f7192a2367bf4c829ec64d888f65014f221e0aacb9745b21e0105e82f8cd5d81

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260701-bjtkysby8m
SHA256 f7192a2367bf4c829ec64d888f65014f221e0aacb9745b21e0105e82f8cd5d81
MD5 02a6a0c9b3085ee6dd6331da22ca0e17
SHA1 cf96ea672c4ea71c87f5da72fbaaa0e27b3619e0
SHA512 d9cdc6b9f16e7ea1f5efbaff238c29bcf26e3f1084cf0da280a117d7009eebaf3b4e6097baf3a24897ed155d81ed69b708839445b2892a8b284b5b90eccbcc26
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1488	CP.exe
3196	trljdbwqjb.exe
2692	CP.exe
3792	CP.exe
5832	i_trljdbwqjb.exe
4404	ywqojgbztr.sys
5012	CP.exe
5184	nlgdbwqoid.exe
3112	CP.exe
3728	CP.exe
4872	i_nlgdbwqoid.exe
4240	qoigaysqli.sys
2556	CP.exe
552	nifdbvtqlj.exe
3220	CP.exe
5024	CP.exe
2248	i_nifdbvtqlj.exe
5352	qnigaysqki.sys
5268	CP.exe
4536	nlfdavsnlf.exe
4756	CP.exe
4428	CP.exe
3404	i_nlfdavsnlf.exe
4672	sqkfdxvpnk.sys
3564	CP.exe
4464	nhfzusnkfd.exe
5796	CP.exe
2676	CP.exe
5612	i_nhfzusnkfd.exe
3596	upnhfzxvpn.sys
5756	CP.exe
4512	khcausmkec.exe
4136	CP.exe
1104	CP.exe
4888	i_khcausmkec.exe
4796	wupmhfzxrp.sys
4808	CP.exe
5352	zxrpkhczxr.exe
1336	CP.exe
5260	CP.exe
5276	i_zxrpkhczxr.exe
4224	ecwurmjhbz.sys
1124	CP.exe
628	zwuomgezwr.exe
5520	CP.exe
5592	CP.exe
3328	i_zwuomgezwr.exe
5084	dbztrojhbz.sys
4956	CP.exe
6112	dbwtomjebw.exe
1424	CP.exe
2004	CP.exe
4240	i_dbwtomjebw.exe
4204	oljebwuolg.sys
3024	CP.exe
2984	bvtnljdywq.exe
4160	CP.exe
1916	CP.exe
4584	i_bvtnljdywq.exe
4224	jdbvtqoigb.sys
1568	CP.exe
2284	jdbvtnlgdy.exe
1540	CP.exe
6064	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_812856761\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_121784286\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1861870285\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_812856761\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_812856761\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_812856761\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_823343676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_121784286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3388_1861870285\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzusnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzusnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwqjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdbwqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdbwqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnljdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwqjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnljdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrpjhbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4788	ipconfig.exe
1168	ipconfig.exe
2888	ipconfig.exe
4476	ipconfig.exe
4656	ipconfig.exe
5968	ipconfig.exe
1576	ipconfig.exe
2940	ipconfig.exe
4812	ipconfig.exe
5556	ipconfig.exe
2252	ipconfig.exe
1492	ipconfig.exe
1620	ipconfig.exe
6000	ipconfig.exe
1520	ipconfig.exe
5312	ipconfig.exe
1164	ipconfig.exe
5964	ipconfig.exe
1248	ipconfig.exe
2876	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273418588212959"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{0E1F2A28-2570-4E41-88A8-B6CAFDDAFB31}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe
3388	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5832	i_trljdbwqjb.exe
Token: SeDebugPrivilege	4872	i_nlgdbwqoid.exe
Token: SeDebugPrivilege	2248	i_nifdbvtqlj.exe
Token: SeDebugPrivilege	3404	i_nlfdavsnlf.exe
Token: SeDebugPrivilege	5612	i_nhfzusnkfd.exe
Token: SeDebugPrivilege	4888	i_khcausmkec.exe
Token: SeDebugPrivilege	5276	i_zxrpkhczxr.exe
Token: SeDebugPrivilege	3328	i_zwuomgezwr.exe
Token: SeDebugPrivilege	4240	i_dbwtomjebw.exe
Token: SeDebugPrivilege	4584	i_bvtnljdywq.exe
Token: SeDebugPrivilege	4552	i_jdbvtnlgdy.exe
Token: SeDebugPrivilege	4276	i_nlfdyvtnlf.exe
Token: SeDebugPrivilege	4992	i_nifaxvpnif.exe
Token: SeDebugPrivilege	5564	i_spkicsmkec.exe
Token: SeDebugPrivilege	1068	i_zxrpkhczus.exe
Token: SeDebugPrivilege	2360	i_zxrpjhecwu.exe
Token: SeDebugPrivilege	4652	i_hbztrpjhbz.exe
Token: SeDebugPrivilege	5144	i_oljebwtomg.exe
Token: SeDebugPrivilege	1068	i_tolgdywqoi.exe
Token: SeDebugPrivilege	2772	i_sqlidbvtni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3408	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3408 wrote to memory of 3388	3408	iexplore.exe	89
PID 3388 wrote to memory of 5392	3388	msedge.exe	90
PID 3388 wrote to memory of 2124	3388	msedge.exe	91
PID 3388 wrote to memory of 672	3388	msedge.exe	92
PID 3388 wrote to memory of 2124	3388	msedge.exe	91
PID 3388 wrote to memory of 2124	3388	msedge.exe	91
PID 3388 wrote to memory of 2788	3388	msedge.exe	94
PID 3388 wrote to memory of 2788	3388	msedge.exe	94
PID 3388 wrote to memory of 4476	3388	msedge.exe	95
PID 3388 wrote to memory of 4476	3388	msedge.exe	95
PID 3388 wrote to memory of 4476	3388	msedge.exe	95
PID 3388 wrote to memory of 4252	3388	msedge.exe	96
PID 3388 wrote to memory of 4252	3388	msedge.exe	96
PID 3388 wrote to memory of 4252	3388	msedge.exe	96
PID 3388 wrote to memory of 3216	3388	msedge.exe	97
PID 3388 wrote to memory of 4192	3388	msedge.exe	98
PID 3388 wrote to memory of 3216	3388	msedge.exe	97
PID 3388 wrote to memory of 3216	3388	msedge.exe	97
PID 3388 wrote to memory of 4192	3388	msedge.exe	98
PID 3388 wrote to memory of 4192	3388	msedge.exe	98
PID 3388 wrote to memory of 4656	3388	msedge.exe	99
PID 3388 wrote to memory of 4656	3388	msedge.exe	99
PID 3388 wrote to memory of 1820	3388	msedge.exe	101
PID 3388 wrote to memory of 1660	3388	msedge.exe	102
PID 3388 wrote to memory of 1820	3388	msedge.exe	101
PID 3388 wrote to memory of 1660	3388	msedge.exe	102
PID 2796 wrote to memory of 1488	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 3388 wrote to memory of 5612	3388	msedge.exe	106
PID 3196 wrote to memory of 2692	3196	trljdbwqjb.exe	108
PID 3388 wrote to memory of 1620	3388	msedge.exe	113
PID 3388 wrote to memory of 1620	3388	msedge.exe	113
PID 3388 wrote to memory of 4756	3388	msedge.exe	114
PID 3388 wrote to memory of 4756	3388	msedge.exe	114
PID 2796 wrote to memory of 3792	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 2796 wrote to memory of 5012	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 5184 wrote to memory of 3112	5184	nlgdbwqoid.exe	121
PID 2796 wrote to memory of 3728	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2796 wrote to memory of 2556	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 552 wrote to memory of 3220	552	nifdbvtqlj.exe	130
PID 2796 wrote to memory of 5024	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2796 wrote to memory of 5268	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4536 wrote to memory of 4756	4536	nlfdavsnlf.exe	139
PID 2796 wrote to memory of 4428	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 3388 wrote to memory of 1168	3388	msedge.exe	145
PID 3388 wrote to memory of 5592	3388	msedge.exe	146
PID 3388 wrote to memory of 5564	3388	msedge.exe	147
PID 2796 wrote to memory of 3564	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4464 wrote to memory of 5796	4464	nhfzusnkfd.exe	152
PID 2796 wrote to memory of 2676	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 2796 wrote to memory of 5756	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4512 wrote to memory of 4136	4512	khcausmkec.exe	161
PID 2796 wrote to memory of 1104	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 2796 wrote to memory of 4808	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 5352 wrote to memory of 1336	5352	zxrpkhczxr.exe	170
PID 2796 wrote to memory of 5260	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 2796 wrote to memory of 1124	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 628 wrote to memory of 5520	628	zwuomgezwr.exe	179
PID 2796 wrote to memory of 5592	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 3388 wrote to memory of 2264	3388	msedge.exe	186
PID 3388 wrote to memory of 2264	3388	msedge.exe	186
PID 2796 wrote to memory of 4956	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 6112 wrote to memory of 1424	6112	dbwtomjebw.exe	192
PID 2796 wrote to memory of 2004	2796	2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_02a6a0c9b3085ee6dd6331da22ca0e17_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb15cdc188,0x7ffb15cdc194,0x7ffb15cdc1a0
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3065410183937237611,2013278588766000263,262144 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1496710558755510051,1767258643636809138,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
      4⤵
      System Time Discovery
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,13742998824273270706,10047911127269164859,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:13
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,11594047915167642089,2431638606759814075,2097152 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,7830318196592307505,5026838049971850236,2097152 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14592672480655862701,13834012707609247937,2097152 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:9
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,7915167418691059726,6829756538579020732,2097152 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:1
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12966282717284062449,13290857086864968358,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6220213861230074816,8849054252019868284,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,12110567568669288259,11535620348632710956,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,18419661128703298228,18222451258704338262,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,18419661128703298228,18222451258704338262,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8490408325367256505,9160721159187351059,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,6429905218545075732,14267456537157172576,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,18026950745789358084,10407239847148166711,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,3372790134848507046,16694777404858061754,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,11489159561579835311,3532057824327686107,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,158552373293560450,13028491815533756005,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9385903033559625032,15671732462971446420,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,8484641708681903242,8860634899565961539,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,4753100806563628341,17026506340302032993,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6836,i,3507742685506522011,17274047816729374799,262144 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,9628580927623663537,10298296614990957055,524288 --field-trial-handle=2172,i,12534056591960744517,6269098454839117491,262144 --variations-seed-version --mojo-platform-channel-handle=1216 /prefetch:14
      4⤵
      PID:5220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwqjb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1488
- - C:\Temp\trljdbwqjb.exe
    C:\Temp\trljdbwqjb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwqjb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\i_trljdbwqjb.exe
    C:\Temp\i_trljdbwqjb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdbwqoid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\nlgdbwqoid.exe
    C:\Temp\nlgdbwqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdbwqoid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\i_nlgdbwqoid.exe
    C:\Temp\i_nlgdbwqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdbvtqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\nifdbvtqlj.exe
    C:\Temp\nifdbvtqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdbvtqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5024
- - C:\Temp\i_nifdbvtqlj.exe
    C:\Temp\i_nifdbvtqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdavsnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5268
- - C:\Temp\nlfdavsnlf.exe
    C:\Temp\nlfdavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdavsnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\i_nlfdavsnlf.exe
    C:\Temp\i_nlfdavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzusnkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\nhfzusnkfd.exe
    C:\Temp\nhfzusnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzusnkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\i_nhfzusnkfd.exe
    C:\Temp\i_nhfzusnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\khcausmkec.exe
    C:\Temp\khcausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1104
- - C:\Temp\i_khcausmkec.exe
    C:\Temp\i_khcausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\zxrpkhczxr.exe
    C:\Temp\zxrpkhczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\i_zxrpkhczxr.exe
    C:\Temp\i_zxrpkhczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1124
- - C:\Temp\zwuomgezwr.exe
    C:\Temp\zwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5592
- - C:\Temp\i_zwuomgezwr.exe
    C:\Temp\i_zwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtomjebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\dbwtomjebw.exe
    C:\Temp\dbwtomjebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtomjebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2004
- - C:\Temp\i_dbwtomjebw.exe
    C:\Temp\i_dbwtomjebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnljdywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\bvtnljdywq.exe
    C:\Temp\bvtnljdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnljdywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1916
- - C:\Temp\i_bvtnljdywq.exe
    C:\Temp\i_bvtnljdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1568
- - C:\Temp\jdbvtnlgdy.exe
    C:\Temp\jdbvtnlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\i_jdbvtnlgdy.exe
    C:\Temp\i_jdbvtnlgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvtnlf.exe ups_run
  2⤵
  PID:3616
- - C:\Temp\nlfdyvtnlf.exe
    C:\Temp\nlfdyvtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvtnlf.exe ups_ins
  2⤵
  PID:3488
- - C:\Temp\i_nlfdyvtnlf.exe
    C:\Temp\i_nlfdyvtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaxvpnif.exe ups_run
  2⤵
  PID:4888
- - C:\Temp\nifaxvpnif.exe
    C:\Temp\nifaxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaxvpnif.exe ups_ins
  2⤵
  PID:2580
- - C:\Temp\i_nifaxvpnif.exe
    C:\Temp\i_nifaxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicsmkec.exe ups_run
  2⤵
  PID:1988
- - C:\Temp\spkicsmkec.exe
    C:\Temp\spkicsmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicsmkec.exe ups_ins
  2⤵
  PID:3664
- - C:\Temp\i_spkicsmkec.exe
    C:\Temp\i_spkicsmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run
  2⤵
  PID:5612
- - C:\Temp\zxrpkhczus.exe
    C:\Temp\zxrpkhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins
  2⤵
  PID:5384
- - C:\Temp\i_zxrpkhczus.exe
    C:\Temp\i_zxrpkhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhecwu.exe ups_run
  2⤵
  PID:5052
- - C:\Temp\zxrpjhecwu.exe
    C:\Temp\zxrpjhecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhecwu.exe ups_ins
  2⤵
  PID:3312
- - C:\Temp\i_zxrpjhecwu.exe
    C:\Temp\i_zxrpjhecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrpjhbz.exe ups_run
  2⤵
  PID:2780
- - C:\Temp\hbztrpjhbz.exe
    C:\Temp\hbztrpjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrpjhbz.exe ups_ins
  2⤵
  PID:3532
- - C:\Temp\i_hbztrpjhbz.exe
    C:\Temp\i_hbztrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljebwtomg.exe ups_run
  2⤵
  PID:1072
- - C:\Temp\oljebwtomg.exe
    C:\Temp\oljebwtomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljebwtomg.exe ups_ins
  2⤵
  PID:5840
- - C:\Temp\i_oljebwtomg.exe
    C:\Temp\i_oljebwtomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgdywqoi.exe ups_run
  2⤵
  PID:2252
- - C:\Temp\tolgdywqoi.exe
    C:\Temp\tolgdywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgdywqoi.exe ups_ins
  2⤵
  PID:1004
- - C:\Temp\i_tolgdywqoi.exe
    C:\Temp\i_tolgdywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtni.exe ups_run
  2⤵
  PID:5740
- - C:\Temp\sqlidbvtni.exe
    C:\Temp\sqlidbvtni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtni.exe ups_ins
  2⤵
  PID:1552
- - C:\Temp\i_sqlidbvtni.exe
    C:\Temp\i_sqlidbvtni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3352

C:\Temp\ywqojgbztr.sys
C:\Temp\ywqojgbztr.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\sqkfdxvpnk.sys
C:\Temp\sqkfdxvpnk.sys
1⤵
- Executes dropped EXE
PID:4672

C:\Temp\upnhfzxvpn.sys
C:\Temp\upnhfzxvpn.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\ecwurmjhbz.sys
C:\Temp\ecwurmjhbz.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\dbztrojhbz.sys
C:\Temp\dbztrojhbz.sys
1⤵
- Executes dropped EXE
PID:5084

C:\Temp\oljebwuolg.sys
C:\Temp\oljebwuolg.sys
1⤵
- Executes dropped EXE
PID:4204

C:\Temp\jdbvtqoigb.sys
C:\Temp\jdbvtqoigb.sys
1⤵
- Executes dropped EXE
PID:4224

C:\Temp\qlidavtnlf.sys
C:\Temp\qlidavtnlf.sys
1⤵
PID:2008

C:\Temp\ayvqfaxsnk.sys
C:\Temp\ayvqfaxsnk.sys
1⤵
PID:1612

C:\Temp\spnhfaxvpn.sys
C:\Temp\spnhfaxvpn.sys
1⤵
PID:1616

C:\Temp\zxupnhfzxr.sys
C:\Temp\zxupnhfzxr.sys
1⤵
PID:4840

C:\Temp\zxrpjhbzxr.sys
C:\Temp\zxrpjhbzxr.sys
1⤵
PID:4544

C:\Temp\mgeczurpjh.sys
C:\Temp\mgeczurpjh.sys
1⤵
PID:5532

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
PID:3228

C:\Temp\toljdbvtqo.sys
C:\Temp\toljdbvtqo.sys
1⤵
PID:5596

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
PID:5408

C:\Temp\dyvtnlgdxv.sys
C:\Temp\dyvtnlgdxv.sys
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausmkec.exe

Path C:\Temp\i_khcausmkec.exe
Size 226KB
SHA256 0b3e0d82b97e3b3f5ff85dc65cee0f32c1fff5495631ca0b0dc807af9c5a1915
MD5 882785f6749156fdaee3afd026cd219b
SHA1 b264413818f240a12febba18fe4dd457a55a3ba6
SHA512 378799e88dac77f94f3762b5e8f909fab4417fb7142108b07cd6377ca373406b5d3273d9785b9d5e1d8bad7d6cd0f7bb20fdef6a203bce4570f15a3ed11fceb5
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T10534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzusnkfd.exe

Path C:\Temp\i_nhfzusnkfd.exe
Size 226KB
SHA256 afb907ad8f0dc3b06ed68a6a3e694b370b7e180d42cdfdd22f509db4720af5ac
MD5 08af7904becf132815758f5f3347e785
SHA1 042b7345670f0299f059962940288428dba6ed56
SHA512 e6608d941e7dbfe0a1b1b58bcd2991a768b9f33d6f868b88c2dbb212d8d7636160f8457aa15805f9b4a44a5f36acbfc9844bc00688ebbfe4c0afc473ff825663
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T1F634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifdbvtqlj.exe

Path C:\Temp\i_nifdbvtqlj.exe
Size 226KB
SHA256 5483d41d9951ccc767f5dce3651c676b5cf161656103808a2810722f2b92e106
MD5 60ed29c975c72068b8111ed102858841
SHA1 f3be1a05b971085b29d5192fce06060458eb2c63
SHA512 e17f4ed7a79ef3768e77dc8228e980fd66aa32fbda4174d5824cbf24a0ad8e95b968c27e082a9188367808dc96e38087f6134d9d2b197a274b4849eea4ed2be1
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdavsnlf.exe

Path C:\Temp\i_nlfdavsnlf.exe
Size 226KB
SHA256 33e1ae45491e3e06d0e873e249f4ec5b51c34f8a44cd1e5832171b5950602810
MD5 7200b665c92d65520e32689d5abf775d
SHA1 41f1be8638d86013c00ca3ea75f8de838babedcd
SHA512 47b409d3256ce16c889e8fda59bc237212f4cfc027a6d73b74d07264f3d99ec37856369c1073512b087cc266e813a8fefda4b716bc4e43ff876322176580f178
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T19234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdbwqoid.exe

Path C:\Temp\i_nlgdbwqoid.exe
Size 226KB
SHA256 07a6809314999130a7914afebc3ef34ac4e790460f2bfac2e3f34fd859e5a2a7
MD5 3f0fc6438054a460fbc83b7e15aa67ce
SHA1 637c9f764da9a95237ca31b3f6e0e543b5fa119d
SHA512 ec97b5a1874dee2694adfdb0309cdac1861fa36e27161d3287e24dc4f2068034880ee202b8f6c6785592180e75dcde2fab04e494d7b5ba3da0004037346c6566
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwqjb.exe

Path C:\Temp\i_trljdbwqjb.exe
Size 226KB
SHA256 35662db1e0c53976b1b11fed10d06bd21beef247e0d1b15f5e160ab9cf5fdd37
MD5 c5dd40b30e7f90296958a73456ed3b0d
SHA1 b165d54cf287eb0e1f558edfcdd7c75b76210bad
SHA512 c752b1b565f98280dee6fad0ed025abe707b3cfb90faea9e27e7c8ffdaf013780cc670eda4baa230ac25a778b13e72d4687c7b95bd185e47f82c8ceffb1f8b76
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkec.exe

Path C:\Temp\khcausmkec.exe
Size 226KB
SHA256 afda641b223460d740d33ee9babe07cb8c845895bd872f25a74f5f166567be0c
MD5 78f6a909744c7b6e7168c8e852231e01
SHA1 a691648d295a65e2ba6f485cf10ff4ff8f1ae0ba
SHA512 64c59b15730d436cc648912721bb5372b1e4a4e956300cc4a3dd3650cea9e1e73b978bf35efd8f60db3f61be2c201b78996051a9bfbdb41bf0af804801a426b5
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T11734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzusnkfd.exe

Path C:\Temp\nhfzusnkfd.exe
Size 226KB
SHA256 06d3c88c6ed56f91833c621f0f643b6498dc045078b4d20e05fba3fd619a6ede
MD5 5c4bf403aa003bf4324f9ea66fa0a36c
SHA1 2cfbe14813eae8f26f0d0000128d02b691f46b99
SHA512 e2ffb885363ea321d564202f8920f42fa72df0210cd1b9051e0e0711abd1ff2eb0c56352735004c76235e67d9c94c58e8630f8df1ea3b074b3876d4f4ad8a31a
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdbvtqlj.exe

Path C:\Temp\nifdbvtqlj.exe
Size 226KB
SHA256 4fe1c9e40462bb43219f64789313d89957b2c246fd79bb5f65bed99a1bfc15ee
MD5 9d55d591181ff8196cada7cfafbd3b80
SHA1 cf42c77dafe2a751a3518016b56bf891c95f022c
SHA512 d1a0f52fc3cb97322fa466fbc67c9aa7d0703827faf6a52bd3c1ac888bb754630d4f9ef86cccd2672023f4b8b6ba2f75c7ddb0bca5535ae32e7c76ca9f0a891b
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavsnlf.exe

Path C:\Temp\nlfdavsnlf.exe
Size 226KB
SHA256 73722347e471b22f39dfbf7d0b0faa579cff310470e24013402729f0cfae83f5
MD5 f9ca863c7171a400d9286a5512c80943
SHA1 4b366705865cbc8ecb1bc4fe0c1c290cce7dbdd8
SHA512 3fbebe5cedd5e9bbdf12d22faef064b36152bd67185867fc7b0c3553e42023533117f6848e7b4d71884203da71fbc09ad9436a31473e1723dd6b94ca680cb642
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T14634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdbwqoid.exe

Path C:\Temp\nlgdbwqoid.exe
Size 226KB
SHA256 2a93f3a307be4dcc2cdd1f7c1efe750bcbad4ccbf034befdb606560748b330f9
MD5 c57b4116cbabfdf9299cda46e2e33114
SHA1 806a4fc54a2ea42508d9d1795cbb5f811babf92a
SHA512 bd53883870881a35dd37652801c5f7461c4aba3b53b4375ea9fbb6c191310649c4c4fda552be78ec7eaa104c605a87d684cd84d098960e1e7af211883afbed0d
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.sys

Path C:\Temp\qnigaysqki.sys
Size 141KB
SHA256 17884ae10ba7c88b542eac4e255a473dafcaa47a13eb517c280da71782cbaa12
MD5 5587799764b30cdfcb76008a12023cca
SHA1 a5a879a84b634880676fd2c5c053caab37bc8422
SHA512 dd9ed167274e5e860115b6f4eab374275b601fe03485dba475a22d6188b6797c850f76401d8dc06dc9584abfe6bc7742474ccc68c3f45f07be779ecddfd6421f
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EAE37C12B292D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E643D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.sys

Path C:\Temp\qoigaysqli.sys
Size 141KB
SHA256 7085a017d13c5da364fa2f54e3f77df50f0cf1e03fa34dc589fb481cd3a1193d
MD5 4f092b5e02a4e8c59b69ebae9bea7631
SHA1 fad144603bce825f97ac49f810e930dbd80722d3
SHA512 93a760e0c7d43bdabd7eccd191aa2e9e72d5471bb919159906d681919b411e1796a2a2cf398d746974fae444700501941d9008679bd4506128d779a6538d4748
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkfdxvpnk.sys

Path C:\Temp\sqkfdxvpnk.sys
Size 141KB
SHA256 ebc6985da6707573b9393b6a6b13936796e76f9dd15fc4de4ce5bef14ca4d199
MD5 be562c77b3983cdde097bb33beb7ab13
SHA1 8e1b7c0018aceaf80800eb839adce3a5721e6c94
SHA512 8aa734fb9bba04eb65da603f147d771b9cbc4c11b20331e9243d21a60de8a553490c4123d6af5468f3521a8b2b0004b559d43205f63e4e0cedac5889bc0d587e
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwqjb.exe

Path C:\Temp\trljdbwqjb.exe
Size 226KB
SHA256 be9ad99411ca0b0ba77a1ad26f9c1d9f63c4c6f8febba440ee630033aa97e6cb
MD5 ed896541fe08dce16db204f61844ce1e
SHA1 5456d11cb90a3f228660ebb8b21ed5504a2483e7
SHA512 f4ae1ecd6793769125f593a260353ec1e2e474d44608ab03cbd98cadd998e6e939d86dd1327357ed29a5f07bfa2551dde2e1496a859299edd2754acab86717f0
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T1CE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxvpn.sys

Path C:\Temp\upnhfzxvpn.sys
Size 141KB
SHA256 f94081c3a771df59b5afe09e81366a8b1fbdcfe653b97c323c3de52d3b3f0fc9
MD5 59e33dfddea270f0d0408abb6cc70931
SHA1 1f429d434c90ee24a690878ab8f2ec4500aca07e
SHA512 55f231d4c65b3fc242cbb5ebf45c9f5cb512e722821281705336bf0b96c612234026490aac86c007c69f47bac726ce037b2e1adcc8947ce3e3ed9d0fbcd4f4e8
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 141KB
SHA256 86b14a6e5fe652918d359f926a5375b85a76d766bbaf06d33dcf5be7038ac0a3
MD5 d52360037f205cb6c111b5d233ca1a18
SHA1 36590e61fa9fea810482da5bd28ec145c218c9f3
SHA512 b4c95eba72c536b3aa5e659e66b59d8ea25f998e70b17c0c288f6548aac95203edaedaa94c28a4212e5462b7e2c7c1d2700a0fcba293b171a7a5436f7ea82d25
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqojgbztr.sys

Path C:\Temp\ywqojgbztr.sys
Size 141KB
SHA256 f684ea69de45e38f8bd2ea9892e5c266f547d0dbf561195bb66e1edee8f8825e
MD5 a281c43de3c2902d5069a1b5be61eb63
SHA1 bcf05b07dedd3fc2226dd6525605cbd1a6695e25
SHA512 74a56461a99bfab1e051db1c3e5f0ae0debdbc771427a4efda36bb1068685a8bd814dcc8a7aeb07c585cfd16551ed4f1d77148e200dd05a97bee48c35f55d00a
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cd66eeb3b8a8d8e1a95b3ae90dd883056a28f7e24640d97e889ec53c8bdf14e1
MD5 d412fd22172dba426e6233a8f12e654e
SHA1 457882092bb4050814d8cd9c74dcdebb8e4f1ef7
SHA512 0fcd07592e76c9fab5dae241d17c84f499738a32afa505017ef030a3a9240e4b503ea8d49f51fd3e32fd48343a87557d89f5703ab16a3f4cc7e9ec1c2b7eb6a9
TLSH
T17051A854247589E1E7B3027179FF4088FFBC889D8227EF893748B9B4AA4677452BE490
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59afbe.TMP
Size 2KB
SHA256 37529d77e3bbe0bcabf3d15414ae7284ee0467be4670c8fc315cd2e652e92b98
MD5 533e7dccb0eca8512b3fa92d22325fa2
SHA1 13e53874aa4d5dbab983dd218f3d49d7274f7892
SHA512 23defe612304fbed475ec967f93e243c81c909ad5ecfd4e7171803b56b0dfd06d8f73fe783838868c4546ec687fd1c7d73c5495aa9672e61b11627b9159b7371
TLSH
T10651B854257589E0E7B3027179FF4188FFBCC89D8227EF893748B9B4AA4677452BE480
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fa8c73b8062300dcf2f9a76b9b37cc85a62659d646a32d2bbfc1ea832d6fac48
MD5 7ce944b0df5b2ceafb4131a64b34ce8d
SHA1 36e244e21f339a83f3a4bd1bb794568a0ef4f06a
SHA512 9c669ea33b17352d03511e42e363334c156fc7211877dd7ee8951737ed2b02d41a8a9d97b7fb523159f9215805a80f8f90c599e61e38f7b5ba200f78ac7fc448
TLSH
T161519DF7C7E8856E9A0196F0BA187E2FCE1D0914832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 66f64a68bcd4808e3fc49aa2068fcd2725309a38a990e7a550cac7916b6f42d7
MD5 705bc8962419610df108128780483bd7
SHA1 9e5a88acf206c8527eebff2ff187a2714e0f3486
SHA512 764d48171998d73f2539963f93d30405d5f3dbe6a3bd2ac233e24a304c95f29c50a2000be0f082c6c8b217975eba905a6a970e09235ffc420d06cbd33add1320
SSDEEP 192:sxRVVuRICyM/jK1Ml8wcYk/f0YsaEOBZFn0erQXzoA8p9Vs/g6+WNCV35/Y47RAC:sxR2PCf/fxsahPF34/5a/Ke0o3
TLSH
T13162D9156A3899378CDBD209FA55BF53D6F81573E2901E08AAFC8B0C05E76DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d4c9516ecb57ff301dda421a96cd1369b1c0f213ef37d8828559611e53cae76f
MD5 0ec2f1d0896243d7b54ce3ceffeb87db
SHA1 e576347f59fc30c7397fc3d2267881828f10eab9
SHA512 0581da310e4aa08dcf4653781015edee0fa8ce8b644fb0eeb5ed795f6407714eb8859954ec4ad862ea4dc05a2d40266ef4af8546ff0053efa0ee5879c8f9fb83
SSDEEP 192:sxRVwuRICyM/jK1Ml8wcYk/f0YsYoEOBZFn0erQXzoA8p9Vs/g6+WNCV35/Y47RN:sxRtPCf/fxsVhPF34/5a/Ke0oD
TLSH
T10B62EA1569349937CCDBD208FA55BF53D6F81572E2900E04A9FC8B0C05E76DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6fae30b7fd111d3c9af725fca106b92b77f26fc712e776b1a8e5087de14df77f
MD5 569914bd16971a515d4cbc2d0b3f7ba5
SHA1 c918352e75b8628653373e6ca52fb1f9d9077cd5
SHA512 1a2d30b7b90d99043bd19655a20013425a6c060ac0cc6ecfe54d23fdf8006801dac580eb8f4a26b1dbc7bf6d7b8a4f6f069191fd2137adcea9b7440271e66861
SSDEEP 192:sxRVwuRICyM/jK1Ml8UQYTcYk/f0YsYoEryqBZFn0erQXzoA8prVs/g6+WNCV358:sxRtPqjf/fxsVnqPF3O/5a/xe0ot
TLSH
T1FF62DA16A9289977CCDBD209FA55BF53D6F81572E2900E04AAFCCB0C05E76DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e4535fbd7e0e2dbddafa8034d004294ec695cea55483426960da6061318b78e2
MD5 1344cd200886f17010435c1b2b84187d
SHA1 d9851ccc1ca4fd1b8987964a49e7890afffe8e93
SHA512 42c3644fdf8243c2cf77eebe56ba75f709d16a8adadf2a02cde172d6a53d9271c79d3c087fcb394e7a06d4689cf2d070129e06cd8d6cde35c0cb13117edf08a4
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaqzXNGWroKTpa8:Tqi0NHE7C3WgNxfezu1jaNqz9GtQ
TLSH
T124E2ED3B680CCB7E4F804E9CEC2A7E9A6DE802CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4bb0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4bb0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 713d8683e2c90a4fffb587383a478aca576b35f7517c0cf9d6d57bf8bf4ad8dd
MD5 e36016769fdb4d85a984c9ee6cf00ec0
SHA1 679201744b979cab4d84fd3484869a06ad2515ee
SHA512 77dacb9de9b888820e1c1ed16e3f556283f3d651603e659bf92d32aafa5c6827e1b1ec94c61c8ad1ceefd0db06fd6d35cf6e683a65c779ff515c2359b1927731
SSDEEP 768:cj+9x3hzthvoAvA+AW+152MvSCaihc8Kzh:79x3zApx2pectzh
TLSH
T1BCF2AD71AC5ADD778CE6C6C4B30B3B97AFB012A385810E54C9D8AB0D01C774D274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b7358c1f434e3d37c5b80995a150cdb35724a5349cc16b899b04e2e19ee62e70
MD5 dfc340ab7d59c2b76d360e7b110629bf
SHA1 565a13084b679ca9473fa5234bac1c69f4779031
SHA512 4911bff924ee315a216cd19aaa911094fee36722bae8fd13983f71695cd8b64d9342b78a1f1329ed47b4e660c76d598f09dcabd8cf23d2c74132c80fcf742c91
SSDEEP 768:Arv+4UNbd23QPthvt+AW+152MvSCa2WG+8rir9:Absbs3wpx2pfGDriR
TLSH
T1D003BF32E8ADA9778CF686C4B64B36137EB0519389C50B94CDD92B0D069B6DD230FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 38d8c5915102663ce36c09b88dc0dac3917810fb6f4f844d86127082c2f56c4d
MD5 83c544d1af13f2d98f28f3b56f18f616
SHA1 4e03d66580124d135da5bc8e5400c46068c0d171
SHA512 9a0c0f49fbae7e25a0a2dc90e0fc3971235437a99eefe122a9c2773d16579f7b8397ea019ad26c09189a6e591276b5d9d0fba34708f72bd1d8b764f9665c19c4
SSDEEP 768:/rv+4UNbdv3KzthvoAv8+AW+152MvSCaih+8rir1:/bsbN3o8px2peDriR
TLSH
T13913AE31A86EED338DA6D6C4B60B7643BFB0259388C50F54C9DA6B4D058B68D270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9b9fd477c2eaf430f031befcddfa550cbc2e3f6b3ac1e25f46bf87a1e235a4a7
MD5 ff7ef532df4894b6dacc54902adcc258
SHA1 59d3bd984f1a19bf1db991ad514414da02c58927
SHA512 c2b3886379f8edd1bb30eef3bf42603622094f307056547e4989af622566f90b72030466a9df95e67b17aabeb607658cb867653df1f680c1eff5682a58bd0b9d
SSDEEP 768:+F1j+9X32wg/+6hvoAv9+AW+152MvSCaihc8Kzh:79X3a9px2pectzh
TLSH
T1A21328F298D7C936C8AE8787633D6E469EBCD153B5841994FBC45E0CCC8627FD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3388_1999523698\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1612-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1616-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2260-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3596-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3596-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4204-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4204-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-185-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5084-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5408-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5532-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5596-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download