093704443578c11aad304ed
SHA1 8cf0c9d7abd0a4af403d72ecd9c4c5980eadf679
SHA512 dd85d7d5f76a799e0dfbe97fde9c35a92ac5f43f37d1f63c658788c626244052d08c97980b1bbde0033d850c579496b7da6a1b0b106c53141ff961064eb05f04
SSDEEP 768:4Fd83DwgbaCcROfqfdlzLfdxzXGJYe1ELsAvC8/YE/cLm:s83Naafqf7zLf7zUYe1EQujYmcS
TLSH
T11413F7F598E7CA37D9AD5787A37D2E429ABCC113B4884994F7C91D0CCC821BFD60A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

298f3149-9231-4d46-a8d1-5e2cb0a4025b.tmp

Path C:\Users\Admin\AppData\Local\Temp\298f3149-9231-4d46-a8d1-5e2cb0a4025b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ed75da5d-06f5-4b67-8622-1489b4ee3de5.tmp

Path C:\Users\Admin\AppData\Local\Temp\ed75da5d-06f5-4b67-8622-1489b4ee3de5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1604_1644033256\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1084312767\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_1924494321\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_370987904\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1604_383186286\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

memory/860-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/860-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/916-194-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1072-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1072-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1544-332-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1544-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-297-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2200-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3208-405-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3208-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3524-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3608-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3972-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-244-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-233-0x0000025F36480000-0x0000025F3683B000-memory.dmp

Download

memory/4332-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-403-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5064-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5128-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download