e6a7b14e82cec013a15283695a4c35424f2697fc1eabf7aad0578915c7444763

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 19:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260706-x9q4eact8w
SHA256 e6a7b14e82cec013a15283695a4c35424f2697fc1eabf7aad0578915c7444763
MD5 ee7917323d493406d61d566ef049dbab
SHA1 76d57ab7f0ba684c1db6d492c93c364ccb0652dc
SHA512 c5f7a597e44acd1cac4b3e18d23719000cf7ef1f78eb8cc8c70255f1ebceef73b58ec00c9e8d52afb223906d3098c0e0fe217f18ea0420e35835fa12caa0fa7d
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T15E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3908	CP.exe
5716	xspkicausm.exe
4300	CP.exe
6088	CP.exe
4132	i_xspkicausm.exe
3544	mkeczusmke.sys
1612	CP.exe
3460	hczusmkecw.exe
5896	CP.exe
4460	CP.exe
1476	i_hczusmkecw.exe
1324	bztrpmgecw.sys
2504	CP.exe
2588	czurmjebwu.exe
1092	CP.exe
612	CP.exe
2968	i_czurmjebwu.exe
4272	hbztrljeto.sys
3416	CP.exe
2972	ztrljdbwto.exe
1088	CP.exe
540	CP.exe
976	i_ztrljdbwto.exe
3744	dbwtomjdbv.sys
1308	CP.exe
988	ywtoljdbyw.exe
2984	CP.exe
2500	CP.exe
4592	i_ywtoljdbyw.exe
4504	dbytqlidbv.sys
2488	CP.exe
4156	ysqoigaysn.exe
2076	CP.exe
1544	CP.exe
3532	i_ysqoigaysn.exe
4180	yvqnifdxvq.sys
4708	CP.exe
3568	ysqkicavsn.exe
3536	CP.exe
6004	CP.exe
2416	i_ysqkicavsn.exe
4416	daxsqkifax.sys
5488	CP.exe
3792	usnkfdxvpn.exe
5784	CP.exe
4148	CP.exe
4588	i_usnkfdxvpn.exe
2964	icausnhfcx.sys
748	CP.exe
200	hfzxspkhca.exe
2112	CP.exe
256	CP.exe
4916	i_hfzxspkhca.exe
4976	fzxrpjhczu.sys
2924	CP.exe
4748	urpkhcausm.exe
3700	CP.exe
2396	CP.exe
3616	i_urpkhcausm.exe
5280	zwrpjhbztr.sys
5676	CP.exe
5668	wrpjhbzurm.exe
5332	CP.exe
3168	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_33456231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_123066820\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_123066820\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_168928910\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_168928910\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_824353022\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_824353022\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_824353022\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1296_824353022\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqligey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpkhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqligey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoigaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigdyvqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtoljdbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoigaysn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqomjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqomjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpkhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigdyvqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnkfd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2744	ipconfig.exe
1060	ipconfig.exe
5212	ipconfig.exe
1976	ipconfig.exe
4456	ipconfig.exe
4996	ipconfig.exe
5976	ipconfig.exe
5060	ipconfig.exe
4112	ipconfig.exe
5836	ipconfig.exe
5600	ipconfig.exe
4476	ipconfig.exe
1448	ipconfig.exe
260	ipconfig.exe
5368	ipconfig.exe
5920	ipconfig.exe
4508	ipconfig.exe
2800	ipconfig.exe
5600	ipconfig.exe
3760	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{DD84DBFA-257F-493D-89C6-334BF8274528}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5340	msedge.exe
5340	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	i_xspkicausm.exe
Token: SeDebugPrivilege	1476	i_hczusmkecw.exe
Token: SeDebugPrivilege	2968	i_czurmjebwu.exe
Token: SeDebugPrivilege	976	i_ztrljdbwto.exe
Token: SeDebugPrivilege	4592	i_ywtoljdbyw.exe
Token: SeDebugPrivilege	3532	i_ysqoigaysn.exe
Token: SeDebugPrivilege	2416	i_ysqkicavsn.exe
Token: SeDebugPrivilege	4588	i_usnkfdxvpn.exe
Token: SeDebugPrivilege	4916	i_hfzxspkhca.exe
Token: SeDebugPrivilege	3616	i_urpkhcausm.exe
Token: SeDebugPrivilege	2368	i_wrpjhbzurm.exe
Token: SeDebugPrivilege	1636	i_zwqomjebzt.exe
Token: SeDebugPrivilege	3060	i_mgdbwtomge.exe
Token: SeDebugPrivilege	1772	i_dbvtqligey.exe
Token: SeDebugPrivilege	6072	i_kigdyvqkig.exe
Token: SeDebugPrivilege	2928	i_causqkicav.exe
Token: SeDebugPrivilege	3356	i_kicavsnkfd.exe
Token: SeDebugPrivilege	5808	i_causmkfcxv.exe
Token: SeDebugPrivilege	4892	i_cwurpkhbzu.exe
Token: SeDebugPrivilege	2132	i_hbztrljebw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 5236	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 5236 wrote to memory of 1296	5236	iexplore.exe	88
PID 1296 wrote to memory of 1200	1296	msedge.exe	89
PID 1296 wrote to memory of 1764	1296	msedge.exe	90
PID 1296 wrote to memory of 5616	1296	msedge.exe	91
PID 1296 wrote to memory of 1764	1296	msedge.exe	90
PID 1296 wrote to memory of 1764	1296	msedge.exe	90
PID 1296 wrote to memory of 2540	1296	msedge.exe	92
PID 1296 wrote to memory of 2540	1296	msedge.exe	92
PID 1296 wrote to memory of 2752	1296	msedge.exe	94
PID 1296 wrote to memory of 2752	1296	msedge.exe	94
PID 1296 wrote to memory of 2752	1296	msedge.exe	94
PID 1296 wrote to memory of 1752	1296	msedge.exe	95
PID 1296 wrote to memory of 1752	1296	msedge.exe	95
PID 1296 wrote to memory of 1752	1296	msedge.exe	95
PID 1296 wrote to memory of 1216	1296	msedge.exe	96
PID 1296 wrote to memory of 1216	1296	msedge.exe	96
PID 1296 wrote to memory of 1216	1296	msedge.exe	96
PID 1296 wrote to memory of 2708	1296	msedge.exe	97
PID 1296 wrote to memory of 2708	1296	msedge.exe	97
PID 1296 wrote to memory of 2708	1296	msedge.exe	97
PID 1296 wrote to memory of 6056	1296	msedge.exe	98
PID 1296 wrote to memory of 6056	1296	msedge.exe	98
PID 2956 wrote to memory of 3908	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 5716 wrote to memory of 4300	5716	xspkicausm.exe	103
PID 1296 wrote to memory of 3508	1296	msedge.exe	106
PID 1296 wrote to memory of 1264	1296	msedge.exe	107
PID 1296 wrote to memory of 3508	1296	msedge.exe	106
PID 1296 wrote to memory of 1264	1296	msedge.exe	107
PID 1296 wrote to memory of 5820	1296	msedge.exe	109
PID 1296 wrote to memory of 3888	1296	msedge.exe	110
PID 1296 wrote to memory of 3888	1296	msedge.exe	110
PID 1296 wrote to memory of 5240	1296	msedge.exe	111
PID 1296 wrote to memory of 5240	1296	msedge.exe	111
PID 2956 wrote to memory of 6088	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 2956 wrote to memory of 1612	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 3460 wrote to memory of 5896	3460	hczusmkecw.exe	120
PID 2956 wrote to memory of 4460	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2956 wrote to memory of 2504	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 2588 wrote to memory of 1092	2588	czurmjebwu.exe	129
PID 2956 wrote to memory of 612	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2956 wrote to memory of 3416	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 2972 wrote to memory of 1088	2972	ztrljdbwto.exe	138
PID 2956 wrote to memory of 540	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1296 wrote to memory of 5516	1296	msedge.exe	143
PID 1296 wrote to memory of 3788	1296	msedge.exe	144
PID 1296 wrote to memory of 5316	1296	msedge.exe	145
PID 2956 wrote to memory of 1308	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 988 wrote to memory of 2984	988	ywtoljdbyw.exe	150
PID 2956 wrote to memory of 2500	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 2956 wrote to memory of 2488	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 4156 wrote to memory of 2076	4156	ysqoigaysn.exe	159
PID 2956 wrote to memory of 1544	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 2956 wrote to memory of 4708	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 3568 wrote to memory of 3536	3568	ysqkicavsn.exe	168
PID 2956 wrote to memory of 6004	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 2956 wrote to memory of 5488	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 3792 wrote to memory of 5784	3792	usnkfdxvpn.exe	177
PID 2956 wrote to memory of 4148	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 1296 wrote to memory of 2412	1296	msedge.exe	182
PID 1296 wrote to memory of 2412	1296	msedge.exe	182
PID 2956 wrote to memory of 748	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 200 wrote to memory of 2112	200	hfzxspkhca.exe	190
PID 2956 wrote to memory of 256	2956	2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_ee7917323d493406d61d566ef049dbab_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ffeca80c188,0x7ffeca80c194,0x7ffeca80c1a0
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,6970930002442237952,3802959694177533362,262144 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,3631900526176349514,8191130470274987284,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,919549205360988744,3498783571362917223,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,17770624799246151994,16868234291608141965,2097152 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,5985323372490804518,2826211800717286227,2097152 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,4646318219116047917,12176419480002988785,2097152 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,3373837260902976991,16262985726494635099,2097152 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,13160045983957393875,4814133141348192757,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,7965432745405416054,10474758074319808825,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,9745719136978605786,15694748330119786417,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,105170315398291007,11873998834593622232,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,105170315398291007,11873998834593622232,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,9204483140436246700,6871300684045869256,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1492718689953960914,4171661712780616385,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,4189256307605928426,1997757195557509144,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8030996461589960379,5320564206911318698,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,3433562727371460123,9344274729269889108,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,3286802597903017912,10198383469528291881,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7100113397969001907,11502333407818679944,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,16690953860956562754,8202190940333974963,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,3438017011885241751,1490154360214655087,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6896,i,13084981105151855688,15533672306529409340,262144 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,1014406339608442799,4112172004521239169,524288 --field-trial-handle=2392,i,6473404397443736706,13016312469269081969,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:14
      4⤵
      PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3908
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6088
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1612
- - C:\Temp\hczusmkecw.exe
    C:\Temp\hczusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4460
- - C:\Temp\i_hczusmkecw.exe
    C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmjebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Temp\czurmjebwu.exe
    C:\Temp\czurmjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmjebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:612
- - C:\Temp\i_czurmjebwu.exe
    C:\Temp\i_czurmjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3416
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:540
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtoljdbyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1308
- - C:\Temp\ywtoljdbyw.exe
    C:\Temp\ywtoljdbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtoljdbyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2500
- - C:\Temp\i_ywtoljdbyw.exe
    C:\Temp\i_ywtoljdbyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqoigaysn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\ysqoigaysn.exe
    C:\Temp\ysqoigaysn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqoigaysn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\i_ysqoigaysn.exe
    C:\Temp\i_ysqoigaysn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6004
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5488
- - C:\Temp\usnkfdxvpn.exe
    C:\Temp\usnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4148
- - C:\Temp\i_usnkfdxvpn.exe
    C:\Temp\i_usnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:748
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:256
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2924
- - C:\Temp\urpkhcausm.exe
    C:\Temp\urpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_urpkhcausm.exe
    C:\Temp\i_urpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\wrpjhbzurm.exe
    C:\Temp\wrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\i_wrpjhbzurm.exe
    C:\Temp\i_wrpjhbzurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwqomjebzt.exe ups_run
  2⤵
  PID:5304
- - C:\Temp\zwqomjebzt.exe
    C:\Temp\zwqomjebzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwqomjebzt.exe ups_ins
  2⤵
  PID:4264
- - C:\Temp\i_zwqomjebzt.exe
    C:\Temp\i_zwqomjebzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgdbwtomge.exe ups_run
  2⤵
  PID:2376
- - C:\Temp\mgdbwtomge.exe
    C:\Temp\mgdbwtomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgdbwtomge.exe ups_ins
  2⤵
  PID:2320
- - C:\Temp\i_mgdbwtomge.exe
    C:\Temp\i_mgdbwtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtqligey.exe ups_run
  2⤵
  PID:5656
- - C:\Temp\dbvtqligey.exe
    C:\Temp\dbvtqligey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtqligey.exe ups_ins
  2⤵
  PID:2772
- - C:\Temp\i_dbvtqligey.exe
    C:\Temp\i_dbvtqligey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kigdyvqkig.exe ups_run
  2⤵
  PID:976
- - C:\Temp\kigdyvqkig.exe
    C:\Temp\kigdyvqkig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kigdyvqkig.exe ups_ins
  2⤵
  PID:4592
- - C:\Temp\i_kigdyvqkig.exe
    C:\Temp\i_kigdyvqkig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causqkicav.exe ups_run
  2⤵
  PID:5196
- - C:\Temp\causqkicav.exe
    C:\Temp\causqkicav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causqkicav.exe ups_ins
  2⤵
  PID:3936
- - C:\Temp\i_causqkicav.exe
    C:\Temp\i_causqkicav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnkfd.exe ups_run
  2⤵
  PID:1556
- - C:\Temp\kicavsnkfd.exe
    C:\Temp\kicavsnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnkfd.exe ups_ins
  2⤵
  PID:1500
- - C:\Temp\i_kicavsnkfd.exe
    C:\Temp\i_kicavsnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  PID:1816
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  PID:1128
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwurpkhbzu.exe ups_run
  2⤵
  PID:5412
- - C:\Temp\cwurpkhbzu.exe
    C:\Temp\cwurpkhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwurpkhbzu.exe ups_ins
  2⤵
  PID:1244
- - C:\Temp\i_cwurpkhbzu.exe
    C:\Temp\i_cwurpkhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  PID:4624
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  PID:4544
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2948

C:\Temp\mkeczusmke.sys
C:\Temp\mkeczusmke.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\bztrpmgecw.sys
C:\Temp\bztrpmgecw.sys
1⤵
- Executes dropped EXE
PID:1324

C:\Temp\hbztrljeto.sys
C:\Temp\hbztrljeto.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\dbwtomjdbv.sys
C:\Temp\dbwtomjdbv.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\dbytqlidbv.sys
C:\Temp\dbytqlidbv.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\yvqnifdxvq.sys
C:\Temp\yvqnifdxvq.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\daxsqkifax.sys
C:\Temp\daxsqkifax.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\icausnhfcx.sys
C:\Temp\icausnhfcx.sys
1⤵
- Executes dropped EXE
PID:2964

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:4976

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5280

C:\Temp\ecwuomjebz.sys
C:\Temp\ecwuomjebz.sys
1⤵
PID:2456

C:\Temp\jdbztrojge.sys
C:\Temp\jdbztrojge.sys
1⤵
PID:5368

C:\Temp\geyvtnlgdy.sys
C:\Temp\geyvtnlgdy.sys
1⤵
PID:5088

C:\Temp\lidayvqoig.sys
C:\Temp\lidayvqoig.sys
1⤵
PID:4440

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:2084

C:\Temp\nkicausqki.sys
C:\Temp\nkicausqki.sys
1⤵
PID:2416

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
PID:5956

C:\Temp\eczurmjhcz.sys
C:\Temp\eczurmjhcz.sys
1⤵
PID:2264

C:\Temp\jhbzwrpjhb.sys
C:\Temp\jhbzwrpjhb.sys
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpmgecw.sys

Path C:\Temp\bztrpmgecw.sys
Size 141KB
SHA256 086a64f044907a223cd5a7312dcaa2b2ab8f86381a619454acacf0ebf7eb5809
MD5 d5c06bb3fdd97ae24bba2ba70681079e
SHA1 737d8b0b243d90eae48d2ea4791fbc1eae1c7e49
SHA512 5d82a1b4e540bd9b7df526f1b41a14523cdce6fb952ebf85119a8cca39754e3e07b8aa153f8492ab9ac21a3e75b80c2b95546a193d591add0ee642d9209bf8a1
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmjebwu.exe

Path C:\Temp\czurmjebwu.exe
Size 226KB
SHA256 ed048c69630c775d4ab4a5887dbd612883770708effcc96bd326b4085d6bc769
MD5 1725cbf3e201362a4fe38628e423837c
SHA1 d1e4ae8167b1e5f4b7cb34e3ba1def670b1fd8be
SHA512 7ca3481e49bdc1ab7074804c0cc746acb0a6e92ecaad996e6609107ed7c2ce04beb0c9bef64d1a8a9450984df01fefc78d6d2c71dda9ee4fc81171671fa418fe
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtomjdbv.sys

Path C:\Temp\dbwtomjdbv.sys
Size 141KB
SHA256 1016d4aa5cb7353a527c96255dddc58054b143948393ab4264978d605e9250cb
MD5 798d59073ffc0e0f94d2c519433379bc
SHA1 fff991acb3bd4c7db473d100c9804a6aa27027e9
SHA512 1adaaccf943f8682df6f0bece1196d6e837736530c03c16cef32886e4b2432642805ce99f238561de4be699e9f8508123689a7cae2d225847d328ec816eeb026
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqlidbv.sys

Path C:\Temp\dbytqlidbv.sys
Size 141KB
SHA256 ec4049a31e043a275d92b0022a007e0c02b924779b1c36568f5bdf88085ea751
MD5 ffb17f439bbeae717cee383a2e9599c5
SHA1 910ca21e2015aed7c36c4230948fc138d836fe58
SHA512 525156721f2acc25fb20e8dee231882e96d86a2c32722750c19567a7b1823838a7a33f29767978e3082f9f47b14b3f2e1faf654c1225e833fc91f046692e659d
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19AE37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljeto.sys

Path C:\Temp\hbztrljeto.sys
Size 141KB
SHA256 3102438b46338a3da52414cd063f89c0cddab0be1bf7d2c259a2a1276038274a
MD5 747f03e96fabfa61c35cdde2e711e5da
SHA1 fbdf96f8155ce3b8c065b4f7a87abafcffe738ad
SHA512 f8eda4b16e4ca6a336e7dc11773cfae7856270845091747b8903cd2c506d27f85025ed8f1b673db33a1cb2cdcdadb35b71df89025d78a6c77def49c3f72ba97c
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecw.exe

Path C:\Temp\hczusmkecw.exe
Size 226KB
SHA256 6c248db84cda6c8c0cfe621f1368052ae46d93bb5081b3298195ab1f5378269b
MD5 c7434d1cacb2c7110e93968fbb910a55
SHA1 ec968555369b31a2766461d771102794754e8f51
SHA512 bec45d2320ae50280e6ff83d578f9c965693b86c6e301238ecd531147150d128f02597b6ef02b6ec1c2e1c8dcb0a5cab0f53cdceb0b035dbdd46c2c84b5994b8
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmjebwu.exe

Path C:\Temp\i_czurmjebwu.exe
Size 226KB
SHA256 7bd9395e5075a783479e166fefdc1849e67d4c8b04fbe1d24ef8cc8adfa72dc5
MD5 58c807a14b0969a177d71048a2057cc5
SHA1 81977c946c52aed08d6d81192325486296676b4c
SHA512 c8150da8ff66d82a42713b763bb99514745f925c53e0bba92ace94c65fa8e5179874c329c0395f377e373873874f1787827ba6c1d933ab9d519ca6b89cfc04d4
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkecw.exe

Path C:\Temp\i_hczusmkecw.exe
Size 226KB
SHA256 f93a6c1ce81d0d48fa9ca60236fce063acbe7143d28fc3f22646fb92ec7d022c
MD5 9b3422276739f7215db179637d552bef
SHA1 cb63f99044dce514bacc2814d962fbe2d357ee2e
SHA512 8e3ce6ca0fb96eee7a2605ebb3f2a02ca7dae8a3fdba4e8f061430b9ed779a6652921e79cad9c15b3cb1cec0589965f43fb960d2cfbbdf8805dadd3a42bdeac4
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicausm.exe

Path C:\Temp\i_xspkicausm.exe
Size 226KB
SHA256 0491b23409a31bc0178451414e8174af844721a3f1d2ecbd78695afa75a8201f
MD5 8fe77849922fbbcbc355c6256de446c4
SHA1 1f59d1daed569c3cf0b404f5e3b6c7099c7c15ec
SHA512 bf60ad258cc0dcc11724ba4d4aefc240dcc8baefbf0a5460e364437ef0c5e9b3b04e9236a605e3f9f6539b3a1a44f4b9b01442e2229e66475adbd4a52661fb6b
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqoigaysn.exe

Path C:\Temp\i_ysqoigaysn.exe
Size 226KB
SHA256 30072e053312bf4e1ca1472e639135838cfdc5bc8ff95950b383ec4c9465c24a
MD5 1cfcbfcb52b9c7b5536c1325b29b180e
SHA1 1b0b932e8ab0106d171c24235f828a7720f0bd04
SHA512 c2e6ad6f6615e0123a2d73c3ee6f8d9e232744a814197b50f8651ee7343ef26457cf9610babd11d7c03baed2a9997dc9d6c355e38d2368ad2ed04ffa0a75ec5c
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T11334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywtoljdbyw.exe

Path C:\Temp\i_ywtoljdbyw.exe
Size 226KB
SHA256 e6213405133d2eacbe06a78ef8e087d3c122323d103d76d62dd943556d2b9f93
MD5 4a71749007a55bc0a034bdeb75575d62
SHA1 d5ac0ce7b59eab872a49a2769206744c703c4ed9
SHA512 743e05c0ce508e85b0070864ddc77bd7e304ec428c8918746cf6801e70722c10a1ead99c752892e0deb7a28a959b72c7632d2a6719a7f6705a15d83a9d7a5ed3
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1BC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljdbwto.exe

Path C:\Temp\i_ztrljdbwto.exe
Size 226KB
SHA256 459052c1be5d091f158add2bd768c639f0bb599d0c168ba1d3e76b4218153cd7
MD5 2e7a20942e6c02079bce34fdfef63b20
SHA1 49ed6a1f848142a64cf1bf5c1727948d012b80a8
SHA512 245769fc5195f4be79c011caad4220b049e46c5da0793d02ae0a33a9cdc88051544b336df94cc55db7cb169155e0618df2dced8676ec7a50a74258c0b59b4843
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1E834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkeczusmke.sys

Path C:\Temp\mkeczusmke.sys
Size 141KB
SHA256 9f3f74ac46eef02e9e0f0af4d0fd5565d7039bde0f0a66acfd208055d34a3927
MD5 9ec161b1a3a06244afdcfedffdac9f35
SHA1 c4d4081e0996a8dceae144f1a2beea9bcc8b641d
SHA512 3ca96a9e5e49383b4cd6b9f31c352ea605d785dc76e5f3865e2ef48abf99770a8ef1889628635bbd8d7e882674b1b93c26d080018ea5168eff3cc04d3f877f31
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.exe

Path C:\Temp\xspkicausm.exe
Size 226KB
SHA256 e447d603cf753708c173029092d6a4f22adbdd32eb9d56fcfdfe768e25020401
MD5 5906d751a412e9aad6c75ffa9b673db5
SHA1 26cbb1d28f9728a2be807962ec8f048ad4dd94f2
SHA512 718d8452ae8fc8a09acd8868ad5836e130dff84a1fd6e358042ea7bbfe219947afc665c4ffa9e6017c7f61f7d96b65c0e0abfca06982037f840f5700c63018d8
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqoigaysn.exe

Path C:\Temp\ysqoigaysn.exe
Size 226KB
SHA256 bc6c44b9631667c0fac6c1039e6d183ef5120f1b56bb935ac87e5afed4b710ea
MD5 42e8b4e432d9e6e04f5943db3182cd7b
SHA1 0c68256ae46b2eae2d513bd613268b68eb8e3c25
SHA512 5fcaabf8adec08e5d20329af73e11ca353de9741fe7ab3dfd894526f4c24eaf3eee9d09abb188b72a250ff707afe5fbb2d5e9195929ed21b64349d6b3ce80a7d
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T11234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtoljdbyw.exe

Path C:\Temp\ywtoljdbyw.exe
Size 226KB
SHA256 8f873b06c49ac88f916cc5b07086dddee364a4f9e54cdc42b7df834a5a529a55
MD5 accc8f21d92ace4f5412beeee1a44c44
SHA1 0744b4d7666762ebed9359cc17543ad4b996f09c
SHA512 8083e87e4ef5c186cfb7449aea055ddeecf83b9b44457c68aeab38eca92f4843b845f2f47b70f088f51d27e9eaf7a08024213fd2a9f6bd9b38c16828f248d471
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1CD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.exe

Path C:\Temp\ztrljdbwto.exe
Size 226KB
SHA256 31cf5465b0b3e4aa0b48abd39ca2a776e34a720056bcca7b9a223a399881ca45
MD5 b8897ba6449d35b4dd5fcb709cf27c44
SHA1 fe4c92bc1c7d09316d84801bcc6a30078673f9f2
SHA512 e15a1c6257673b9b440ced2b7ad5cd79e4c261ed411b3f632fc4688924a5a95e0f67da63a8e252a446d65128947e1f4ee5bbc8f0cc056e9a889f601e58c3cf70
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1A334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27950d40a9551c84ad47cd8133b3dc2562d0cbfb9e6e2862e52b6ffc59465636
MD5 3cdef261498cc0a89a5099917822c668
SHA1 8386a4997ce2ae9e730585e5e657293325681cc6
SHA512 3a8de603951463432923081d35c238e0d798a1d4f2e6ccf76499aa997c2e7f6498ecd60523b96ebdec43384983d689dd047458813137f74e88aba315a69353a7
TLSH
T1F4D02B5932002D44C483383732502221E3209432082401084051B17C4C5C546066F4EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c6cefa1e36fc8c458c1103dc425dc7d4774e2a109aed9ce8254e2f005fb9cc99
MD5 ce6d65fb8c0c0020b2525439c0b95194
SHA1 a2e2e5c2fbd1d6df05e8e5aedb7fb4f66906627d
SHA512 5b2ae476b36e7a5d7be156e29405a78d59922fd34a87bb430ddc143f501f55bfeb3b0c1103f165ecc20fb18970c574188e4b078cfc4406a77b6c5f6c8c03c9ae
TLSH
T11AD02B5532102C44C483383B32512221E3109432042401084051F17C4C5C546066F4DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f160211dde848ed19c49eff1127b404fa3f6666c475c2bcc54d168b2fa883be4
MD5 4e40d2a831e6c5f573f8648ac6889129
SHA1 ee05281a2b7c8310748472a09425f8c42e166bcd
SHA512 e4ed0d201a2ca4281a01eebb13c33d3c3247aaedaf481105bbc5d65f3e283c3ce444ab9c4218852db4581e2e8c42fb16e0c1d51212eea19b07e02a259a19832c
TLSH
T11351A2210B3ECAD1C34456B122E3FDACB338C8D64ECB6FF81A6750700836B4A3042A28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e1b5d3f-c8d5-497b-897e-e657b40c494b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e1b5d3f-c8d5-497b-897e-e657b40c494b.tmp
Size 2KB
SHA256 e73cdbf8deec7187b77e45c2dc74291960a23b2f4ad0ae0c2329584d498a58b8
MD5 d4e6396e9f479f845590b2a0cb07af8d
SHA1 95efedb537a789e9fcc917b0c223a6e008d6eecd
SHA512 c8e60a3eb1b24fbe83098fc56108476be52e5e2cb291bd599f5d075da20bab785f10ebda86debaa487fc7550c669a1ef2f1656b44ba13312adc9c34d852d4403
TLSH
T1DF51BDF383E5826EC91156F0AA147E1BCE1D0A11832C3D5AC5E4AF1B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9cae039fc4d870adae90ed7b7e17069a992f4edcab6fefde148e1f7f54972dd9
MD5 e30492c92841db1274a2d9cbf04185a3
SHA1 758a115894135b91ea0a741682e707363b8daf55
SHA512 8710ebc0e603dcacc41e69bc86a09d597630491d0247292b864c955800727d2f4583bade9a4bf1498330fac418a6a9233b5db7e527d6e64d66674f3802a6ceab
SSDEEP 192:sxRZGRlyM/jK1Ml8wCM/f7sIf0LwZ2zoA8p98/g6+WNC8b/YkOJH7/GBLIgtJ:sxRZGp8M/f7sISurm/5V/kH7MD3
TLSH
T1BA62FB15692899778CCBD209FA557F63D2F81573A2915E04ADFCCB0C01E7AEC621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f4f557667359cdd6d96e868886eb6ee5639fbcd689487ad286beeacc9237cf5
MD5 9109b2d3c8d1c152e541f76210bb600c
SHA1 8431cbcd08167ad82e4bddc526144ae321a87595
SHA512 e413aee36a8913937c4aa96d748e3cabd7763b39eabdb48a9522bf2dfde496b4d44bcb55f070e3794f68e77e5fa32c8843b0741ae2dcb2419bc3d4774f21fe99
SSDEEP 192:sxRiGRlyM/jK1Ml8wCM/f7s9Gf0LwZ2zoA8p98/g6+WNC8b/YkOJH7/GBLIgDYJ:sxRiGp8M/f7sgSurm/5V/kH7MDg
TLSH
T16962EA156A2499778CCBD209FA557F63D2F81573A2911E08ADFCCB0C01E7AED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7ebc648b65eb1ea0017c0853a57e4307628c2d0a20b14c39ecc34a7f836d30d6
MD5 7f858f19e47c1036cac84f0fd16fe8c4
SHA1 8271b12fea387291905990235a8707586c8f5b2a
SHA512 29fbebc0d971c24f88fa57d83852bac32d3d0639456e4d6153c47ab4967ba8ef776f92c126b30a4dc09bcdbf89c9a7575ecbfbb853c88945e58f9bd903b355ea
SSDEEP 192:sxRiGRlyM/jK1Ml8UQrCM/f7s9Gf0LwZ2zoA8pr8/g6+WNC8b/YkwJH7/GBLIgD8:sxRiGpqeM/f7sgSurI/5V/yH7MDg
TLSH
T17E62EA1569249977CCCBD209FA557F63D2F81572A2901E08A9FCCB0C01E7AED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7d8271f84febf23ea978df4b0d40721d35f78ce73bad48bf26f7e17bce4eecdf
MD5 1054f097fddc37cf85b8520468b04b17
SHA1 6a3130aef00ac38720adcf19c4cbcd7ce909b891
SHA512 0e5f73922574a6c069d1a8e88bbe82be4d8e5bada9b730438a8121be05c9659dfb43508dc62266293c7920504fbeeaad9e0f7f34e7cae18ee87f0fdf40ec1f8f
SSDEEP 768:ZUwifd7pLuL7aHWgRhf2r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXPPnxeIrolAAM+:ZUwifLE7aHWgRhf2ru1jaoPPxezlM+
TLSH
T148E2FC3B680CCB7E4F804ADCEC297D9AADE801CF96D8895447FA894C03C66EF51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a5936aae4915f0b0bdfaca2b324a1c1797ab230b4aaf3f1274ece6c2fa9d7fea
MD5 98190e28be1e5343b75991834720cbb6
SHA1 07e11827a8057f3d97691d92de72f9a36aa5cf89
SHA512 2722a46a6609bf3cec13c8438bc67a5aaedf92b4ce00450fff7abe729f19d46b24561a12d6788094551f21861232121a0478e2ea9e631c034db9c2b1167138a4
SSDEEP 96:KR9KD3tHbPWDYGg/PK4eghPcF9wTrEHuDSOowg2Ww19gO2K4TgM2cmut8uHQ1xHm:C9KD3tHbuDY3/1eghEF9wTrEHuDSOowq
TLSH
T1AF914609717B4690383E265885EA9C9682C17063311EE93B3BFC15D32F27E459EFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59eb12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59eb12.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 37b9c6cb04a9ec5466b15cc3019efc00e47ab6933511667895f510ea107f83c5
MD5 952a17dcaec6f8bffeb4250b28bc6678
SHA1 6fd5a4c45b0a0b7299198ffa5877c8cbd71c003c
SHA512 38099e462a3ef99c6e54b30ac4bc442e55af96eb835f0c193e9207055d7cfd7aea410f4210318b63d1c9b5990ef2a2201202a5296d6e41455faa98e10ca91535
SSDEEP 768:Srv+4UNbdL3Vf0kImuNDR6/IpR5myymCbeiUiBf8j:SbsbZ3RIpGhlxUL
TLSH
T15B03D032AC588AB3DDF2E285B1477953BEB46163D9C50BC098ED2B0D429B5CE0307DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9b3e345bf8c6b7361a4cadaa3eb18b0c733b70e22d3ffc1a6437a1b718c16a06
MD5 7309b90d7cf01ee0f9b0b26832a6da11
SHA1 d83c24ac5cf6024c9f8520c2b52837836483958f
SHA512 724eaa127597662e38cf148c8c05095c98256ae1d289e34080083768e9efec58cf7090339ae4c818388dd8ec54e1d5f0439adf9e3f7e26b699d5f720673097f1
SSDEEP 768:yj+9l3ptOkImuN34R6/IpR5myymCba2b9M4Y:B9l3MIpGhlNb+4Y
TLSH
T1B4F2CF30AC198EB39DE2938576173AA6EEF061B398C41EC4E8E99F0D01837DD174781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 048408baf8a7de91fc15d7a45c35a5254397582ab4efee97d24f3e84e5658355
MD5 e09c2f4db14064e3a40433a40e31b173
SHA1 099879d56dd3c079fcc715d4ef98595f19de6708
SHA512 733ce74a69a91f0d8e4a92b947ca29642b6bd3f265a4fe00514e5c5fbcfe50691a44648c09eeaa6459eff24b7c9a2f3c0126c529cf1473d5ece82f08d1547af9
SSDEEP 768:KF1j+9l3/wgCOrUEN3yGR6/IpR5myymCba2b9M4Y:P9l3cBIpGhlNb+4Y
TLSH
T17B1349F198D78A77D9AE4783673E2D569DBCD1A3B4881984B7D85E0CCC832BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

720295b0-a6d9-4101-876f-95fb200d6987.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\720295b0-a6d9-4101-876f-95fb200d6987.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1296_1849513898\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2084-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2264-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2456-381-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-435-0x0000000000290000-0x00000000002CD000-memory.dmp

Download

memory/2964-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4272-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4272-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4476-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-288-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4976-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5280-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5368-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download