3f8981bd5f8f7002f928ce91aaeead9dd60c8437e5faad275c5dabedd6660fe1

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260701-cj79saet2w
SHA256 3f8981bd5f8f7002f928ce91aaeead9dd60c8437e5faad275c5dabedd6660fe1
MD5 f1ac6c8e671d70e9f0477b4334b81ddd
SHA1 a4d14adeae3cf83fd78296ff90a4e967e353f121
SHA512 9ac9e484954c54bf0a9af6490a9ca8282b0a2bbd8ce355f798eacb75625b5f458ca51ccc88ed0d12770242d2507a44374c13b574433007e86dda1ed16b74f28b
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1512	CP.exe
1728	jgbwtrmgeb.exe
5624	CP.exe
3968	CP.exe
2364	i_jgbwtrmgeb.exe
5592	ztrljdbwto.sys
5736	CP.exe
1480	gaytqojdbv.exe
2288	CP.exe
5200	CP.exe
5800	i_gaytqojdbv.exe
4352	tqlidbvtnl.sys
3152	CP.exe
5864	lgdywqniga.exe
4472	CP.exe
4164	CP.exe
1780	i_lgdywqniga.exe
2992	gayvqnigay.sys
4516	CP.exe
3352	vpnlfdyvqn.exe
2764	CP.exe
3400	CP.exe
2368	i_vpnlfdyvqn.exe
428	ifaxsqkica.sys
4220	CP.exe
2452	xvsnkfdxvp.exe
5528	CP.exe
1084	CP.exe
1204	i_xvsnkfdxvp.exe
5012	axsqkicaus.sys
5048	CP.exe
3212	hfzxrpkhcz.exe
3424	CP.exe
4540	CP.exe
5456	i_hfzxrpkhcz.exe
5972	khcausmkec.sys
5876	CP.exe
4116	zxrpjhczus.exe
5756	CP.exe
1432	CP.exe
4916	i_zxrpjhczus.exe
2488	rmjecwuomg.sys
4296	CP.exe
3080	hezwrpjhbz.exe
3456	CP.exe
5308	CP.exe
2252	i_hezwrpjhbz.exe
1796	ywuomgezwr.sys
3004	CP.exe
5272	rojhbzwroj.exe
1120	CP.exe
4140	CP.exe
2900	i_rojhbzwroj.exe
6032	olgeywqoiy.sys
3396	CP.exe
2632	wtoigaytql.exe
1100	CP.exe
1232	CP.exe
3596	i_wtoigaytql.exe
1052	ytqljgbytr.sys
5856	CP.exe
3408	oigaykidav.exe
2644	CP.exe
5444	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_980530561\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_645477816\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_645477816\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1946746591\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1019878667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1019878667\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1946746591\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1019878667\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1019878667\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaykidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtrmgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqojdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqojdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbwtrmgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaykidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxuomhezxr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1528	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5644	ipconfig.exe
1932	ipconfig.exe
1136	ipconfig.exe
3448	ipconfig.exe
5456	ipconfig.exe
5568	ipconfig.exe
1908	ipconfig.exe
5776	ipconfig.exe
2752	ipconfig.exe
1660	ipconfig.exe
5608	ipconfig.exe
4368	ipconfig.exe
3264	ipconfig.exe
4804	ipconfig.exe
1516	ipconfig.exe
1308	ipconfig.exe
1036	ipconfig.exe
5844	ipconfig.exe
1576	ipconfig.exe
2692	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273452569350274"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{DE8731DC-76F9-4253-8C25-814DA3C54251}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	i_jgbwtrmgeb.exe
Token: SeDebugPrivilege	5800	i_gaytqojdbv.exe
Token: SeDebugPrivilege	1780	i_lgdywqniga.exe
Token: SeDebugPrivilege	2368	i_vpnlfdyvqn.exe
Token: SeDebugPrivilege	1204	i_xvsnkfdxvp.exe
Token: SeDebugPrivilege	5456	i_hfzxrpkhcz.exe
Token: SeDebugPrivilege	4916	i_zxrpjhczus.exe
Token: SeDebugPrivilege	2252	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	2900	i_rojhbzwroj.exe
Token: SeDebugPrivilege	3596	i_wtoigaytql.exe
Token: SeDebugPrivilege	1908	i_oigaykidav.exe
Token: SeDebugPrivilege	4828	i_tnlidbvsnl.exe
Token: SeDebugPrivilege	4852	i_fdxvpnlfdx.exe
Token: SeDebugPrivilege	1176	i_vsmkfcxvpn.exe
Token: SeDebugPrivilege	5188	i_cxuomhezxr.exe
Token: SeDebugPrivilege	1576	i_urmkecwuom.exe
Token: SeDebugPrivilege	5224	i_ztrmgeywro.exe
Token: SeDebugPrivilege	5616	i_jgbztrljdb.exe
Token: SeDebugPrivilege	4792	i_vqoigaysql.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 1600	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 1600 wrote to memory of 2924	1600	iexplore.exe	89
PID 2924 wrote to memory of 1804	2924	msedge.exe	90
PID 2924 wrote to memory of 1076	2924	msedge.exe	92
PID 2924 wrote to memory of 1528	2924	msedge.exe	93
PID 2924 wrote to memory of 1076	2924	msedge.exe	92
PID 2924 wrote to memory of 1076	2924	msedge.exe	92
PID 2924 wrote to memory of 2756	2924	msedge.exe	94
PID 2924 wrote to memory of 2756	2924	msedge.exe	94
PID 2924 wrote to memory of 4712	2924	msedge.exe	95
PID 2924 wrote to memory of 2564	2924	msedge.exe	96
PID 2924 wrote to memory of 4712	2924	msedge.exe	95
PID 2924 wrote to memory of 4712	2924	msedge.exe	95
PID 2924 wrote to memory of 2564	2924	msedge.exe	96
PID 2924 wrote to memory of 2564	2924	msedge.exe	96
PID 2924 wrote to memory of 2228	2924	msedge.exe	97
PID 2924 wrote to memory of 2228	2924	msedge.exe	97
PID 2924 wrote to memory of 2228	2924	msedge.exe	97
PID 2924 wrote to memory of 956	2924	msedge.exe	98
PID 2924 wrote to memory of 956	2924	msedge.exe	98
PID 2924 wrote to memory of 956	2924	msedge.exe	98
PID 2924 wrote to memory of 2908	2924	msedge.exe	99
PID 2924 wrote to memory of 2908	2924	msedge.exe	99
PID 3020 wrote to memory of 1512	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 1728 wrote to memory of 5624	1728	jgbwtrmgeb.exe	104
PID 2924 wrote to memory of 5184	2924	msedge.exe	107
PID 2924 wrote to memory of 3404	2924	msedge.exe	108
PID 2924 wrote to memory of 5184	2924	msedge.exe	107
PID 2924 wrote to memory of 3404	2924	msedge.exe	108
PID 2924 wrote to memory of 2792	2924	msedge.exe	110
PID 2924 wrote to memory of 4300	2924	msedge.exe	113
PID 2924 wrote to memory of 4300	2924	msedge.exe	113
PID 2924 wrote to memory of 4460	2924	msedge.exe	114
PID 2924 wrote to memory of 4460	2924	msedge.exe	114
PID 3020 wrote to memory of 3968	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 3020 wrote to memory of 5736	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 1480 wrote to memory of 2288	1480	gaytqojdbv.exe	121
PID 3020 wrote to memory of 5200	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 3020 wrote to memory of 3152	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 5864 wrote to memory of 4472	5864	lgdywqniga.exe	130
PID 3020 wrote to memory of 4164	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 3020 wrote to memory of 4516	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3352 wrote to memory of 2764	3352	vpnlfdyvqn.exe	139
PID 3020 wrote to memory of 3400	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 2924 wrote to memory of 5944	2924	msedge.exe	145
PID 2924 wrote to memory of 2128	2924	msedge.exe	146
PID 2924 wrote to memory of 3596	2924	msedge.exe	147
PID 3020 wrote to memory of 4220	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 2452 wrote to memory of 5528	2452	xvsnkfdxvp.exe	152
PID 3020 wrote to memory of 1084	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 3020 wrote to memory of 5048	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 3212 wrote to memory of 3424	3212	hfzxrpkhcz.exe	161
PID 3020 wrote to memory of 4540	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 3020 wrote to memory of 5876	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4116 wrote to memory of 5756	4116	zxrpjhczus.exe	170
PID 3020 wrote to memory of 1432	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 3020 wrote to memory of 4296	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 3080 wrote to memory of 3456	3080	hezwrpjhbz.exe	179
PID 3020 wrote to memory of 5308	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 2924 wrote to memory of 5192	2924	msedge.exe	184
PID 2924 wrote to memory of 5192	2924	msedge.exe	184
PID 3020 wrote to memory of 3004	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 5272 wrote to memory of 1120	5272	rojhbzwroj.exe	192
PID 3020 wrote to memory of 4140	3020	2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_f1ac6c8e671d70e9f0477b4334b81ddd_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa7694c188,0x7ffa7694c194,0x7ffa7694c1a0
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1992,i,6662813232244523429,12614060116005823649,262144 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,13000621466244934611,13779833620050705515,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,8638636884124911725,18276883088095331113,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,8022706692780424505,5817557172022623219,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,1738491016027766464,14413528230141640421,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4567301409119020135,5582378443149011451,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,13369233811748787376,5286667041407545436,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:9
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,1818579972565842878,6802652020157741446,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,6239429350991994620,11129022474601664481,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,14664954303930279136,16908704215444260867,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1814925891040215483,13330963418310331806,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1814925891040215483,13330963418310331806,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,5580308189796936501,9690186617137683244,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,1528278520508144534,9896081787455710781,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,13059264080129367412,16502911547002518828,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:14
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1244,i,625279979458615182,12081306512231711036,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,6175724093863695813,2233665658399009767,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15357183060048228716,12668555852573587720,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,14473690594760392804,10736411448707418987,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3744,i,13996078359291510627,16868606427565703214,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3728,i,14961281108021199852,4013212279740036847,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,1426461364262749689,17908572889143207986,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5124,i,18211959566128715580,16698281995308276185,2097152 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,3913736384828827278,16991143315799752293,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,14445431704881629016,4299016054541993506,262144 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,11117101309144799877,15282911893164226968,524288 --field-trial-handle=2540,i,16637414021909682929,5569042017688535796,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbwtrmgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1512
- - C:\Temp\jgbwtrmgeb.exe
    C:\Temp\jgbwtrmgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbwtrmgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\i_jgbwtrmgeb.exe
    C:\Temp\i_jgbwtrmgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqojdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5736
- - C:\Temp\gaytqojdbv.exe
    C:\Temp\gaytqojdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqojdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5200
- - C:\Temp\i_gaytqojdbv.exe
    C:\Temp\i_gaytqojdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\lgdywqniga.exe
    C:\Temp\lgdywqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_lgdywqniga.exe
    C:\Temp\i_lgdywqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfdyvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\vpnlfdyvqn.exe
    C:\Temp\vpnlfdyvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfdyvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\i_vpnlfdyvqn.exe
    C:\Temp\i_vpnlfdyvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\xvsnkfdxvp.exe
    C:\Temp\xvsnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1084
- - C:\Temp\i_xvsnkfdxvp.exe
    C:\Temp\i_xvsnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5048
- - C:\Temp\hfzxrpkhcz.exe
    C:\Temp\hfzxrpkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\i_hfzxrpkhcz.exe
    C:\Temp\i_hfzxrpkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5876
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\hezwrpjhbz.exe
    C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5308
- - C:\Temp\i_hezwrpjhbz.exe
    C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbzwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Temp\rojhbzwroj.exe
    C:\Temp\rojhbzwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbzwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\i_rojhbzwroj.exe
    C:\Temp\i_rojhbzwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\wtoigaytql.exe
    C:\Temp\wtoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Temp\i_wtoigaytql.exe
    C:\Temp\i_wtoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaykidav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5856
- - C:\Temp\oigaykidav.exe
    C:\Temp\oigaykidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaykidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5444
- - C:\Temp\i_oigaykidav.exe
    C:\Temp\i_oigaykidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidbvsnl.exe ups_run
  2⤵
  PID:1688
- - C:\Temp\tnlidbvsnl.exe
    C:\Temp\tnlidbvsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidbvsnl.exe ups_ins
  2⤵
  PID:2908
- - C:\Temp\i_tnlidbvsnl.exe
    C:\Temp\i_tnlidbvsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnlfdx.exe ups_run
  2⤵
  PID:6136
- - C:\Temp\fdxvpnlfdx.exe
    C:\Temp\fdxvpnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnlfdx.exe ups_ins
  2⤵
  PID:3204
- - C:\Temp\i_fdxvpnlfdx.exe
    C:\Temp\i_fdxvpnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsmkfcxvpn.exe ups_run
  2⤵
  PID:5452
- - C:\Temp\vsmkfcxvpn.exe
    C:\Temp\vsmkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsmkfcxvpn.exe ups_ins
  2⤵
  PID:2884
- - C:\Temp\i_vsmkfcxvpn.exe
    C:\Temp\i_vsmkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxuomhezxr.exe ups_run
  2⤵
  PID:2792
- - C:\Temp\cxuomhezxr.exe
    C:\Temp\cxuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxuomhezxr.exe ups_ins
  2⤵
  PID:1884
- - C:\Temp\i_cxuomhezxr.exe
    C:\Temp\i_cxuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run
  2⤵
  PID:4984
- - C:\Temp\urmkecwuom.exe
    C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins
  2⤵
  PID:5480
- - C:\Temp\i_urmkecwuom.exe
    C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmgeywro.exe ups_run
  2⤵
  PID:5532
- - C:\Temp\ztrmgeywro.exe
    C:\Temp\ztrmgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmgeywro.exe ups_ins
  2⤵
  PID:2336
- - C:\Temp\i_ztrmgeywro.exe
    C:\Temp\i_ztrmgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljdb.exe ups_run
  2⤵
  PID:6080
- - C:\Temp\jgbztrljdb.exe
    C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljdb.exe ups_ins
  2⤵
  PID:2064
- - C:\Temp\i_jgbztrljdb.exe
    C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run
  2⤵
  PID:3416
- - C:\Temp\vqoigaysql.exe
    C:\Temp\vqoigaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins
  2⤵
  PID:4724
- - C:\Temp\i_vqoigaysql.exe
    C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqli.exe ups_run
  2⤵
  PID:3340
- - C:\Temp\qnigaysqli.exe
    C:\Temp\qnigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5692

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:5592

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\gayvqnigay.sys
C:\Temp\gayvqnigay.sys
1⤵
- Executes dropped EXE
PID:2992

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:428

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
- Executes dropped EXE
PID:2488

C:\Temp\ywuomgezwr.sys
C:\Temp\ywuomgezwr.sys
1⤵
- Executes dropped EXE
PID:1796

C:\Temp\olgeywqoiy.sys
C:\Temp\olgeywqoiy.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\ytqljgbytr.sys
C:\Temp\ytqljgbytr.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
PID:4880

C:\Temp\snifaxsqki.sys
C:\Temp\snifaxsqki.sys
1⤵
PID:1800

C:\Temp\kiusmkecxu.sys
C:\Temp\kiusmkecxu.sys
1⤵
PID:5972

C:\Temp\urmkhcxupm.sys
C:\Temp\urmkhcxupm.sys
1⤵
PID:5932

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
PID:4824

C:\Temp\jebztomgeb.sys
C:\Temp\jebztomgeb.sys
1⤵
PID:2584

C:\Temp\qoigbytroj.sys
C:\Temp\qoigbytroj.sys
1⤵
PID:1712

C:\Temp\oljdywqoig.sys
C:\Temp\oljdywqoig.sys
1⤵
PID:4936

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicaus.sys

Path C:\Temp\axsqkicaus.sys
Size 141KB
SHA256 df17bd7967167729e2bb87375ca6e91172faed68e7f5cccd8524b0dad28c4141
MD5 1bb215d44a1bacfd34887089d7e8b5f4
SHA1 0b05aab07193e26ccdae2b209bbb8c2f33d2aae6
SHA512 7b186d27b5f7934ce01e47ab5179fe482aed6e6a7b922f0eab225f908087de6888de7029f32c721328b5f1d4dd863d38c698718f0b5074a2962c3b3dd49944bb
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqojdbv.exe

Path C:\Temp\gaytqojdbv.exe
Size 226KB
SHA256 e4eac5da3d323ac0f3cf4331959b28f7cbe23e8c6da3297151cd6d13ccd2acd8
MD5 34ab0d1237415b9f01b9da5b755f4c30
SHA1 f17b783a6179449ad5fa17be38676cf04bfe3eb0
SHA512 3a1717ab00001cf0c8c72b11181a6e5d2a17e85aacd6dadadf7abbdb8a6d44cd517cdd99dc56bb90d72db15266023e047f6d0ba20b550ffc2ed572e0743934d4
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqnigay.sys

Path C:\Temp\gayvqnigay.sys
Size 141KB
SHA256 65643e9eb4a7214c00e802b5a979dd9fffbdaa99b428654be08c24734a12ced2
MD5 dd6c04e75ced3ec1f4dcd59757a498d4
SHA1 e6101352967ae8cb040186bbc6a34695f77ae6ea
SHA512 b358b3668617ecbe10e01ca67d27afa677b9e7ca9165c4b9f34ebaa63efd7f43cc7cdd719152b8a4d1283ce7fd0bfe2cc612115043c24c8157596f09f593a46f
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T147E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhcz.exe

Path C:\Temp\hfzxrpkhcz.exe
Size 226KB
SHA256 12e38a229349cce91b5ca0d6f45d760c3d4d767d2ee115675fcd8fbb619ff40e
MD5 25227558157582a25598287997a1586b
SHA1 b3ad2059ec3d7aff855597fce4225230c6efac2a
SHA512 2209862768cc05e6cdfdc64185191acd08bfc3717843845d863c882994ebad994398de39c31219ebbda88dff26229c676100fe2a23f21dd40eb1c4ae217c3bb6
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqojdbv.exe

Path C:\Temp\i_gaytqojdbv.exe
Size 226KB
SHA256 675eb68fa0766538e96b21d3031015961974bafbaab3073d31c078ed6c18b98b
MD5 cb51aca2c0b7efc962984b283251fb40
SHA1 a7103f42c0385189f2c3f718a8def21e08e67283
SHA512 91cde31a2534720d33f62fb4a9c787fb8c56307b6e1f8af016e1c410ec62b0b3a9721f264c630d47c1002757c1f965ed8f377135bff155eec53b2eab7d8441bd
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1FB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpkhcz.exe

Path C:\Temp\i_hfzxrpkhcz.exe
Size 226KB
SHA256 06a226b2696caba37215dc1c4f41241b58895948cfb34cd65ea6b56326eeaf71
MD5 c180ebc5a411c73b74407cf83d051b43
SHA1 085d0bd7d32cf4cf3023e052c42e63bbc9e2d8fb
SHA512 c82ede1e2333e2123f3de3537de4ae25cfe0128b3cae88e8d3366d97a879384d30ce25f2139b47043dc86809efa14c7554fd17044b449907f7e8671db278b5f8
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1E034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbwtrmgeb.exe

Path C:\Temp\i_jgbwtrmgeb.exe
Size 226KB
SHA256 49cbceea2d44918b8330796d4a9dcf5cfc55037c59d210ecd0ae4e00e6bb51cc
MD5 e493731590865e104e6a74a3e881b73b
SHA1 11c8cf80c60836ac2ca445b9d120f2da2fb6510b
SHA512 2fb28a037dd9110b8c15c6e8b41d5abfde1d6acf610ac4d1afb200874512eb3ec5f021ca6f03b01e06a7b2ebe9404a36861cbc905d1f377df77ba8b6defd6576
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T18C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqniga.exe

Path C:\Temp\i_lgdywqniga.exe
Size 226KB
SHA256 4c743fc495129e1f3d870441d80bf7d19b985fc9ae8b4fdd6887f58be19075ec
MD5 193a05fb17b3434b3d9f5b6639433b45
SHA1 142a87576c50be5ddd1328e9b6b36797fa8e9f0d
SHA512 5e4305e441490d548d43f87a31346065ee01f45aec765832d1eaa1087939a9552967b9835ffc74dbbf1d3d4fc2fb7dd4377cbc2e46a18635def6426d3d603c34
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1B334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnlfdyvqn.exe

Path C:\Temp\i_vpnlfdyvqn.exe
Size 226KB
SHA256 c2e01deab4b2ca8fb981401a0170d6513b50b3813306853aca9bad12d3c859ad
MD5 5d9efdafb85547d948aaa76fe2782c37
SHA1 a1c22eaa0fa4e0e08185773e97ccea488bcde68f
SHA512 0e575018bb935a682c6e8adc6d9ada452209fc91397ebfb0c1d1612c3f8d27c8fff5197c0259ebeca8e2e25005f1252cce761c4336c7d68dc934cd94893aaa16
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvsnkfdxvp.exe

Path C:\Temp\i_xvsnkfdxvp.exe
Size 226KB
SHA256 639d80f21f910396858bf685f108eb4fbfbe2fea7292f9474becb8432cad41e8
MD5 187d24b0e78782d42a76207cfb520bb4
SHA1 496e2fc2f7ff71818427b0bc9507b232322f7fb2
SHA512 d6ec9a641538523ff47b9f6dc0b70ee9468d2868ff2987ce3e801bfdd9b6a59ae6e6baaa712c444665bd8637939633406336472aa8d0293722f8d63650f6723a
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.sys

Path C:\Temp\ifaxsqkica.sys
Size 141KB
SHA256 fd00e4b01260a385957d550bcc2ba55cb515b42820039898a943cdf93a4d1ef0
MD5 f856210cb9d8ca119d17980db7626ed9
SHA1 580364ebab0d351a77d62955ba6d74511487f372
SHA512 9027179559398a9aa8540355ae64b7dab7543fda0ed640698ad990d4035aa0e324ec73adaf24f63dd951324b0921d9658c3e46966abce74b743f385823633841
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbwtrmgeb.exe

Path C:\Temp\jgbwtrmgeb.exe
Size 226KB
SHA256 0a75c3fba52d98ff6996a80d347ab1c138b762bc485ccf2b3dbb3522e898a24b
MD5 b42c1cd01c1e36e322c91f7e5c7227d5
SHA1 2413b5dddbd7b8346fe18329361bf5dadaee1742
SHA512 0c91abbbe782edc632b15b8d40b8a974a5cd8aa0257aeda26c36718368b4682511adc0760b9ac20a69dfa491d24f5649af4c8261ae3ac5964da7eb12c3ba84d7
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkec.sys

Path C:\Temp\khcausmkec.sys
Size 141KB
SHA256 fd1ef96b458916ef7e16c5e9da9e414b280aec83e68995a2c476fe340f33ec8d
MD5 88190c3bb86e87c58b0ae93f90cb5bec
SHA1 b2003f71ed20d823dc0683fd43169c3bcbf18b63
SHA512 c82b9a3e0d3e8f29e8fb5e444611bad23203a6cf6b4e67e33ea2e63c70e1732e658bb0bd0ee65fd7ab87e97c65779ebbf71c30db86f28d83b1550e913ad52ae5
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T199E38D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqniga.exe

Path C:\Temp\lgdywqniga.exe
Size 226KB
SHA256 33834d77fe537c8895c0b964118d9d35a90c3795972899de539d5e4b43f0186a
MD5 7260364961f7f01d46479f2a9a187d64
SHA1 7148dcf79a70ff262e2673bfd20ae68102cf711b
SHA512 43cc6ff07b326ca62ac2aa3778a407487eb79635831b8e52a7eb5b4199262a2844de0451e79274cd597e9e72bc04e0b7f8c00ad762bfcda9e07d6fbfb468c07d
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1C234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.sys

Path C:\Temp\tqlidbvtnl.sys
Size 141KB
SHA256 144b1958dbe1e401166c5438c1dab4f2fae459918927d3b434b6414216f85e97
MD5 2a4482e8fc5e645356e585dd1628d194
SHA1 8682afae09f36576bdd3f3ac311fce315c9b0c31
SHA512 8a2b7607a0c392db59f511debc1db8b3875d397e1d362e8b372d023adda2a71366c87a8034b0495d1f726c67ecc5b18b5fb1bf789dc9d60aeada0e9e6fc4a706
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnlfdyvqn.exe

Path C:\Temp\vpnlfdyvqn.exe
Size 226KB
SHA256 cdac42dca1642692b949f369ea3bf5cf727e5c29f4f1d070214288bd9cf0a8fc
MD5 14bb29b282094047f70d04e0a6491d34
SHA1 bac76f035f19fab279024ead182b7f179576bb51
SHA512 db432553369fb02af90dbd137a0517fcecab49a82c20fb00e256ddbbc9221fd5154699aada24a24544d835b5703314bf93e96c6da8e7423c2e2da45c874539a6
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1D834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkfdxvp.exe

Path C:\Temp\xvsnkfdxvp.exe
Size 226KB
SHA256 2d4e3a26ac5039b2c5dc49ad16db7ff5b3a9c50f7f183cad7691d3e982578e08
MD5 23c39eb18a3d1c843f2f0899bf67c4cc
SHA1 72a27817d8684d341f274b25e224b8a8de69f7d0
SHA512 3a10ca9a8db20efdaf4940be2d422f6139622aa5ecc667a30c22a2e068c376086180ecbcbb952d1c5a1db6e2af648ad8fcd2c7832ead2850d954d90ee28da850
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T19B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 46533a2a5233aeb1d1b51cb18c89ec142955024f0fbec86fd3c0555120e32ea4
MD5 eb6ea1f8750fe5f35a9a6946131e27d3
SHA1 40d1ad0f705d2441024e6a197fb806b184d91e4a
SHA512 f17ba6e4c31c0da20368fb34b458b2dbdc166ea5cbd601671716a60bc1cab3ce76d3372d7aba68fb89e96d1912991cfb6c9cd1fa6e0f90d303c1caefdd88060f
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1ca568baaed45142b9571aee1f6e1199fef55d0da6492030f28708daa58073e
MD5 902afa13330e13d4abc17995c3442c9a
SHA1 38c411c8b2f6680356e1602846edd1d20638ccc3
SHA512 02d225fd7cb29b73cc4ee08151d29c6b4b32438201b935e81c5b574b6d4c21e52a97097470c988d22b0f6f9fa5965b4a0e1491748c59b7d1478e47d5e914fae5
TLSH
T1E7613DC43C567A9DE32FF4B390D111AA37F4C2AD850B6A07D848B3B8483AB5478C6935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59abc7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59abc7.TMP
Size 3KB
SHA256 21e821ec66d8b2a8c540baf1c0ac38aedf8e038f55cd4d517fa698b5ea59ae17
MD5 3732f7f9aa830a76fcdf5525de98b7dd
SHA1 47239bfa9991199b2208617be8d3465174130604
SHA512 0b65a22b7aa6f12ef3732cfe78e4daa028d716abebb4af49025d9e052d9b296e788aab6d0bc55cfafaa69fdea81e0eec44607c8ebc0faf67b076d4fe76b1686a
TLSH
T14D613DC43C567A9DE32FF0B390D111BA37F4C2AD850B6A07D848B3B84836B5478C2935
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ca63d4f-8439-4c63-adac-3ea82b1041fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ca63d4f-8439-4c63-adac-3ea82b1041fa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b5fb0416a227d6600f32a74fd048b22fbb4ba335572cdc1afc11fa49fb5527c8
MD5 36ea91ef11dad143880a9d8173b5d367
SHA1 61a25345032b5b49b2375be8ade8625bf7cfef3d
SHA512 379d700b25e84b1810dd74e8e56b626c58ad07c1d03664b74ebd794562f842a51885575e31d40e805e773e5e721580df183dfaee44e53acede2702ea55ade2e4
TLSH
T1F651CCF7C7E8852E8A1196F0BA187E2BCE1D0914832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 94fd9f29f9de9fc7f7628f91647b3c646e2804dd94cc28403e12dda4455991d5
MD5 315ebee4714392c90c6d7d800fc1b35f
SHA1 856aa0022d9045d45f3d3d0ba079cde5171e6681
SHA512 052be9f486d7c709ed5ac00a569c63901033a6169dff6ae7a1ec059f860e352a0c1905d7128aaaa7d1302f106bc18872ec1b1b2e5298e5fbd17d6a73c26dc1c4
SSDEEP 192:sxRVPyRIHyM/jK1Ml8wcYo/fH2sY1J0ZTsv/kjzoA8pi/g6+WNIYyBJkTGib4wIq:sxRAUCj/fWsYjKTsVi/5IFot3
TLSH
T18352DA16AA349D3B8CDBD209FA557F53D6F91573E2900E44A9FC8A1C01E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 166454b87ee6c6433fcdd708c3b4e3d62984951a54f88abf80405129a28ea0df
MD5 448e36b030157ffa26043197dbc2760c
SHA1 2201f92d29b0a198ffb06c2f960bce10fb6c5023
SHA512 25ad0ec1443463d41dc291a0e4a145b3c461154f257cb7de0dfaffefe807f8a4e4217b630fb12907e628a092cb1c35a0af8591f393c36dccd7f183281c6d1f57
SSDEEP 192:sxRV6yRIHyM/jK1Ml8wcYo/fH2sYz1J0ZTsv/kjzoA8pi/g6+WNIYyBJkTGib4wJ:sxRbUCj/fWsSjKTsVi/5IFotJ
TLSH
T1A352D916AA345D7B8CDFD209FA517F53D6F91473A2900E44A9FC8A1C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a9a7ccd6cd7cad070fe8a2b2a01620512d6a44f995aac9b4e6e1c6957dcd62a2
MD5 9f9e558014a4c8b6bdcdfc6999754bc9
SHA1 24a6ccacfde7cc445492ef190b1a0457276aa935
SHA512 0ac703569708b81fe715e4b05f81c1848b91b5d6b435ccfe715cc0be21fc8e748d6c1b2789d1ddf509d061cae9b33ac7ce0558bfa814927e2d36e8ca2682f388
SSDEEP 192:sxRV6yRIHyM/jK1Ml8UQYPcYo/fH2sYz1p60ZTsv3kjzoA8prVa/g6+WNIYy1Jk9:sxRbUqHj/fWsS6KTs9M/5Itotn
TLSH
T17262D916AA345D778CDBD609FA517F53D6F81473A2900E44AAFCCA1C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e298018220df0a277ce559ac73b9edc7f9bc6281e9aa33116284574bc831a8bf
MD5 e92ab22166a4d069e0e690a0c2321f8f
SHA1 515b32666ab6921b174e2b2452e782ffeae65718
SHA512 7f54aa54e86ca04bd7411e71949d0f727b9944581d1f4c371b70d082cabc031ebd53468c22683ef5805a9cef418e7d5ecc69c11facb660d73ad749b47c857db8
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpvgccicro56lwI:AIox/OE7p0WguMfnAu1jaCvgXiH56J
TLSH
T15DE2EB3B680CCB7E4F8049DCEC29BE9E6DA801CF96D8CD5447FA841C03C66EB551A5DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 943d2003cc544a234b666c608612c510d6f0c0d62714bfec486338795c6b5255
MD5 2c05626cbdb88ec95b1d6e9e9e2dab43
SHA1 36bfb32a25b6eb899544674fc9e530c0c010ea95
SHA512 3369ff7e9c8d5b6ad6a90ce266faa3fa16c28fd12c25ff6033aed0d5d8f9b588b97c8ac3a6baa25b2123d9a18f4466de71a8826538ff8072bbf3f5d08c1a3cef
SSDEEP 96:KHyruiQEYkoEJPOqkKGBO4kaCipQC5KEQKFanRu/bpLP7W/cKgD7K4CgN7cRZUnJ:kyruiQEYFEJGqmBO4VCipQC5fqRu/bpT
TLSH
T10C914055367B2740387F680D82B8E55B868271A3308DB47B3BA861A15F27F414DFEEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d655f35-3dd8-439e-bd35-c247b6361732.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6d655f35-3dd8-439e-bd35-c247b6361732.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6bc8e169e9f300fa07f40a18811829b05af8a056f2a9ed80500b97ee5135d405
MD5 6e959527b4b37cc20a352b2b083a5775
SHA1 ff2d8f2b508ccb72529bb68588edfacd87447163
SHA512 423a3dee2334fd2c709ac822bca90ab044078c90e81c8656fdb36a8b523bf9dd5e6a4330036ab1184e4edad18abae0b8e8c64382e6b213de11a08a2c55607977
SSDEEP 768:9rv+4UNbdF3OvsQOJIh0NgZ/hUAFjQIMyOV3N5E9MPo+8r0mL:9bsbf3PNYhNFUIpONNmtDrv
TLSH
T15503BF32E8A4DAB39CE7A7C5770A72537FF4416355C10A84C9DE2B0D824B5DD231BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 83563facb4645c8ac9e38e20dfd8222f9f30545d20799768025d0e87536b4ba3
MD5 15a71b57be43b5a920c014a4ad28f262
SHA1 57f16125f04cb957058e57e50312788370613aac
SHA512 8857e08bed875050340c72e74eff333d279c312348af19a4145b2cd9d1491af2a5f63cf0b43ca4430b85f27aa93b7ab9d3d0ae1b11abd17d29c3c36c2a1d5ee4
SSDEEP 768:mIrv+4UNbdT3dHZQdQOJIh0NgahI/hUAFjQIMyOV3N5E9ELd:jbsbB3+N4hNFUIpONNm2d
TLSH
T16403BE71F8A9DEA39CEBE6C1B61672937FB8116748C10A44D9EE6F0C424718E174FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d6b5f835b53e4034d061f70fb0a630b768ce01d13fb26c62b2bf53ab063bc0a0
MD5 eb1ad5ee144e15cf494459a37d3397b1
SHA1 ed1282a59be8292d40e0d1f1861657598761a855
SHA512 551c6cc43600add8b260b40b4c91125a7fcf2659aadc724140d55005ac649fa981da43a09324370dbefe8e3354e919f198630069cf77f76075f0a84dd176686a
SSDEEP 768:SRj+9F3dHZ4dQOJIh0NgahD/hUAFjQIMyOV3N5E9ELc8Kz1p:79F3GNrhNFUIpONNm2ctz1p
TLSH
T135F2AE72BCA6DEA24CEB96C477167793AFF4127345811E44D9EE6E0C428338E134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 071460db4a4e86f534a1f3ce1ce3484f8a86b71a2cde7ef82137b20931f1ef55
MD5 e292f61d7ba250999ec04b8ddc1aa4b2
SHA1 6a3fdf32bdd2dfda3af39b434919960b5988dbfa
SHA512 d4cc45ff9264f231324d527dfc1dde6513ede8007dc9d77257aaf70299553261846bb179c0313ac1af9b73242af0be81f8bf03a1b1f759c89d106d8a2881e7b8
SSDEEP 768:qfF1j+9+3rwggHZ4xrOJIh0Ngah8/hUAFjQIMyOV3N5E9ELc8Kz1p:P9+3MNshNFUIpONNm2ctz1p
TLSH
T193038C76ECA1DFABACE797C5B7057683AFE001B385899D84DADD5E08018329E134BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42d4b40a-c47b-43e9-94b5-4a909ecfbdad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\42d4b40a-c47b-43e9-94b5-4a909ecfbdad.tmp
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

504ac85c-013b-4fa2-b44e-7905820e8e5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\504ac85c-013b-4fa2-b44e-7905820e8e5d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2924_1618997695\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/428-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1796-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1800-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2488-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2584-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2636-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4824-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-518-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5592-190-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download