8f1a6c3ee9b5d7afdb2fc268b8bbba796e875db676772cf47821ededf3e25f5b

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260629-bp4ccabt2j
SHA256 8f1a6c3ee9b5d7afdb2fc268b8bbba796e875db676772cf47821ededf3e25f5b
MD5 f4a29c860b7403a4822982e942ab6951
SHA1 d8647d88a81aa1c53b6113437ce7c621e33dfcbf
SHA512 17d0e168f18b4beaf3d3e1428223831ab44700407adab14add5ce1692c584f039453af15bdd117746d6c71db4244e344cb9258d8b47d5ffdea9eacc83ae020dd
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6024	CP.exe
1784	pnhxspkica.exe
2264	CP.exe
1836	CP.exe
5552	i_pnhxspkica.exe
4780	hczxvpnhfz.sys
1312	CP.exe
3212	icxrpkhcau.exe
5364	CP.exe
5840	CP.exe
472	i_icxrpkhcau.exe
4556	zxusmkeczx.sys
2944	CP.exe
1076	czurmkecwu.exe
876	CP.exe
6100	CP.exe
2968	i_czurmkecwu.exe
2828	jhbztrmjeb.sys
2896	CP.exe
4456	jhbzurmjec.exe
2436	CP.exe
2192	CP.exe
3488	i_jhbzurmjec.exe
716	ojgebwtrlj.sys
3068	CP.exe
3536	ywqomgeywq.exe
1360	CP.exe
3676	CP.exe
3296	i_ywqomgeywq.exe
2976	jdbztrljdb.sys
4316	CP.exe
5020	gdbwtolgey.exe
5544	CP.exe
5228	CP.exe
5592	i_gdbwtolgey.exe
4308	gayvqoigay.sys
4272	CP.exe
5144	gaytqljdbv.exe
2968	CP.exe
4984	CP.exe
984	i_gaytqljdbv.exe
5448	faysqnigax.sys
3868	CP.exe
1120	aysqkifays.exe
4432	CP.exe
3436	CP.exe
3976	i_aysqkifays.exe
3944	nkidavsnlf.sys
4012	CP.exe
1744	axsqkicaus.exe
620	CP.exe
3316	CP.exe
1396	i_axsqkicaus.exe
4964	faxsqkicax.sys
2924	CP.exe
1240	xspnhfcaxs.exe
4732	CP.exe
5752	CP.exe
1316	i_xspnhfcaxs.exe
4872	nhecaxrpmh.sys
860	CP.exe
4780	xupmhfzxrp.exe
3164	CP.exe
4520	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1338552871\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1338552871\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_667760029\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1001425267\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_606651790\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_667760029\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1001425267\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1001425267\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2568_1001425267\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 44 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxuspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlidayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurpmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztomjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlidayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtrljdb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5512	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 21 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1344	ipconfig.exe
2008	ipconfig.exe
2432	ipconfig.exe
2508	ipconfig.exe
1740	ipconfig.exe
2304	ipconfig.exe
1156	ipconfig.exe
3420	ipconfig.exe
4792	ipconfig.exe
5312	ipconfig.exe
6048	ipconfig.exe
4256	ipconfig.exe
3760	ipconfig.exe
4480	ipconfig.exe
472	ipconfig.exe
6112	ipconfig.exe
1252	ipconfig.exe
1344	ipconfig.exe
3184	ipconfig.exe
4512	ipconfig.exe
5548	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271696119123772"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{345856AD-E5ED-4638-8ADF-A9294AE42468}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe
2568	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5552	i_pnhxspkica.exe
Token: SeDebugPrivilege	472	i_icxrpkhcau.exe
Token: SeDebugPrivilege	2968	i_czurmkecwu.exe
Token: SeDebugPrivilege	3488	i_jhbzurmjec.exe
Token: SeDebugPrivilege	3296	i_ywqomgeywq.exe
Token: SeDebugPrivilege	5592	i_gdbwtolgey.exe
Token: SeDebugPrivilege	984	i_gaytqljdbv.exe
Token: SeDebugPrivilege	3976	i_aysqkifays.exe
Token: SeDebugPrivilege	1396	i_axsqkicaus.exe
Token: SeDebugPrivilege	1316	i_xspnhfcaxs.exe
Token: SeDebugPrivilege	1356	i_xupmhfzxrp.exe
Token: SeDebugPrivilege	4308	i_zwurmkecwu.exe
Token: SeDebugPrivilege	2680	i_cztomjecwu.exe
Token: SeDebugPrivilege	3272	i_gebwtrljdb.exe
Token: SeDebugPrivilege	3108	i_qoigdbvtqo.exe
Token: SeDebugPrivilege	1932	i_dbvtnligdy.exe
Token: SeDebugPrivilege	2828	i_vtqlidayvt.exe
Token: SeDebugPrivilege	1812	i_nkicavsqki.exe
Token: SeDebugPrivilege	3944	i_nhfcxuspnh.exe
Token: SeDebugPrivilege	3312	i_zxrpmkhczx.exe
Token: SeDebugPrivilege	1736	i_hbzurpmhec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5316	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5316 wrote to memory of 2568	5316	iexplore.exe	90
PID 2568 wrote to memory of 5392	2568	msedge.exe	91
PID 2568 wrote to memory of 5984	2568	msedge.exe	92
PID 2568 wrote to memory of 5512	2568	msedge.exe	93
PID 2568 wrote to memory of 5984	2568	msedge.exe	92
PID 2568 wrote to memory of 5984	2568	msedge.exe	92
PID 2568 wrote to memory of 2536	2568	msedge.exe	94
PID 2568 wrote to memory of 2536	2568	msedge.exe	94
PID 2568 wrote to memory of 4872	2568	msedge.exe	96
PID 2568 wrote to memory of 5892	2568	msedge.exe	97
PID 2568 wrote to memory of 4872	2568	msedge.exe	96
PID 2568 wrote to memory of 4872	2568	msedge.exe	96
PID 2568 wrote to memory of 5892	2568	msedge.exe	97
PID 2568 wrote to memory of 5892	2568	msedge.exe	97
PID 2568 wrote to memory of 3852	2568	msedge.exe	98
PID 2568 wrote to memory of 5620	2568	msedge.exe	99
PID 2568 wrote to memory of 3852	2568	msedge.exe	98
PID 2568 wrote to memory of 3852	2568	msedge.exe	98
PID 2568 wrote to memory of 5620	2568	msedge.exe	99
PID 2568 wrote to memory of 5620	2568	msedge.exe	99
PID 2568 wrote to memory of 716	2568	msedge.exe	100
PID 2568 wrote to memory of 716	2568	msedge.exe	100
PID 2568 wrote to memory of 5068	2568	msedge.exe	102
PID 2568 wrote to memory of 2864	2568	msedge.exe	103
PID 2568 wrote to memory of 5068	2568	msedge.exe	102
PID 2568 wrote to memory of 2864	2568	msedge.exe	103
PID 5064 wrote to memory of 6024	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 2568 wrote to memory of 1668	2568	msedge.exe	107
PID 1784 wrote to memory of 2264	1784	pnhxspkica.exe	110
PID 2568 wrote to memory of 5328	2568	msedge.exe	114
PID 2568 wrote to memory of 5328	2568	msedge.exe	114
PID 2568 wrote to memory of 5252	2568	msedge.exe	115
PID 2568 wrote to memory of 5252	2568	msedge.exe	115
PID 5064 wrote to memory of 1836	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5064 wrote to memory of 1312	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3212 wrote to memory of 5364	3212	icxrpkhcau.exe	122
PID 5064 wrote to memory of 5840	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 5064 wrote to memory of 2944	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1076 wrote to memory of 876	1076	czurmkecwu.exe	131
PID 5064 wrote to memory of 6100	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5064 wrote to memory of 2896	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4456 wrote to memory of 2436	4456	jhbzurmjec.exe	140
PID 5064 wrote to memory of 2192	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2568 wrote to memory of 2456	2568	msedge.exe	146
PID 2568 wrote to memory of 3436	2568	msedge.exe	147
PID 2568 wrote to memory of 5552	2568	msedge.exe	148
PID 5064 wrote to memory of 3068	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 3536 wrote to memory of 1360	3536	ywqomgeywq.exe	153
PID 5064 wrote to memory of 3676	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 5064 wrote to memory of 4316	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5020 wrote to memory of 5544	5020	gdbwtolgey.exe	162
PID 5064 wrote to memory of 5228	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 5064 wrote to memory of 4272	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 5144 wrote to memory of 2968	5144	gaytqljdbv.exe	171
PID 5064 wrote to memory of 4984	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 5064 wrote to memory of 3868	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1120 wrote to memory of 4432	1120	aysqkifays.exe	180
PID 5064 wrote to memory of 3436	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 2568 wrote to memory of 1732	2568	msedge.exe	185
PID 2568 wrote to memory of 1732	2568	msedge.exe	185
PID 5064 wrote to memory of 4012	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 1744 wrote to memory of 620	1744	axsqkicaus.exe	193
PID 5064 wrote to memory of 3316	5064	2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f4a29c860b7403a4822982e942ab6951_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x318,0x7ffd418fc188,0x7ffd418fc194,0x7ffd418fc1a0
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,7782118152519570042,14429711371372958315,262144 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,16415428653095401819,17792000657244927606,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:11
      4⤵
      System Time Discovery
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,466063397808016049,978701329367841873,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,11874707311943930660,13314519323771864550,2097152 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,4793035786271448353,12968430643263726410,2097152 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,9063472992368318805,3894790876513889056,2097152 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,11372404928323857018,2462685721704661707,2097152 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,2579000702567731167,1462856858953333593,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3098986523633620171,426203938353497528,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,49643473042117924,10067720138634976176,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6120980344927175610,5988544587816768856,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6120980344927175610,5988544587816768856,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8742872441094358467,15718856139268847626,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,6429013018539818585,4715810487404891238,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,7640509231856851461,17676318417552963762,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,16058583309579873966,1583799660556500739,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16644626637463838100,7275611320000505139,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,15083585603008065134,12598790150081109579,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:14
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2064,i,18205695129640977022,2425166128814174105,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12502656095536949590,15532916127597917442,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,7007903706265250558,4292534353723027081,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6196,i,8159391459331669253,12720721003823366231,262144 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,2266542965045743353,4468416163499765407,524288 --field-trial-handle=2460,i,1866593589638841963,113218649390135735,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
      4⤵
      PID:5524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024
- - C:\Temp\pnhxspkica.exe
    C:\Temp\pnhxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1836
- - C:\Temp\i_pnhxspkica.exe
    C:\Temp\i_pnhxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Temp\icxrpkhcau.exe
    C:\Temp\icxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5840
- - C:\Temp\i_icxrpkhcau.exe
    C:\Temp\i_icxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2944
- - C:\Temp\czurmkecwu.exe
    C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Temp\i_czurmkecwu.exe
    C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\jhbzurmjec.exe
    C:\Temp\jhbzurmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Temp\i_jhbzurmjec.exe
    C:\Temp\i_jhbzurmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqomgeywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\ywqomgeywq.exe
    C:\Temp\ywqomgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqomgeywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Temp\i_ywqomgeywq.exe
    C:\Temp\i_ywqomgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbwtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4316
- - C:\Temp\gdbwtolgey.exe
    C:\Temp\gdbwtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbwtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5228
- - C:\Temp\i_gdbwtolgey.exe
    C:\Temp\i_gdbwtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Temp\aysqkifays.exe
    C:\Temp\aysqkifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3436
- - C:\Temp\i_aysqkifays.exe
    C:\Temp\i_aysqkifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3316
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspnhfcaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2924
- - C:\Temp\xspnhfcaxs.exe
    C:\Temp\xspnhfcaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspnhfcaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5752
- - C:\Temp\i_xspnhfcaxs.exe
    C:\Temp\i_xspnhfcaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupmhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:860
- - C:\Temp\xupmhfzxrp.exe
    C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Temp\i_xupmhfzxrp.exe
    C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwurmkecwu.exe ups_run
  2⤵
  PID:4728
- - C:\Temp\zwurmkecwu.exe
    C:\Temp\zwurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwurmkecwu.exe ups_ins
  2⤵
  PID:1436
- - C:\Temp\i_zwurmkecwu.exe
    C:\Temp\i_zwurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cztomjecwu.exe ups_run
  2⤵
  PID:5328
- - C:\Temp\cztomjecwu.exe
    C:\Temp\cztomjecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cztomjecwu.exe ups_ins
  2⤵
  PID:4916
- - C:\Temp\i_cztomjecwu.exe
    C:\Temp\i_cztomjecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebwtrljdb.exe ups_run
  2⤵
  PID:2404
- - C:\Temp\gebwtrljdb.exe
    C:\Temp\gebwtrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebwtrljdb.exe ups_ins
  2⤵
  PID:2616
- - C:\Temp\i_gebwtrljdb.exe
    C:\Temp\i_gebwtrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdbvtqo.exe ups_run
  2⤵
  PID:5700
- - C:\Temp\qoigdbvtqo.exe
    C:\Temp\qoigdbvtqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigdbvtqo.exe ups_ins
  2⤵
  PID:1472
- - C:\Temp\i_qoigdbvtqo.exe
    C:\Temp\i_qoigdbvtqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnligdy.exe ups_run
  2⤵
  PID:5636
- - C:\Temp\dbvtnligdy.exe
    C:\Temp\dbvtnligdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnligdy.exe ups_ins
  2⤵
  PID:3248
- - C:\Temp\i_dbvtnligdy.exe
    C:\Temp\i_dbvtnligdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqlidayvt.exe ups_run
  2⤵
  PID:5620
- - C:\Temp\vtqlidayvt.exe
    C:\Temp\vtqlidayvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqlidayvt.exe ups_ins
  2⤵
  PID:4792
- - C:\Temp\i_vtqlidayvt.exe
    C:\Temp\i_vtqlidayvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicavsqki.exe ups_run
  2⤵
  PID:2708
- - C:\Temp\nkicavsqki.exe
    C:\Temp\nkicavsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicavsqki.exe ups_ins
  2⤵
  PID:1656
- - C:\Temp\i_nkicavsqki.exe
    C:\Temp\i_nkicavsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcxuspnh.exe ups_run
  2⤵
  PID:5080
- - C:\Temp\nhfcxuspnh.exe
    C:\Temp\nhfcxuspnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcxuspnh.exe ups_ins
  2⤵
  PID:5584
- - C:\Temp\i_nhfcxuspnh.exe
    C:\Temp\i_nhfcxuspnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpmkhczx.exe ups_run
  2⤵
  PID:200
- - C:\Temp\zxrpmkhczx.exe
    C:\Temp\zxrpmkhczx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpmkhczx.exe ups_ins
  2⤵
  PID:5012
- - C:\Temp\i_zxrpmkhczx.exe
    C:\Temp\i_zxrpmkhczx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurpmhec.exe ups_run
  2⤵
  PID:5264
- - C:\Temp\hbzurpmhec.exe
    C:\Temp\hbzurpmhec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurpmhec.exe ups_ins
  2⤵
  PID:5096
- - C:\Temp\i_hbzurpmhec.exe
    C:\Temp\i_hbzurpmhec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:824

C:\Temp\hczxvpnhfz.sys
C:\Temp\hczxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\zxusmkeczx.sys
C:\Temp\zxusmkeczx.sys
1⤵
- Executes dropped EXE
PID:4556

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\ojgebwtrlj.sys
C:\Temp\ojgebwtrlj.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\jdbztrljdb.sys
C:\Temp\jdbztrljdb.sys
1⤵
- Executes dropped EXE
PID:2976

C:\Temp\gayvqoigay.sys
C:\Temp\gayvqoigay.sys
1⤵
- Executes dropped EXE
PID:4308

C:\Temp\faysqnigax.sys
C:\Temp\faysqnigax.sys
1⤵
- Executes dropped EXE
PID:5448

C:\Temp\nkidavsnlf.sys
C:\Temp\nkidavsnlf.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\faxsqkicax.sys
C:\Temp\faxsqkicax.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\nhecaxrpmh.sys
C:\Temp\nhecaxrpmh.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\zxupmkeczx.sys
C:\Temp\zxupmkeczx.sys
1⤵
PID:2920

C:\Temp\rpjhbztrpj.sys
C:\Temp\rpjhbztrpj.sys
1⤵
PID:3224

C:\Temp\uomgebztro.sys
C:\Temp\uomgebztro.sys
1⤵
PID:2672

C:\Temp\omywtoljdb.sys
C:\Temp\omywtoljdb.sys
1⤵
PID:5116

C:\Temp\tqolgdbywq.sys
C:\Temp\tqolgdbywq.sys
1⤵
PID:5476

C:\Temp\nigayvqnlf.sys
C:\Temp\nigayvqnlf.sys
1⤵
PID:5668

C:\Temp\hfaysqkica.sys
C:\Temp\hfaysqkica.sys
1⤵
PID:5476

C:\Temp\hfaxvpnkif.sys
C:\Temp\hfaxvpnkif.sys
1⤵
PID:352

C:\Temp\pnkiczxrpk.sys
C:\Temp\pnkiczxrpk.sys
1⤵
PID:5784

C:\Temp\xrpmhezwur.sys
C:\Temp\xrpmhezwur.sys
1⤵
PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.exe

Path C:\Temp\czurmkecwu.exe
Size 226KB
SHA256 d5d210d6fc6b53596119808d7e7250a607fbb9e1f255ab89df88ba2ae60b1e1a
MD5 b9317b46bd1dfd4e5c452a42ca8a17f0
SHA1 cdca535ff68c124af0d6fe14c862ba6c76af0b26
SHA512 d43b9263cdaa1ce2d1b2a2f70e45cd28060ac9caf938baa4e19198201a158e2f3ba8f4771fc882fb7fb61c837a0bc6ecd669dceaab5d8f5011322bcb8c383de3
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbwtolgey.exe

Path C:\Temp\gdbwtolgey.exe
Size 226KB
SHA256 656eef8acea349f3d968a7ae39812f8a345bad8f3d27caa1f77dd264c15251b7
MD5 a8691b576a823465093cc000bf515c42
SHA1 2001c43ab8bef14177a4768d61185e64c2d26364
SHA512 490788b4e38dc4f82f05b7c9316d1910efef66fa2cdc00ab79c0fef13081cad77dbfdea8e82d269f3885d42f6f29d942f459dd9b40a4ac9556110737757588e6
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxvpnhfz.sys

Path C:\Temp\hczxvpnhfz.sys
Size 141KB
SHA256 081f53e5cfaa6f1a8ccf895da5e08c065564b8abed1916ebbd2aafa70555da7d
MD5 37dc13222413acce539129538ed2df31
SHA1 50bd82816182e91520a25da35d5f2db8716acd92
SHA512 3504e7bd14ab1fd74d0918aa65a7d4030561d3b6f609c5d5e02121216e789e7e12b1f4f6f910f234b86871bbc2dba2e095d03ad4a187f9f852865ddba8bcf7cc
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmkecwu.exe

Path C:\Temp\i_czurmkecwu.exe
Size 226KB
SHA256 4e263f87f0183e3b8bf5f30dfc223695dfb46eb070e503fe369e2374650d1a10
MD5 197840657f919d6d8e01e742849a8579
SHA1 74fbadf477a44bbf28bd94c4a1e5f1f79ebc84a4
SHA512 37cb1bfa5e9ce735b9cf5d7c22d3a4936c9a0a50e69712a73c4576c8e24b72b6791fe22efc13b9b8015ca54324bda005d115316c8b6346e7a735f9c291a82d16
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1A434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbwtolgey.exe

Path C:\Temp\i_gdbwtolgey.exe
Size 226KB
SHA256 896144237f34a04b706c362d0a0f09d8e7b74b93d441b454eaa45fc56ddbc3be
MD5 f6b5be9049f9cb69502bca63a5af6a24
SHA1 35aeb78d754acce3cfa9ee69f0620a3c5793fee3
SHA512 0a991d319a1208d479e44a23701b3e98e4d98e111a5044ee5a0b8630b463d572a01e20562b7490391f8c527be69de37fbca9316158af6b466b56b097a394e618
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icxrpkhcau.exe

Path C:\Temp\i_icxrpkhcau.exe
Size 226KB
SHA256 814873c412725bc377c63ea526d2f2fe6801ec70f9a6c473b01c2ecab054dc41
MD5 faf38004a25df12815be78274f8f2c71
SHA1 5353043534f09dfc496e96f6242abb88fc197e4b
SHA512 c6cdfa83e9aeec3675b3837689a6bc73701216b2c231756090e3fa6a69e29cb77e42884c72ec1b22cebbff09f541ed646649cc901c60169b8f4da63f9bef361e
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T11934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzurmjec.exe

Path C:\Temp\i_jhbzurmjec.exe
Size 226KB
SHA256 1ff0c0aa78cc7fe97d0071dbfc60e557b7bb5da30fcf234ae17678b2c960b1a9
MD5 258cf285da16ec9e94c94af5769b6b1e
SHA1 5f48fcccc7d8d28ac1554368f3567f3de66bd077
SHA512 c3bb2c1cea3aba15d527ccf19b845ee3a629e0e5bdc89de8414871fc44f793b34fb26822d5a506a833ecb3371502e91b2a13acc4536eb1900bfb00e8c8323cbd
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhxspkica.exe

Path C:\Temp\i_pnhxspkica.exe
Size 226KB
SHA256 f44052dcd0b6de08f0413b69b09a29a03b9838a3b7406b1005dc4acc044640fa
MD5 f3b71e0781a67e347fb7101975f61d09
SHA1 8ca22effe1df1b525b393dde0291422fcd2627fa
SHA512 8faeca18f3431c8c74791c24e0ab7fdf4124d636612f9bee90e33c7749ea41d5d5d2d4b357ee1eadf0338e6d2fd7da63da44084b6c2f957c7f42f91dcc3f5ce0
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T19234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqomgeywq.exe

Path C:\Temp\i_ywqomgeywq.exe
Size 226KB
SHA256 5e950e867b1d0c7b62381980bf6dc3acd3892191e483ce1e15d4314b6b5d88ff
MD5 4c8c5635cc9a45933aad2516009f9767
SHA1 938e7c6fc9460efa75643d73543e02f270872870
SHA512 90c3f689efd0721890f314fd3da5279ea192ad30e3d5dce22dda8083f8cd413b162467d68fd73ab208504856613b3f74b9e75128b50758a6cab93acb1d79805a
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T11534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icxrpkhcau.exe

Path C:\Temp\icxrpkhcau.exe
Size 226KB
SHA256 772907b6e317625723a15a62d3eefaa18e22b522d5e645670a92f867e792f18c
MD5 69b7636d3a66feb20924894e9095eb53
SHA1 07b3ce7f5ab18293465b19746ff525275bf18b1c
SHA512 f7c064f28e256f55c03f33f369fbc1fe9a00eec63681d52d0335b7bd1da6b041e284d9a9288a4a21588aa6b98531c54f41f8ccf06577fb45601b994a5bc27c64
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbztrljdb.sys

Path C:\Temp\jdbztrljdb.sys
Size 141KB
SHA256 304164c757b5cf7b949c9a033d7014bd40eda335c9b9a976fcc65d1ef9078b56
MD5 4fd596295ce60700479f5f4ae299f920
SHA1 490d4b4f632976dded5fdd2664c3033f60c8ef4e
SHA512 54a00203a0829c28a73f57183a44875291effabc2b1391dc1282866ce8642e822a6c204eb730cd9198ab92474cb33204cb613c9377dc4b2b7b9cd324bc23a4fd
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T199E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjeb.sys

Path C:\Temp\jhbztrmjeb.sys
Size 141KB
SHA256 c5b0ecba6d96a076a08a179e9708bf578589f9672722f2a6aab17aa8ab4598c2
MD5 80c1bb0e2220d8f4298c4d4f7ade7839
SHA1 cc1797fdee94d7df2c8142f29cf048c50f423c3f
SHA512 d5c03f6bc36fdd2706c90f794b19a72158ce532c48ccc897ec7e45e1235508b53a74b9d9a53f603d78751c5fd671b5e4f7b321e8040dd72cbc043023f9914df7
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE38D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmjec.exe

Path C:\Temp\jhbzurmjec.exe
Size 226KB
SHA256 aca04d24b14ec79669b93620ca45c8c1b969e800a6e34011d01fa7869812e473
MD5 77e63eddf3de804bfabcec6665750986
SHA1 06391ab291642d9b9457cc6d382470f1761822d9
SHA512 7fdde9080b5fdda8fcb73cac9eee110c83b2723abc1a851e508bd38e85a604e244d7000390307177ea9d25b7eec8b5689a7e4d49fb4e95a3c2b35b9e84c3ff55
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1C034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgebwtrlj.sys

Path C:\Temp\ojgebwtrlj.sys
Size 141KB
SHA256 d128de16074a33ec517b1d56749c41251eb363de135841124e04303126158f12
MD5 ebf15051d7a7daf601879c5c9084f67f
SHA1 1a6358feef743995fdc9bafa546976f295959292
SHA512 09bd5e73496930dcdbc05da7e9d1aea57e3ef7e91402583146ad2300ca91cf2517982824237bbdda3be3df13cd880a79b24d5b1b50047836c138ee300b1d630b
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhxspkica.exe

Path C:\Temp\pnhxspkica.exe
Size 226KB
SHA256 d44d94fe7cb24d3331796f41fe7d28c4bf1b7da90a0297338830ff332c13c075
MD5 9404bf878f80353d5b18f16d2062775c
SHA1 0bfceb7beec5a4a810a8331e2bd4fc27a66940a9
SHA512 b6f09f20bc093275aaf86d396a9e4c9fdce9005615bfb18f224dd651430481523898032a75ce63a5d2b4f712d1d988fb0876912b61586f66f29f48fa1c1953e7
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgeywq.exe

Path C:\Temp\ywqomgeywq.exe
Size 226KB
SHA256 304ba63e6c53cfd47442702ae6dad07b3307f66c4e9bb1162ba8bf4576dbe142
MD5 66f1a42b5115e1fc2cc9df3bd431b544
SHA1 81652dc0c9f8741b9964cc0c8f4ac35d61f9a9c0
SHA512 b3840fad4fea32fa812a2c04c992e84f611a1854bbf474d7ce18161083132939174435883fc15fabacc64b9914e2dd495c44a66184220d14fcf2f8beb0631e0a
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxusmkeczx.sys

Path C:\Temp\zxusmkeczx.sys
Size 141KB
SHA256 20bfadca725a142beb7b5cdf748803b0742ce850b24189beddc2b8faba0af8e6
MD5 2b1c4ccd92cd7fb6f478bb334b4b1258
SHA1 a70ad4c712f0fed286618c2179d4539eb6a0e112
SHA512 22dce3381df3e7385e0f058ce297b54e9fc80fe45f4507dc0399a8bd6826fa8c41c588b391f40bc1b9df54ffd5716e196f780a04e129170174854d44a068831d
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

438141c1-e3ae-4b56-a2b5-abbaf5891899.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\438141c1-e3ae-4b56-a2b5-abbaf5891899.tmp
Size 43KB
SHA256 b174a602a2c06ceadff4bd7508e213eda32e06324c24192e73d3c40d3cd90e25
MD5 0518d0f598f364aa571b78f3202d1f1c
SHA1 00392cf907c751a352a5de6bb6c14b62b479ee3f
SHA512 06ba97b27eed054743f37807a6ec8641d326b56050d865ec403e9750ac739d02aea74f1e7b0545150116cbf2bdf662278e039fc3219364d71e501d984af92ad7
SSDEEP 768:oF1j+9/3YwghVekoVCgZSVCKPFECrBhpjcN3zn12bfJg:F9/3Au8gs0KPF1HRcBByJg
TLSH
T1811339F594E78A37D8AE8787A33D6E459DBCC163B5890984F7C85E0CCC862BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

8cda7d34-7f8a-43b9-bc0d-0db6a796c683.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8cda7d34-7f8a-43b9-bc0d-0db6a796c683.tmp
Size 14KB
SHA256 02798c5b1b2023bd286154a46aeeadb2232d73098f656e311691ac8d0c65d78e
MD5 fc5ebd45067020a962758070a19f5db8
SHA1 fc01ad361cbb8984ed7e1bae93f07c2b25c42471
SHA512 d50e6de162bf61ff1171d019b04ce853bc087d1ef9f0f1077f769e4d09d1b8e7cf9b7df5e65f1d93b9bdc1a6a4d2f4b4d3390cc3113cb5d3e460c0361b9dcfe6
SSDEEP 192:sxRIRtyM/jK1Ml8wch/f3sG38aYZk8WLCzoA8p9o/g6+WNCou/YJGCfGzIgtJ:sxRIFCh/f3sE8amJWLPi/58/Gu3
TLSH
T1F562EB15AA345937CCDFD209FA957B53D6F94573E2900E44EAFC8A0C04E6AEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b1638a7df77445591574df2c8c35a361bfac87c97afc38c9f3f2836fa153b0d
MD5 ab8761d45b7a7fa140125263ed94ef3e
SHA1 e78b70091350261d14b2656c9f8bc41920a63c6f
SHA512 5e3addf5451a6c8107a0492ffeb51b55eb3d8200c6825c5c8ab81a2f9bb70cddea9988fda6efe886a377c58e7e4698cf2d7c1d12e472c43cdb63a76f2258cd00
TLSH
T1A4716054B2632966D7A5ED3720D570A4BBFC543E4A0F1FC0049BD87CB8C67D6B831814
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592ed6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592ed6.TMP
Size 3KB
SHA256 ba33c27fd25e72f21b3fe3117a1da9e057cc902af3949fbe0cc00cc90746baac
MD5 24f9cae43437cb19ee40a7e86635c30a
SHA1 ae3856ab1ed9b549d1ef66d3380aab430028a76b
SHA512 6a5c62469910e78662ac736dba8155bd0b707e3ddb0229b5afa6a9a212c3ef2420cb4849b58cf31c81fefdf5e9af15120aa6422a5892a2cfebae4a43f2be9471
TLSH
T146716E54B2632966DBA5ED3720D530A4BBFC443E4A0F1FC5049BD87CB8C67D6B871814
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 adb0bf195146b4af5415c06e80ba0589704eb9393179b791720f41231e3d961c
MD5 bfa76a9e611b906e3e3f9e6560952dbe
SHA1 85ba57b63e860d6822e9c73f7461352f6ff0cff0
SHA512 85fbbbe1671895d9c97209c05d895065bdfff5d275aa25983e03d1d7ba03186300430d8f3b5033d4e91ed6efe668f33d4e85638b3a7fa87a07f53746e0aa94c7
TLSH
T17D519CF3C3E8866E890156F0BB187E2BDE1D0915832C3D5AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5449aa25115ad10a728f5d6d8799740bed030a196b96ceee09ade2c4896cea34
MD5 12538179b921eb89dd91c3e63d7aff11
SHA1 ed0e2ca17ec5675114536217d91c016b3a35a296
SHA512 929dfac75a08de0ee1d368002d26d16f91fc29668ae0d3659b815dde5df7cffe10df8391e1ad32f561d01c7fc9c4b9b84dbdab7e38faf0032c8cf26825f4a015
SSDEEP 192:sxRzRtyM/jK1Ml8UQRch/f3s63WaYZk8WLCzoA8pro/g6+WNCou/YJACfGzIgDQJ:sxRzFqGh/f3sAWamJWLP0/58/aug
TLSH
T1AC62DA15AA345937CCDFD209FA917B53D6F84563A2900E44EAFC8B0C05E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 35f1b17d2baf84a6ffd36a30a914199119950894f1e9276746cd160dbc64b7bf
MD5 20b7dfb440c639dccf0bc0802a25c169
SHA1 e158c742c09ce7523e0363e11a7148ab64f08625
SHA512 1062149bbdf67cd311769bfba6ab84bdfd7767d19ddfc0800d230ce631c8faedc2f1cfa8deb593c232df45f7da538f91f164ac3bd826511fbc06e473c54aaea2
SSDEEP 192:sxRzRtyM/jK1Ml8wch/f3s638aYZk8WLCzoA8p9o/g6+WNCou/YJGCfGzIgDeJ:sxRzFCh/f3sA8amJWLPi/58/GuW
TLSH
T1F862EA15AA345977CCDFD209FA917B53D6F94563A2900E44EAFC8B0C05E7AEC621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 72430a1cba60919896e4212ff91631c9a6ec32f48c5c7d70ac6251d8685fb1e2
MD5 e168d9b4de9a32ece65eaf9940e04a61
SHA1 f722d4846892276f2fbca0ec179b242cd486fc25
SHA512 946c4cf02f185f194c6b596bd29736368dbcaf2024c034b10103b56c1460f195a88195e03d2f2df30e1b994182cb6b4e19c8c5d54e69dc644060c55f8f68f8fb
SSDEEP 768:v1D8Pw7pLuL7e7WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwAHDZhTrol2ZFK:v1D8P8E7e7WgeEftqu1jaDAHNhgr
TLSH
T1BBE2FD3B680CCB7F4F444A9CEC29BD9A6DE801CB96D8CD5447EA880C03C6AFB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 ea04a794f96728d0f06d7f54cfa93af355d4f38dab79f43a84951dc6f3d1dd92
MD5 c92bd46d6e2314f7147101d4bc562813
SHA1 0d008affa4a9746e8fb6122c8d9baa60ff2c57c2
SHA512 24302ea374eda26466d1746486c80e7db2cac5c7cb50a36597c0adfe0c6f862cbed7b2aa00896a3fef39e3d219f71f56ffac2e25e21df0341ded20e3684644b1
TLSH
T108515600B4BF2700287E291DA39C955E23517072705BAD3B3B6C22EA1E6AE401EFD5FD
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59caf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59caf7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6729c83e5cc185b505cce4fdd6810c543a9a5d8d22ee0cace2b9796a69dd3fdd
MD5 feca61edb9bb4f1133904c4b91e5171b
SHA1 5d7a7298ee00ded7264d468917d5fabc0c79470c
SHA512 1589eebba977c8c42ae156d6dfd8199da360fb64246b33dc9cefbfd5aac68816fc03330427f589fbc3a20b421f5c1ac62d102a2ecc3527a43147b53b8be1ee9f
SSDEEP 768:bjaeqD4MlshiLdMmu3305GgVCgZSVCKPFECrBhpjcxx+ApX32TB:bqcjhIdMB388gs0KPF1HRcr+KXk
TLSH
T1BC03BF79A8A45E738C77D645B207B2866EB84297D3C92F8CD8DD6B0D42973DD130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b7fba84bbb85df0d875ef5469c0df72312dd0cc2440271cb207046cd072c31b
MD5 d910d75c06ac694bbdeed1672ea4f2d4
SHA1 f8b21ad581e2bfeb149912090543cd3159f1f3b0
SHA512 8392f0999eb4515669ad4b10b2c30ab236b7d3f4ccf71b26a279a90ed7c39cdc364a5d04b8576a8dc8056a6ffed21fd8b737c5e877f78edc6fa61801f777698b
SSDEEP 768:ljaeqD4MlshiLdMm73xVi5G+VCgZSVCKPFECrBhpjcN3ATY:lqcjhIdMg3xG8gs0KPF1HRcBL
TLSH
T1AF03AF75A8F49D738CBBD544B2177382AEB402A786CA1F4CD9D96B0D05873DD160BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 571f1ed43b0d7cbd6507dd9a9fb41a36c08b0ae497309c0669c01e0c756f3f1e
MD5 f6e94fdd4aae3e4c5c37a504925f5a14
SHA1 eba7daec9ea9fc3751f20afea27be6b48a500dee
SHA512 496fc95b7afd51e928b1f4e7c2239ec8c81f0800dc6c8ee9377b2f112c19b1ad4f4eb82c7998e32d8ff60b2d1f9944199be2cc16c5a2b4bce6e39a811d655c7b
SSDEEP 768:Pj+9p3+ci5GvVCgZSVCKPFECrBhpjcN3zn12bfJg:i9p3+28gs0KPF1HRcBByJg
TLSH
T198F2AF31A8A59E334CEBD658B1167385BEF816A786C90E4CC9DC9B0D49C739C271BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 15866bcc92bbd7f95c01f1042f66a8954501c19c3442036c056109d147f64d50
MD5 6c337ce98d09374fe3564885345d3ec7
SHA1 47ac3ae41900424f8dd3f459665d2899b9182f36
SHA512 d356e1a4e885d403c82aea138a61ac016069c2c8d18826c1a161971d6f7b740544533ee0857a3fc74857f76a4f6ed69e0b18659691bb8c28624d42abf7ed4ba8
SSDEEP 768:Yj+9p3fci5GvVCgZSVCKPFECrBhpjcN3zn12bfJg:H9p3f28gs0KPF1HRcBByJg
TLSH
T1A8F2AF31A8A59E334CEBD658B1167385AEF816A786C90E4CC9DC9B0D49C739C271BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2568_722788580\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2672-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2828-472-0x0000000000010000-0x000000000004D000-memory.dmp

Download

memory/2828-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2920-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2976-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3224-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4308-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4780-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5476-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5476-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5784-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5928-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download