5cf4b958b77253807cc329038c1621b29754578c218a8cc1df116f5516a05471

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260701-dd3msaez2x
SHA256 5cf4b958b77253807cc329038c1621b29754578c218a8cc1df116f5516a05471
MD5 c570fad2846cf9eb1a87c149f711381f
SHA1 7495e352759ada0f4ffd077a8ed5f4c90b28c9b9
SHA512 2a62cd62425686b686df068ac8857d13e7a515601a9ebd9965f8cd07d9b98e1a48a2b329c6113721f271cb3bcaef4b3a8e35c2471581f2c10a2b5fe0532ac160
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5332	CP.exe
4660	xspkicausm.exe
4148	CP.exe
5392	CP.exe
5548	i_xspkicausm.exe
5748	mkicaxspkh.sys
368	CP.exe
256	xrpmhfzxus.exe
3844	CP.exe
1460	CP.exe
4652	i_xrpmhfzxus.exe
3888	urpjhecwup.sys
1128	CP.exe
1628	rpjhbzusmk.exe
5792	CP.exe
4992	CP.exe
3156	i_rpjhbzusmk.exe
1088	pjhbztrpjh.sys
5916	CP.exe
2560	mgezwtrljg.exe
4316	CP.exe
2764	CP.exe
6092	i_mgezwtrljg.exe
4852	ojgbytqomj.sys
3188	CP.exe
2084	jgbztrljeb.exe
364	CP.exe
248	CP.exe
4288	i_jgbztrljeb.exe
4388	ljdbwtolge.sys
4652	CP.exe
4540	gaytqlidbv.exe
3680	CP.exe
3816	CP.exe
424	i_gaytqlidbv.exe
3596	nligaytqlj.sys
2296	CP.exe
4760	lidbvtnljd.exe
3152	CP.exe
1780	CP.exe
3524	i_lidbvtnljd.exe
4636	ifdavqnifa.sys
4432	CP.exe
4732	idavtnlfdx.exe
2832	CP.exe
3112	CP.exe
5532	i_idavtnlfdx.exe
1008	hfaxspnhfd.sys
2100	CP.exe
1004	faxsnhfdxv.exe
5824	CP.exe
2660	CP.exe
1292	i_faxsnhfdxv.exe
2804	xusnkfcaup.sys
5012	CP.exe
3256	mkhcausmkf.exe
5300	CP.exe
6048	CP.exe
5328	i_mkhcausmkf.exe
1872	upmkecxupm.sys
824	CP.exe
4936	pmhczxrpjh.exe
1796	CP.exe
2844	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_279060950\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_279060950\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_279060950\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_1444622263\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_577650228\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_542677781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_542677781\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_577650228\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4408_279060950\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhezwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoiytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhezwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigayvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigayvqnig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3532	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3392	ipconfig.exe
5476	ipconfig.exe
4460	ipconfig.exe
2908	ipconfig.exe
5600	ipconfig.exe
5320	ipconfig.exe
2724	ipconfig.exe
4644	ipconfig.exe
4944	ipconfig.exe
3556	ipconfig.exe
2000	ipconfig.exe
4484	ipconfig.exe
1464	ipconfig.exe
3424	ipconfig.exe
5828	ipconfig.exe
3332	ipconfig.exe
5568	ipconfig.exe
6108	ipconfig.exe
3764	ipconfig.exe
5500	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273480730661243"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{16A73C02-F733-4C51-97D0-414965115871}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5548	i_xspkicausm.exe
Token: SeDebugPrivilege	4652	i_xrpmhfzxus.exe
Token: SeDebugPrivilege	3156	i_rpjhbzusmk.exe
Token: SeDebugPrivilege	6092	i_mgezwtrljg.exe
Token: SeDebugPrivilege	4288	i_jgbztrljeb.exe
Token: SeDebugPrivilege	424	i_gaytqlidbv.exe
Token: SeDebugPrivilege	3524	i_lidbvtnljd.exe
Token: SeDebugPrivilege	5532	i_idavtnlfdx.exe
Token: SeDebugPrivilege	1292	i_faxsnhfdxv.exe
Token: SeDebugPrivilege	5328	i_mkhcausmkf.exe
Token: SeDebugPrivilege	4692	i_pmhczxrpjh.exe
Token: SeDebugPrivilege	3576	i_mjhezwurmk.exe
Token: SeDebugPrivilege	5740	i_qojgbztrlj.exe
Token: SeDebugPrivilege	2396	i_qoiytqljdb.exe
Token: SeDebugPrivilege	4796	i_igaytqlidb.exe
Token: SeDebugPrivilege	5496	i_nigayvqnig.exe
Token: SeDebugPrivilege	1660	i_hfcavsnlfd.exe
Token: SeDebugPrivilege	5928	i_xsqkicausq.exe
Token: SeDebugPrivilege	1132	i_pmkhcausmk.exe
Token: SeDebugPrivilege	3512	i_urpjhczurm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5724 wrote to memory of 3380	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3380 wrote to memory of 4408	3380	iexplore.exe	89
PID 4408 wrote to memory of 5248	4408	msedge.exe	90
PID 4408 wrote to memory of 1932	4408	msedge.exe	91
PID 4408 wrote to memory of 3532	4408	msedge.exe	92
PID 4408 wrote to memory of 1932	4408	msedge.exe	91
PID 4408 wrote to memory of 1932	4408	msedge.exe	91
PID 4408 wrote to memory of 1588	4408	msedge.exe	93
PID 4408 wrote to memory of 1588	4408	msedge.exe	93
PID 4408 wrote to memory of 984	4408	msedge.exe	94
PID 4408 wrote to memory of 1508	4408	msedge.exe	95
PID 4408 wrote to memory of 984	4408	msedge.exe	94
PID 4408 wrote to memory of 984	4408	msedge.exe	94
PID 4408 wrote to memory of 1508	4408	msedge.exe	95
PID 4408 wrote to memory of 1508	4408	msedge.exe	95
PID 4408 wrote to memory of 5444	4408	msedge.exe	96
PID 4408 wrote to memory of 5444	4408	msedge.exe	96
PID 4408 wrote to memory of 5444	4408	msedge.exe	96
PID 4408 wrote to memory of 4064	4408	msedge.exe	97
PID 4408 wrote to memory of 4064	4408	msedge.exe	97
PID 4408 wrote to memory of 4064	4408	msedge.exe	97
PID 4408 wrote to memory of 4088	4408	msedge.exe	99
PID 4408 wrote to memory of 4088	4408	msedge.exe	99
PID 5724 wrote to memory of 5332	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 4660 wrote to memory of 4148	4660	xspkicausm.exe	104
PID 4408 wrote to memory of 4308	4408	msedge.exe	107
PID 4408 wrote to memory of 3540	4408	msedge.exe	108
PID 4408 wrote to memory of 4308	4408	msedge.exe	107
PID 4408 wrote to memory of 3540	4408	msedge.exe	108
PID 4408 wrote to memory of 2348	4408	msedge.exe	110
PID 4408 wrote to memory of 3484	4408	msedge.exe	111
PID 4408 wrote to memory of 3484	4408	msedge.exe	111
PID 4408 wrote to memory of 5992	4408	msedge.exe	113
PID 4408 wrote to memory of 5992	4408	msedge.exe	113
PID 5724 wrote to memory of 5392	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 5724 wrote to memory of 368	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 256 wrote to memory of 3844	256	xrpmhfzxus.exe	121
PID 5724 wrote to memory of 1460	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 5724 wrote to memory of 1128	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1628 wrote to memory of 5792	1628	rpjhbzusmk.exe	130
PID 5724 wrote to memory of 4992	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 5724 wrote to memory of 5916	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 2560 wrote to memory of 4316	2560	mgezwtrljg.exe	139
PID 5724 wrote to memory of 2764	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 4408 wrote to memory of 2396	4408	msedge.exe	145
PID 4408 wrote to memory of 4196	4408	msedge.exe	146
PID 4408 wrote to memory of 3160	4408	msedge.exe	147
PID 5724 wrote to memory of 3188	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 2084 wrote to memory of 364	2084	jgbztrljeb.exe	152
PID 5724 wrote to memory of 248	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 5724 wrote to memory of 4652	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4540 wrote to memory of 3680	4540	gaytqlidbv.exe	161
PID 5724 wrote to memory of 3816	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 5724 wrote to memory of 2296	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4760 wrote to memory of 3152	4760	lidbvtnljd.exe	170
PID 5724 wrote to memory of 1780	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 5724 wrote to memory of 4432	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4732 wrote to memory of 2832	4732	idavtnlfdx.exe	179
PID 5724 wrote to memory of 3112	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4408 wrote to memory of 3208	4408	msedge.exe	184
PID 4408 wrote to memory of 3208	4408	msedge.exe	184
PID 5724 wrote to memory of 2100	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 1004 wrote to memory of 5824	1004	faxsnhfdxv.exe	192
PID 5724 wrote to memory of 2660	5724	2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_c570fad2846cf9eb1a87c149f711381f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5724
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc6d1cc188,0x7ffc6d1cc194,0x7ffc6d1cc1a0
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,10653130216832670550,9828961561212672309,262144 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,7531471391035726849,7691048495248668117,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,14717880224784208938,15786492030044748404,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:13
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,7865014427510709486,2356077719310786829,2097152 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,16627343793387198111,10147115195032470431,2097152 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15635156455368896820,12913457925240477957,2097152 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16203744799651568740,7422068690780629621,2097152 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,4108597343955456324,7849186200923643397,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12615466908317617901,10275380376828099848,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12810337891613019226,16095858869198287030,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,1783783415070257000,8676730253638628345,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,1783783415070257000,8676730253638628345,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,7252154307202284303,10573934963550227304,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,225484745685999661,13423902235502716845,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,16104897152811158392,18321583466706504032,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,10660598028115691519,3142692277626904263,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13497949900081159339,10497526334434121664,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,16438397007609970702,9138325840219497558,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,9070761908901602799,15070569271436218067,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,13558922676816195871,1163372641284636714,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,5621905047131741323,17531299015574143988,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6820,i,16779516966745502214,16350531500339987457,262144 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1184,i,7424115567080248996,13314390975842746706,524288 --field-trial-handle=2132,i,8956352294121888900,3793362089248360224,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
      4⤵
      PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5332
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5392
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmhfzxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:368
- - C:\Temp\xrpmhfzxus.exe
    C:\Temp\xrpmhfzxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmhfzxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1460
- - C:\Temp\i_xrpmhfzxus.exe
    C:\Temp\i_xrpmhfzxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Temp\rpjhbzusmk.exe
    C:\Temp\rpjhbzusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4992
- - C:\Temp\i_rpjhbzusmk.exe
    C:\Temp\i_rpjhbzusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwtrljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\mgezwtrljg.exe
    C:\Temp\mgezwtrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwtrljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\i_mgezwtrljg.exe
    C:\Temp\i_mgezwtrljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Temp\jgbztrljeb.exe
    C:\Temp\jgbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:248
- - C:\Temp\i_jgbztrljeb.exe
    C:\Temp\i_jgbztrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqlidbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4652
- - C:\Temp\gaytqlidbv.exe
    C:\Temp\gaytqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqlidbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\i_gaytqlidbv.exe
    C:\Temp\i_gaytqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2296
- - C:\Temp\lidbvtnljd.exe
    C:\Temp\lidbvtnljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1780
- - C:\Temp\i_lidbvtnljd.exe
    C:\Temp\i_lidbvtnljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4432
- - C:\Temp\idavtnlfdx.exe
    C:\Temp\idavtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3112
- - C:\Temp\i_idavtnlfdx.exe
    C:\Temp\i_idavtnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsnhfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Temp\faxsnhfdxv.exe
    C:\Temp\faxsnhfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsnhfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2660
- - C:\Temp\i_faxsnhfdxv.exe
    C:\Temp\i_faxsnhfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\mkhcausmkf.exe
    C:\Temp\mkhcausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6048
- - C:\Temp\i_mkhcausmkf.exe
    C:\Temp\i_mkhcausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhczxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:824
- - C:\Temp\pmhczxrpjh.exe
    C:\Temp\pmhczxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhczxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2844
- - C:\Temp\i_pmhczxrpjh.exe
    C:\Temp\i_pmhczxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhezwurmk.exe ups_run
  2⤵
  PID:2188
- - C:\Temp\mjhezwurmk.exe
    C:\Temp\mjhezwurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhezwurmk.exe ups_ins
  2⤵
  PID:2204
- - C:\Temp\i_mjhezwurmk.exe
    C:\Temp\i_mjhezwurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbztrlj.exe ups_run
  2⤵
  PID:2600
- - C:\Temp\qojgbztrlj.exe
    C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbztrlj.exe ups_ins
  2⤵
  PID:3784
- - C:\Temp\i_qojgbztrlj.exe
    C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoiytqljdb.exe ups_run
  2⤵
  PID:2588
- - C:\Temp\qoiytqljdb.exe
    C:\Temp\qoiytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoiytqljdb.exe ups_ins
  2⤵
  PID:6068
- - C:\Temp\i_qoiytqljdb.exe
    C:\Temp\i_qoiytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqlidb.exe ups_run
  2⤵
  PID:4672
- - C:\Temp\igaytqlidb.exe
    C:\Temp\igaytqlidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqlidb.exe ups_ins
  2⤵
  PID:3576
- - C:\Temp\i_igaytqlidb.exe
    C:\Temp\i_igaytqlidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigayvqnig.exe ups_run
  2⤵
  PID:2196
- - C:\Temp\nigayvqnig.exe
    C:\Temp\nigayvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigayvqnig.exe ups_ins
  2⤵
  PID:4076
- - C:\Temp\i_nigayvqnig.exe
    C:\Temp\i_nigayvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcavsnlfd.exe ups_run
  2⤵
  PID:1324
- - C:\Temp\hfcavsnlfd.exe
    C:\Temp\hfcavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcavsnlfd.exe ups_ins
  2⤵
  PID:4420
- - C:\Temp\i_hfcavsnlfd.exe
    C:\Temp\i_hfcavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicausq.exe ups_run
  2⤵
  PID:1048
- - C:\Temp\xsqkicausq.exe
    C:\Temp\xsqkicausq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicausq.exe ups_ins
  2⤵
  PID:1276
- - C:\Temp\i_xsqkicausq.exe
    C:\Temp\i_xsqkicausq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkhcausmk.exe ups_run
  2⤵
  PID:3604
- - C:\Temp\pmkhcausmk.exe
    C:\Temp\pmkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkhcausmk.exe ups_ins
  2⤵
  PID:2860
- - C:\Temp\i_pmkhcausmk.exe
    C:\Temp\i_pmkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhczurm.exe ups_run
  2⤵
  PID:2328
- - C:\Temp\urpjhczurm.exe
    C:\Temp\urpjhczurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhczurm.exe ups_ins
  2⤵
  PID:5240
- - C:\Temp\i_urpjhczurm.exe
    C:\Temp\i_urpjhczurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3060

C:\Temp\mkicaxspkh.sys
C:\Temp\mkicaxspkh.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\urpjhecwup.sys
C:\Temp\urpjhecwup.sys
1⤵
- Executes dropped EXE
PID:3888

C:\Temp\pjhbztrpjh.sys
C:\Temp\pjhbztrpjh.sys
1⤵
- Executes dropped EXE
PID:1088

C:\Temp\ojgbytqomj.sys
C:\Temp\ojgbytqomj.sys
1⤵
- Executes dropped EXE
PID:4852

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
- Executes dropped EXE
PID:4388

C:\Temp\nligaytqlj.sys
C:\Temp\nligaytqlj.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Temp\ifdavqnifa.sys
C:\Temp\ifdavqnifa.sys
1⤵
- Executes dropped EXE
PID:4636

C:\Temp\hfaxspnhfd.sys
C:\Temp\hfaxspnhfd.sys
1⤵
- Executes dropped EXE
PID:1008

C:\Temp\xusnkfcaup.sys
C:\Temp\xusnkfcaup.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\upmkecxupm.sys
C:\Temp\upmkecxupm.sys
1⤵
- Executes dropped EXE
PID:1872

C:\Temp\mjhbzwrpmh.sys
C:\Temp\mjhbzwrpmh.sys
1⤵
PID:5892

C:\Temp\cwugeywroj.sys
C:\Temp\cwugeywroj.sys
1⤵
PID:2988

C:\Temp\trojgbywqo.sys
C:\Temp\trojgbywqo.sys
1⤵
PID:4304

C:\Temp\oigdywqoig.sys
C:\Temp\oigdywqoig.sys
1⤵
PID:4420

C:\Temp\tnlfdyvqni.sys
C:\Temp\tnlfdyvqni.sys
1⤵
PID:2612

C:\Temp\sqnigaxvqf.sys
C:\Temp\sqnigaxvqf.sys
1⤵
PID:1464

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:1728

C:\Temp\vpnhfzxupn.sys
C:\Temp\vpnhfzxupn.sys
1⤵
PID:3728

C:\Temp\wupmkecwrp.sys
C:\Temp\wupmkecwrp.sys
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidbv.exe

Path C:\Temp\gaytqlidbv.exe
Size 226KB
SHA256 93da922c450b08d199648354d4dcdde00bb9a405178e13c1df4418cf3e57b1a7
MD5 87d48904a1c30ea3b12fa19c6743a88b
SHA1 5a390632b4bfbc45f13888268726983ad6a1eaed
SHA512 8d4eef854232fb86b272f7130c5e3bb79a57cddb9e76ff00cb63e18bf9f4b37ae32ab43a9640dc588b5e8def8a2e447c92eab26237d047ed049248a2640b28f1
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1D434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqlidbv.exe

Path C:\Temp\i_gaytqlidbv.exe
Size 226KB
SHA256 f76eedae5082184a33a18f56a5a6f6ca8afd05bb90633c0303210286b15de8ba
MD5 871f79c239554ff151a88504a7615156
SHA1 dc0696a752e4341cfafc9190c21d59bb157b9da9
SHA512 555a7afe40a11b936a49fa53f1a688dac989bb67af7071aa9404d6d44cba12a6127f83d47b6f56e372db08c611cbc000285e334e6367ca5f28be72e632d3f33d
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T16334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbztrljeb.exe

Path C:\Temp\i_jgbztrljeb.exe
Size 226KB
SHA256 d046fc9a9df88d55b50465e8fb9db8d895bf7164bff3937f58d043fdf07261fa
MD5 5776d48b8d0414e83d41cd5ef9a5cdfa
SHA1 593496cc59047e4831ddfc8f35f07881608e5561
SHA512 86713173a89394c1e953015ceecf40dc03e99d76548a02d587d5a6e000daf2ca676d5673122bbed4ca8fc8e3ef15bd65f5ccf0f87f660bccba6e26d5c1c40327
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T13034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgezwtrljg.exe

Path C:\Temp\i_mgezwtrljg.exe
Size 226KB
SHA256 bace6bba6e9b1faa498b6f2cc43141d26d5cae417688c3ff3c8aec8737398eee
MD5 7d3fad6a2c77339887ab70d38057f308
SHA1 c01a131d0b03f5226ca6b794aba05cf95bcd8ba5
SHA512 4a67b28794ed37327ac6eb5299e8d5c7c8474aee110a931bbe6ed62e38822ae4bea3af2df4c9ebb4fb4f12ddee8130f2505648795ccb9552e7c59ce259909a9d
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T13834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzusmk.exe

Path C:\Temp\i_rpjhbzusmk.exe
Size 226KB
SHA256 7d0f8088872612f6f9b473758f4bfc54f85d891f213dcb7a63c108595428caf9
MD5 49138aa181d572b0442fb3c5846297c4
SHA1 7ccaccaf3959d9a3271cbad385ed856976be5f2d
SHA512 8407acb5e6cb93d3ea39480e1a124924d0d724601657e98aa887263f57eeb14ced6313450eed98e11505fcea23a8d1e92dd266d52b96a3603c499a1a755df573
SSDEEP 3072:RZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:eXY4LK+a3lLNngoqRttA7
TLSH
T1CA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpmhfzxus.exe

Path C:\Temp\i_xrpmhfzxus.exe
Size 226KB
SHA256 2ef7f964ad8a13654a3a7f00b9302b980c232561f304bc0637609b30ee4edf5b
MD5 0cccc5d5781bc8d8d7bcf085b6aa785d
SHA1 034cf4e6c4e72ec271e8b9fc484a59eff61fedef
SHA512 cf6addd9885d5e25dbc649f7d8ff4eac154cfd8b78e4decfb69e6b614150f2d33de627825c50bf0b2759b1298e01c6c294aa9752b308cdef9c6f463581167475
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicausm.exe

Path C:\Temp\i_xspkicausm.exe
Size 226KB
SHA256 c8c3b7d3a63c1f5e7af304eb53aa42e8d30af96c92fc5106ca9194238c1877c9
MD5 92de94be259a10573c879cc836fa23f1
SHA1 fa18f93f46f6bd275cd0077f26c76c3d300636bc
SHA512 1cfe9dcfacd8830544537e51b9bf5bdd22cdf850b922910be6e46cd6ee72cc9ec930d0d086bc5041e093286c3f3966f4c51ca66b3015d177f40f30bbb6947586
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T14834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljeb.exe

Path C:\Temp\jgbztrljeb.exe
Size 226KB
SHA256 85606b9b9cb116988858c8118aa17e37ed1b3d951bc2c69d316064948d0c6f9e
MD5 e3c8ca0251a1efbbafb359f4da1e1832
SHA1 8a39e14a0423fe3b2990a7402a26a9482177ca36
SHA512 f2c4f389c29eb41982e10fc55f670ba96211a0f7f5679078b2dcd9ef2f6e1196622f165245c901cc0eb64f0f5347a362f16718ba48e42e5324d365897366aff9
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T1EB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtolge.sys

Path C:\Temp\ljdbwtolge.sys
Size 141KB
SHA256 48ee033dc7c75f029a5d13f735ab21f2ad93d7f3ff9227a4587905b65c32b46d
MD5 c3ea466d773dca15e8fc6aedff95009b
SHA1 0f23db34e0a304a9b8f323a5aa5bb1583b924ac9
SHA512 0e0c3175210efb332d8f4d4e6ab8b08827ac870d9963723dc87386558be7aa28fa1cb1a69b74361a93dea2ebf65543393ca20621d564bd159e7361e4077d33b9
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T132E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwtrljg.exe

Path C:\Temp\mgezwtrljg.exe
Size 226KB
SHA256 e0b842d27c767afe3560991905be9a347da2afb9468cad304b932642cf0989c3
MD5 23bdfd0d9dc75764856de1cbcba0061f
SHA1 0b61f01b782396d965fe4ce7dbdfb48e43a9875b
SHA512 a60f64a4f254a1efdce99ee1d909bace81541c34e61e896460fe5007c89f0390f0f6e472fdd1eb8e54ee6f62d1a62512bd67bbd21448c73395b9fd12528585c5
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T10134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkicaxspkh.sys

Path C:\Temp\mkicaxspkh.sys
Size 141KB
SHA256 2884ce5f064ddfca2f70766362e1f969cc68f7c48ba62beaefdda63a7dcf5476
MD5 cdcfeb75a1f880502eea6601e74a0733
SHA1 79e8e4126c169d1a2ba1ea3a7610596dd02063a9
SHA512 7f37609b778002dbfb7e3926b201250f2d09a1f2b19a471153c9332d8b8c80bc48a37f6534e6fe6c00140112d1b01a3463de0b483bcdf0f11786be0c474bb2c0
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T195E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nligaytqlj.sys

Path C:\Temp\nligaytqlj.sys
Size 141KB
SHA256 ebc3e9f98940767fb77ce700682415a17cbf1104e6049db865ab2416e2664039
MD5 390609fc7c3574e1bbba6d9145d0c9cf
SHA1 ce05bf8738b9e3813eaa511a760ef36066fc5b2b
SHA512 ed425452fb0602ab8211ae37d2636a10a6ac66522881ced2fbc867541d025bcb779efeaa9be343a0dd040f6c0ff9a178728939a66c10624bb1b49f925e0b07ba
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbytqomj.sys

Path C:\Temp\ojgbytqomj.sys
Size 141KB
SHA256 4ed4d76b133634081463139eb1a618ba2388fe8ebf8e603e58ad0ad55f19caf1
MD5 8f6198101013365622193eb243fd52f0
SHA1 fd47b6a6c5b7b6bb296514702b478537033638bf
SHA512 4088c13e7f32ade9859c687a3d8feb2fd255aab5fdb0392e6dd30503de8bbb2e00771b918b35e70db921fa480a796f7186d507b690f181a653fc9b03a18ed866
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrpjh.sys

Path C:\Temp\pjhbztrpjh.sys
Size 141KB
SHA256 7c0eef906acadab6ce6203cebba332716ed5d4a448fdb806278d75888f3a096d
MD5 a07fdfddc4d573b07fb096d4af060a91
SHA1 91b738ce73799458afeeb48569a2822ed459ab00
SHA512 b56ac94284c97b7e8ef70f7c710e4f7255ad1b55f368e4c25825385e42031c9c3987c4f7eacadee5b2fdc382b9c4bdf000111927afcdd34777424dee6feabdec
SSDEEP 3072:ra3rV3dZPFvOAngoRUAFa1nxayHdXkbj:ra3lLNngoqRt
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzusmk.exe

Path C:\Temp\rpjhbzusmk.exe
Size 226KB
SHA256 67559c9d8a821d74c7090ca19d2adda2f010612d95667e6a411d928cefa81ebc
MD5 ba89b0ab48f7d79a63f94ea6b4b695c0
SHA1 9fb70558117da57cdabdb1c2eec9b302e5adde50
SHA512 22586626eabed18206fdc062a9ae02b7f243192863fb3754fd3fc63a526c88646a15eb5d9232b469ecef75560c769956f1907b1b8923a4db41eaca7106a8c70a
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhecwup.sys

Path C:\Temp\urpjhecwup.sys
Size 141KB
SHA256 f014003fa75639eb43fc103ed829c8462f5aa43aa3607f2ace40486f4fb2454e
MD5 66d165343b51cf8838e3e113bb6421e1
SHA1 f6f03c2d1bef090d89983f382b1256ee5ff62f41
SHA512 824277abe5ae7a8cc20d6f84345de1a2b0b04748a87e10c1da86dc10357ca9a14f110b9bb7032b588a0019222a58419672518e30a9054542f6314bc2282a7fe1
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmhfzxus.exe

Path C:\Temp\xrpmhfzxus.exe
Size 226KB
SHA256 05291797b2c90a7beee782c0723e8daf5bfd0ad4b288b6d2d7ba54a4f170df0d
MD5 b8a70854f7c53ab8880b2aadc6dd255b
SHA1 a09e111b07edda2d59851ef260334a97c923ad13
SHA512 4c40e42e6bfda30e8b17fd9ce26f48c0996e0f5323ab2e010b0c723b3d9737c7cb4156178e2e3e57624c33fd1cbb79772053b126a1acc2a3932f5b8006ab42d0
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.exe

Path C:\Temp\xspkicausm.exe
Size 226KB
SHA256 994c118c45b0414d91c86fd6178880aee1497ba4ad47bbfc5b123ebc15d6b4f2
MD5 3764a285d93804773c30ffdea8434eba
SHA1 4bc38bbf7cf384c12f51af8793a4873785289582
SHA512 11804a1af837846584ce6b5e351a2b381aad376aff34934e5e2a913faf545dec6c81083c4faefe6218ed0f67d4a2a099037af15bc8381f1efcb1cad75eed5be1
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T10D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 48b0127c48894e5c8e42b14bcc7f6b1f91ca5d97355f42d22391fb602568bb1d
MD5 df62623cabc43e309a7767f4081f29d9
SHA1 420f1a4b11b86944a73d3cbcd4aec4883dfdfd62
SHA512 02067a08d194a87842f985ff7d0bee13c7b7228146565bf19114ffaebc120cb3d2ba8b19c941bb0d2773043366f064246a55efd57127d4a0de5768f453b2730c
TLSH
T1FDD08035774DFD08C18054717890D3517A204460345AC3186329A01DDDBC68513DF0EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a958178f477b8cf0f18d83e0835916167b3eaf95d859728b647bc0100a82efc
MD5 b2c496fb89251ff9b8ff1c46a5315932
SHA1 19626950ca3b280d084016871229a48eb3fa5ffc
SHA512 bbd974e4a08ca8f629f0b9a8892ba78ac7d4191c1640d1037e4fd018dadb4d8edd0a663e4a673a29497151c4defd9be09b6a4a4788adf24b182cbc36b18ccda7
TLSH
T1C5D08031774DFD08C18054757890D3517A104460245AC3186329E01DDDBC68513DF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b2c48515d09113f9257ba8fc85801715325ece7e94516c50f8bc6c0aa94d551
MD5 c3bd8193281632293e7bc146185a5739
SHA1 95e96e5139371a5f8a7debabc5718bfb1bbdec60
SHA512 bd4629919f2ec7139f7a7f18e983ba4d01ec7810112ea524f090ffd701045d4d9d6df19929d37022c1ad2518d9df45583fdc5a6eec4b7bd4ccf760c4a57a1dbb
TLSH
T1516172D1057B2B1AC76B70398AF261B8B7BCB5470C07EE025A94B0B4DF0E787A149C31
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5936c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5936c6.TMP
Size 3KB
SHA256 2d682aaf8863234b71ecbba6c1d6a471b0114421fed2de1ff8555fbaae1bb127
MD5 d404a757db35c3059d3c880e63ae1e6f
SHA1 a40328f01aa29c32e1c7199a8777832300feb8ce
SHA512 db10b9d8ccaaf8addd3ca770bc857007379e50f8c32111ba2eaacaf2fe5a7fbe14fe5c35c902a344305fc671389ab6ed1b3ea7f3100169797a8fd1395e3d5526
TLSH
T1546172D1067B6B1AC76B70398AF261B8B7BCB5470C07DE025A94B0B4DF0E7C7A249C20
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 04500f5833a01734d7a4ab6bd2469658bb108929808b962ee21115535a88886e
MD5 c2debcb3fe02f4d573ea9bcec19c577c
SHA1 504dd90572fffca13971b83558cefa8681a5fdba
SHA512 9264c76811c38a05aea5d654b0b3eff7372a4ccd878d1dcc825ccdc017af902e5973a4bf5886ee7b4af7f78e229024c97fa4620bbc734a3072fc572b8dc5688f
TLSH
T1CC51CCF7C7E8856E8A0196F0BA147E2BCE1D0914832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d44666f7662183cdd374ad5af8450acca164466e8785b3bb2b5c4642af4b6d0a
MD5 26a30b511dc7a18dd803b5bc581fd07c
SHA1 2972f9b41cf34d294bb7537d1024c47fa8ac0049
SHA512 db5348ab163bc52029687410a0834a974395ab5291736edd38684218dc5651c29bd50b484346d5230a678312d4aeb8df711ffb24c5dc879269bbc63ac1333ed7
SSDEEP 192:sxRVGFRI5yM/jK1Ml8wcY//f0Ys1+IjcBZDA6Y6izoA8p9Vl/g6+WNCVc5/Y47Mt:sxRMeC0/fRsE8cPUch/5p/ve043
TLSH
T15A62D9166A3499378CDBD209FA55BF53D6F81563A2941E04AAFC8B0C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6d2ff2b9061a102d25562903d11e6ad6b2333eb6c0338f3c6375d24fef8d5de1
MD5 17a404f7016ce97c75f6b31eaf6dd130
SHA1 796a96e0873ae591b049d9e3a690f4e8e7ee1421
SHA512 c4daba62ea5dba851f7aa700d6b1dd1c769ef134a233a728b6b91673d627544ccbc60df2696ed505c00b8da0887890720aba0622106ecc3947a73d8724593c35
SSDEEP 192:sxRV7FRI5yM/jK1Ml8UQYWcY//f0YsYg+IxlcBZDA6Y6izoA8prVl/g6+WNCVc5Q:sxRHeqq0/fRss8cPUcb/5p/Le04P
TLSH
T15862D916AA3499378CDBD20DFA55BF53D6F8156392941E04AAFCCB0C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 99064f94e4fe24f5b1c487aa893d6d512f41b79a2058f758fc2fd7b4c4014cbe
MD5 52d86baa3e7247296ef53d2cd24b4e6f
SHA1 74adffd5509d079177a162953e5a1e914f62e903
SHA512 b946b97482b1c9a88d19bc13303c4cba3ed37aed71af0bdf2277e1de4661204cd33726411affdbc782be7cb2203e2c6a8195d0ee79e03445431d70270c7dbba4
SSDEEP 192:sxRV7FRI5yM/jK1Ml8wcY//f0YsYg+IjcBZDA6Y6izoA8p9Vl/g6+WNCVc5/Y47W:sxRHeC0/fRss8cPUch/5p/ve04B
TLSH
T1A162EA166A349D378CDBD20DFA55BF53D6F81563A2901E44AAFC8B0C01E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 088ab92cf243d373d53494b13f231bc9776f52e7cde8629d66d6f19f952ece1c
MD5 b0e57d184610617aa50322d0b579b6d1
SHA1 bfb3de528286cabb92e101a1bd0b8a06e58df97d
SHA512 bf7ef2da265f46962ff2c2e8042f2e3b6ee88cfcb7721d4fa71661c6bc6a7981c1362b6db945a7284fa021672021965e903d42aa996fa3e1936fb6bb70bc8a8c
SSDEEP 768:Tqi0NR7pLuL7C3WgNxfez8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsNzXNG6CroKTpB:Tqi0NHE7C3WgNxfezu1jaPNz9G6Z4
TLSH
T1ECE2DC3B680CCB7E4F804E9CEC2A7E9A6DE801CF56D8C95447EA841C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a6659bb-17d5-4511-98c9-e93914cd82e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5a6659bb-17d5-4511-98c9-e93914cd82e8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eb894c3f8f789c5a39fd5941ba3c6510ce25765502c3a42519dba28d2df545b9
MD5 15cc17589ac8316e22879e3b2a0ca808
SHA1 cf954c37f772ea75830abd634f507812473df062
SHA512 94d3f4e362d0b31bbf47b99c59487dac4cec845123b25954a178926adf663de136bbc686f227f7f668cadcc92f63fce0cb445f0027b610bfe57f29b8ee57071a
SSDEEP 768:hj+923v/6bth5KA+AW+152MvSCaiGc8KzxJ2:8923v/epx2pxctzxJ2
TLSH
T1AFF2AE32AC56DD778CEA96C4770B3B97AFB022A385811E54CDD96B0D018738D274BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 03908b28f895618db427af4d3fcfe26b08f4a69a7a287a843a16afad474a977d
MD5 4c8574ed25a74533b0b37e3455cdd38c
SHA1 b9a4613f5e24a965264eaa1be7e211783d6fd039
SHA512 050ce4d9c8941fa177b4d148f8f9c7ab6ff8352880d9c43662180abf501e938de5195e3e8fa3bf0d7e4bcbdee12768f45a6f6d8823d6abbf243dcf6df4642d6d
SSDEEP 768:lj+923v/Abth5Kl+AW+152MvSCaiGc8KzxJ2:Q923v/Rpx2pxctzxJ2
TLSH
T16EF2AE32AC56DD778CEA96C4770B3B93AFB022A385811E54CDD96A0D05C738D274BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2459dfb51e1ed99d5505f26b9f6ac5832e015ccc4a8ee5ea9e1e58d6f60ccdfc
MD5 f6bb5736e621096e05ac79b88a1ebf3f
SHA1 93c143dfab5095bd407adb0b60d0d91484ac927f
SHA512 f5f644db0c652ede1d5dd6dbbe7b080ff8e4f09da0f66e1fdb2bbfae2f7459db5d9262d67f412c70bf4cefd9a301675552a0bf4ce9d1eb026cc4fb695f649401
SSDEEP 768:Arv+4UNbd23JPth5Q+AW+152MvSCa2n7AY+8rir9:Absbs3wpx2pe7AYDriR
TLSH
T14C03BF32E869A9738CE686C4764B3603BFB0129389C10B94CDD96B4D429B6CD231BD77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 881b84483e0a818e7a66a03bd4b443282b1e759ab6cd4daab0cf433fb2c31910
MD5 d308d2c1c30d2b5efacc17763faf5408
SHA1 68c597178dec3a276ebc35e347f41c8e97d090e5
SHA512 72dcbbf92b8e7954b62075fd85de4ffca6678e66f8d0f649786cfec11e751ebd3a786071486ae70f98cb263fee24a6924327d31bac344329df14e03c7805aa68
SSDEEP 768:6F1j+9F3MwgN/0W6h5Ka+AW+152MvSCaiGc8KzxJ2:f9F34/+px2pxctzxJ2
TLSH
T1051327F298D7C976C8AE47C7673E2E429EBCD153B5845984BBC45D0CCC822BFD24A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

a945bae1-8ddd-4283-871d-8b291a4e8b5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a945bae1-8ddd-4283-871d-8b291a4e8b5c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4408_2113878760\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1464-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1728-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1728-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1872-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2804-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3408-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3596-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3728-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3888-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4388-298-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4852-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5748-185-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download