10640e76ad6b9678c8bebafecf81606a4969ffe4ecfcde323c5a57d8e0a14eda

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260718-a2lsdsew9s
SHA256 10640e76ad6b9678c8bebafecf81606a4969ffe4ecfcde323c5a57d8e0a14eda
MD5 effb5fd8b3fb2f57568f604275d28bb0
SHA1 a75191be4f8c56e2c049faa69e513390c37ccfb8
SHA512 2bac62508d9836535ae1a70163f652b480c8e15233d8a889cb80ad836f2fee487d36c21f8646816af7a195f43dccf57e27020bdbb9065c51b2490e7ebe635c51
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1232	CP.exe
460	tolgeywqlg.exe
2020	CP.exe
5496	CP.exe
480	i_tolgeywqlg.exe
2836	tqlidbvtnl.sys
4216	CP.exe
3356	igdyvtnlgd.exe
2956	CP.exe
2072	CP.exe
4376	i_igdyvtnlgd.exe
5248	sqnigaysqk.sys
5336	CP.exe
4960	kicavsnlfd.exe
3104	CP.exe
2812	CP.exe
4324	i_kicavsnlfd.exe
4948	snkicausnk.sys
2600	CP.exe
4208	nhfzxpnhfa.exe
3800	CP.exe
1964	CP.exe
5092	i_nhfzxpnhfa.exe
5344	uspkicausn.sys
2772	CP.exe
5880	hecxrpjhfc.exe
3680	CP.exe
4464	CP.exe
3320	i_hecxrpjhfc.exe
2700	pkhczxrpkh.sys
3612	CP.exe
2396	mkhczxrpjh.exe
1508	CP.exe
4324	CP.exe
728	i_mkhczxrpjh.exe
3652	jhezxrpjhb.sys
6072	CP.exe
2224	mgezxrpjhb.exe
1352	CP.exe
636	CP.exe
3432	i_mgezxrpjhb.exe
5124	ztrlgeywqo.sys
4240	CP.exe
2780	tomgeywqom.exe
3276	CP.exe
5092	CP.exe
1828	i_tomgeywqom.exe
3004	jebwtrljge.sys
5332	CP.exe
1104	wtnlgdywqo.exe
5340	CP.exe
5528	CP.exe
2412	i_wtnlgdywqo.exe
3652	ywqoigbytq.sys
5848	CP.exe
944	wtoigaytql.exe
432	CP.exe
5104	CP.exe
3688	i_wtoigaytql.exe
3936	vqoigaysqo.sys
5504	CP.exe
708	tnlfdayvqn.exe
5168	CP.exe
1224	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_616166393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1473981432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1473981432\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_160806968\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_160806968\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1441149223\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1441149223\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1441149223\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5828_1441149223\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfsmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjheczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbytqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxrpjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxrpjhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbytqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjheczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfsmkecxu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2172	ipconfig.exe
3596	ipconfig.exe
6076	ipconfig.exe
944	ipconfig.exe
4128	ipconfig.exe
2828	ipconfig.exe
6132	ipconfig.exe
4260	ipconfig.exe
2836	ipconfig.exe
4384	ipconfig.exe
3776	ipconfig.exe
1952	ipconfig.exe
3144	ipconfig.exe
2516	ipconfig.exe
6076	ipconfig.exe
1200	ipconfig.exe
1912	ipconfig.exe
4276	ipconfig.exe
2496	ipconfig.exe
2412	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288089597540763"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{DE6D4F04-57A6-41BA-8C3D-854483D8DF34}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
200	msedge.exe
200	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe
5828	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	480	i_tolgeywqlg.exe
Token: SeDebugPrivilege	4376	i_igdyvtnlgd.exe
Token: SeDebugPrivilege	4324	i_kicavsnlfd.exe
Token: SeDebugPrivilege	5092	i_nhfzxpnhfa.exe
Token: SeDebugPrivilege	3320	i_hecxrpjhfc.exe
Token: SeDebugPrivilege	728	i_mkhczxrpjh.exe
Token: SeDebugPrivilege	3432	i_mgezxrpjhb.exe
Token: SeDebugPrivilege	1828	i_tomgeywqom.exe
Token: SeDebugPrivilege	2412	i_wtnlgdywqo.exe
Token: SeDebugPrivilege	3688	i_wtoigaytql.exe
Token: SeDebugPrivilege	4580	i_tnlfdayvqn.exe
Token: SeDebugPrivilege	1168	i_axsqkicaus.exe
Token: SeDebugPrivilege	4424	i_khfsmkecxu.exe
Token: SeDebugPrivilege	4128	i_nkhcausmke.exe
Token: SeDebugPrivilege	3372	i_wuomhezxrp.exe
Token: SeDebugPrivilege	1968	i_wurpjheczt.exe
Token: SeDebugPrivilege	3184	i_ebzwrojhbz.exe
Token: SeDebugPrivilege	5360	i_lidbywqojg.exe
Token: SeDebugPrivilege	2644	i_olgdbytqnl.exe
Token: SeDebugPrivilege	4752	i_davtnlfdxv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3492	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3492 wrote to memory of 5828	3492	iexplore.exe	90
PID 5828 wrote to memory of 5844	5828	msedge.exe	91
PID 5828 wrote to memory of 684	5828	msedge.exe	92
PID 5828 wrote to memory of 2632	5828	msedge.exe	93
PID 5828 wrote to memory of 2632	5828	msedge.exe	93
PID 5828 wrote to memory of 2632	5828	msedge.exe	93
PID 5828 wrote to memory of 2392	5828	msedge.exe	94
PID 5828 wrote to memory of 2392	5828	msedge.exe	94
PID 5828 wrote to memory of 5632	5828	msedge.exe	96
PID 5828 wrote to memory of 5508	5828	msedge.exe	97
PID 5828 wrote to memory of 5632	5828	msedge.exe	96
PID 5828 wrote to memory of 5632	5828	msedge.exe	96
PID 5828 wrote to memory of 5508	5828	msedge.exe	97
PID 5828 wrote to memory of 5508	5828	msedge.exe	97
PID 5828 wrote to memory of 1368	5828	msedge.exe	98
PID 5828 wrote to memory of 1368	5828	msedge.exe	98
PID 5828 wrote to memory of 1368	5828	msedge.exe	98
PID 5828 wrote to memory of 4584	5828	msedge.exe	99
PID 5828 wrote to memory of 4584	5828	msedge.exe	99
PID 5828 wrote to memory of 4584	5828	msedge.exe	99
PID 5828 wrote to memory of 4616	5828	msedge.exe	100
PID 5828 wrote to memory of 4616	5828	msedge.exe	100
PID 4924 wrote to memory of 1232	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 460 wrote to memory of 2020	460	tolgeywqlg.exe	105
PID 5828 wrote to memory of 1304	5828	msedge.exe	108
PID 5828 wrote to memory of 5464	5828	msedge.exe	109
PID 5828 wrote to memory of 1304	5828	msedge.exe	108
PID 5828 wrote to memory of 5464	5828	msedge.exe	109
PID 5828 wrote to memory of 1504	5828	msedge.exe	111
PID 5828 wrote to memory of 1472	5828	msedge.exe	112
PID 5828 wrote to memory of 1472	5828	msedge.exe	112
PID 5828 wrote to memory of 5528	5828	msedge.exe	113
PID 5828 wrote to memory of 5528	5828	msedge.exe	113
PID 4924 wrote to memory of 5496	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4924 wrote to memory of 4216	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3356 wrote to memory of 2956	3356	igdyvtnlgd.exe	122
PID 4924 wrote to memory of 2072	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4924 wrote to memory of 5336	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4960 wrote to memory of 3104	4960	kicavsnlfd.exe	131
PID 4924 wrote to memory of 2812	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5828 wrote to memory of 3904	5828	msedge.exe	136
PID 5828 wrote to memory of 3904	5828	msedge.exe	136
PID 5828 wrote to memory of 3904	5828	msedge.exe	136
PID 5828 wrote to memory of 4528	5828	msedge.exe	137
PID 5828 wrote to memory of 4528	5828	msedge.exe	137
PID 5828 wrote to memory of 4528	5828	msedge.exe	137
PID 4924 wrote to memory of 2600	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4208 wrote to memory of 3800	4208	nhfzxpnhfa.exe	142
PID 4924 wrote to memory of 1964	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5828 wrote to memory of 3576	5828	msedge.exe	148
PID 5828 wrote to memory of 2960	5828	msedge.exe	149
PID 5828 wrote to memory of 5700	5828	msedge.exe	150
PID 4924 wrote to memory of 2772	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 5880 wrote to memory of 3680	5880	hecxrpjhfc.exe	155
PID 4924 wrote to memory of 4464	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4924 wrote to memory of 3612	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 2396 wrote to memory of 1508	2396	mkhczxrpjh.exe	164
PID 4924 wrote to memory of 4324	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4924 wrote to memory of 6072	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 2224 wrote to memory of 1352	2224	mgezxrpjhb.exe	173
PID 4924 wrote to memory of 636	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4924 wrote to memory of 4240	4924	2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 2780 wrote to memory of 3276	2780	tomgeywqom.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_effb5fd8b3fb2f57568f604275d28bb0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,6961557454467916485,18440214235330029366,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
      4⤵
      System Time Discovery
      PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,17585943675512872970,15257502666730114759,262144 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,9876574561122001281,10060610863285436353,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=1772 /prefetch:13
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,14039872041561757837,5371253580104617821,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16216169119795717302,4900650166123453187,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,18027502596568911479,12402284205650277892,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,17168848383577639501,3704315525081547002,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,13071592863093583488,9334022956618197616,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,14851114210496835200,6631457565404500825,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,11024472804097374358,15024239540171657569,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,6986543807415806165,9348873434992544447,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,6986543807415806165,9348873434992544447,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1787922373114812898,9156850995479772314,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,14198820508857432580,8332989509980358188,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4360,i,12053834159286126678,1214591205023836032,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3680,i,4963741555320273196,16349261491536872213,2097152 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,18072648699467460895,15119994959035212676,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,17272165613502287482,2448996682447264692,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,15135012496427302945,2351158581608350913,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,9422339786454378383,3231408040328357765,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7856673873775061246,16134966571899086900,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,4531239385726356259,16984651749644907670,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5591793805364689567,8026344563452348714,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,18236688455269289249,6911399795434401351,262144 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,12937912900656337706,10183673438952466228,524288 --field-trial-handle=2224,i,11121959019340051623,5591236817726045914,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqlg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1232
- - C:\Temp\tolgeywqlg.exe
    C:\Temp\tolgeywqlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5496
- - C:\Temp\i_tolgeywqlg.exe
    C:\Temp\i_tolgeywqlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdyvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\igdyvtnlgd.exe
    C:\Temp\igdyvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdyvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2072
- - C:\Temp\i_igdyvtnlgd.exe
    C:\Temp\i_igdyvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5336
- - C:\Temp\kicavsnlfd.exe
    C:\Temp\kicavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Temp\i_kicavsnlfd.exe
    C:\Temp\i_kicavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\nhfzxpnhfa.exe
    C:\Temp\nhfzxpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1964
- - C:\Temp\i_nhfzxpnhfa.exe
    C:\Temp\i_nhfzxpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecxrpjhfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\hecxrpjhfc.exe
    C:\Temp\hecxrpjhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecxrpjhfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\i_hecxrpjhfc.exe
    C:\Temp\i_hecxrpjhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\mkhczxrpjh.exe
    C:\Temp\mkhczxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4324
- - C:\Temp\i_mkhczxrpjh.exe
    C:\Temp\i_mkhczxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\mgezxrpjhb.exe
    C:\Temp\mgezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:636
- - C:\Temp\i_mgezxrpjhb.exe
    C:\Temp\i_mgezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\tomgeywqom.exe
    C:\Temp\tomgeywqom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5092
- - C:\Temp\i_tomgeywqom.exe
    C:\Temp\i_tomgeywqom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtnlgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Temp\wtnlgdywqo.exe
    C:\Temp\wtnlgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtnlgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5528
- - C:\Temp\i_wtnlgdywqo.exe
    C:\Temp\i_wtnlgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\wtoigaytql.exe
    C:\Temp\wtoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5104
- - C:\Temp\i_wtoigaytql.exe
    C:\Temp\i_wtoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdayvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5504
- - C:\Temp\tnlfdayvqn.exe
    C:\Temp\tnlfdayvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdayvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1224
- - C:\Temp\i_tnlfdayvqn.exe
    C:\Temp\i_tnlfdayvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  PID:3404
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfsmkecxu.exe ups_run
  2⤵
  PID:6140
- - C:\Temp\khfsmkecxu.exe
    C:\Temp\khfsmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfsmkecxu.exe ups_ins
  2⤵
  PID:1756
- - C:\Temp\i_khfsmkecxu.exe
    C:\Temp\i_khfsmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkhcausmke.exe ups_run
  2⤵
  PID:3936
- - C:\Temp\nkhcausmke.exe
    C:\Temp\nkhcausmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkhcausmke.exe ups_ins
  2⤵
  PID:2200
- - C:\Temp\i_nkhcausmke.exe
    C:\Temp\i_nkhcausmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run
  2⤵
  PID:1036
- - C:\Temp\wuomhezxrp.exe
    C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins
  2⤵
  PID:3004
- - C:\Temp\i_wuomhezxrp.exe
    C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurpjheczt.exe ups_run
  2⤵
  PID:5128
- - C:\Temp\wurpjheczt.exe
    C:\Temp\wurpjheczt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurpjheczt.exe ups_ins
  2⤵
  PID:5864
- - C:\Temp\i_wurpjheczt.exe
    C:\Temp\i_wurpjheczt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebzwrojhbz.exe ups_run
  2⤵
  PID:5772
- - C:\Temp\ebzwrojhbz.exe
    C:\Temp\ebzwrojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebzwrojhbz.exe ups_ins
  2⤵
  PID:3060
- - C:\Temp\i_ebzwrojhbz.exe
    C:\Temp\i_ebzwrojhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbywqojg.exe ups_run
  2⤵
  PID:3692
- - C:\Temp\lidbywqojg.exe
    C:\Temp\lidbywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbywqojg.exe ups_ins
  2⤵
  PID:2004
- - C:\Temp\i_lidbywqojg.exe
    C:\Temp\i_lidbywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbytqnl.exe ups_run
  2⤵
  PID:3548
- - C:\Temp\olgdbytqnl.exe
    C:\Temp\olgdbytqnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbytqnl.exe ups_ins
  2⤵
  PID:5468
- - C:\Temp\i_olgdbytqnl.exe
    C:\Temp\i_olgdbytqnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  PID:480
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  PID:5056
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4388

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\sqnigaysqk.sys
C:\Temp\sqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:5248

C:\Temp\snkicausnk.sys
C:\Temp\snkicausnk.sys
1⤵
- Executes dropped EXE
PID:4948

C:\Temp\uspkicausn.sys
C:\Temp\uspkicausn.sys
1⤵
- Executes dropped EXE
PID:5344

C:\Temp\pkhczxrpkh.sys
C:\Temp\pkhczxrpkh.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\jhezxrpjhb.sys
C:\Temp\jhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:3652

C:\Temp\ztrlgeywqo.sys
C:\Temp\ztrlgeywqo.sys
1⤵
- Executes dropped EXE
PID:5124

C:\Temp\jebwtrljge.sys
C:\Temp\jebwtrljge.sys
1⤵
- Executes dropped EXE
PID:3004

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
- Executes dropped EXE
PID:3652

C:\Temp\vqoigaysqo.sys
C:\Temp\vqoigaysqo.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\usqnlfdxvq.sys
C:\Temp\usqnlfdxvq.sys
1⤵
PID:4564

C:\Temp\icaxsnkica.sys
C:\Temp\icaxsnkica.sys
1⤵
PID:1976

C:\Temp\khfzxusmke.sys
C:\Temp\khfzxusmke.sys
1⤵
PID:3876

C:\Temp\uspkhczusm.sys
C:\Temp\uspkhczusm.sys
1⤵
PID:2584

C:\Temp\ezwromkecw.sys
C:\Temp\ezwromkecw.sys
1⤵
PID:3144

C:\Temp\eywurljhbz.sys
C:\Temp\eywurljhbz.sys
1⤵
PID:1236

C:\Temp\oljdbytrlj.sys
C:\Temp\oljdbytrlj.sys
1⤵
PID:1912

C:\Temp\qolgdywqoi.sys
C:\Temp\qolgdywqoi.sys
1⤵
PID:4844

C:\Temp\dbvtnligay.sys
C:\Temp\dbvtnligay.sys
1⤵
PID:4404

C:\Temp\ifdxvpnifa.sys
C:\Temp\ifdxvpnifa.sys
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxrpjhfc.exe

Path C:\Temp\hecxrpjhfc.exe
Size 226KB
SHA256 1ea7c5e3a5a393d5b3f97496816273a84df53f3c1da2855fdc59b1c6bf5104f8
MD5 64c3d00cf1dc7467e0acb515292cd2c4
SHA1 504ef192718195421304b9970a551a0d7fd46bf7
SHA512 57bf01b80e14665bcdd375078aa8ddf0ebe418cf9d5cbc097ad879739c83310bf2ebb7744cc5321ecabdb1ae8e1aa489323f44242ac61f878cab3ad573d4e638
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T19F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecxrpjhfc.exe

Path C:\Temp\i_hecxrpjhfc.exe
Size 226KB
SHA256 d055a1c1b0113d75c1d2b8d70523f4fd1d8441b4a89b763e6c423e286663d848
MD5 f83201b67a9a74c23fd232123b164250
SHA1 9975858237898c83addc93e134beb380d5281ef0
SHA512 4eccacc1d4faf7ce269ad9385feaf2b082278a13b4908b9eef17cc0770b5c70e656fbbcbcdf6bbb9a7b68ca49fd713756dc9c0157a5a46f5a7f388fa49a548a4
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdyvtnlgd.exe

Path C:\Temp\i_igdyvtnlgd.exe
Size 226KB
SHA256 78465aee05944aae8ddc8a50043913d8aebb8d4cad8f89c627427fa7846cf644
MD5 fc2674e8d48cba7aa26e1ecba69e2733
SHA1 0cb9166cd7f33cc47640478a897b1f884b7af222
SHA512 5463ba254f30632a59c4c74a3dca556e4539b5b5cc717cce6d4938ddc7eca057a05f75a58e18570045c29ec6709c361955696bdb83cbdf5d8e11f99ffd7cbff1
SSDEEP 3072:NeGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:/XY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavsnlfd.exe

Path C:\Temp\i_kicavsnlfd.exe
Size 226KB
SHA256 1916fc3e41c3704e0bd56e159d01c8dbd58f35360bd2e113545a74b695706120
MD5 a3f3c5e99964e8df43521cd9f654f690
SHA1 7383c40921f0131724eb6c534d4a6bec19ff5747
SHA512 6e00efb9561061a9d8acfd463bfd7eb60e22953eedb361b5863161754cb44e87c0aeec128e53c18c91410f629d1efd0d800b5eac8e017eed9f8565d830997763
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczxrpjh.exe

Path C:\Temp\i_mkhczxrpjh.exe
Size 226KB
SHA256 cd206e859b758b8bd55c9831bb196b25b2137c500d403a3e6f3f1b909044cdfa
MD5 77807359ac4006527493f67ff9f9d2c3
SHA1 ca364420dd204b670b91d1ec6391aaedb15d5c58
SHA512 a234a89610c5d44f8f65e77a52a49984bdf571268efc6cd77cef7d6cda6f99730abe2d045d91b6b7ca32d6a5da28d0ff6341d8e6f6199be2fa9529a687616cb7
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T15234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxpnhfa.exe

Path C:\Temp\i_nhfzxpnhfa.exe
Size 226KB
SHA256 4d55363db246c3f0b8f1cc88acc7a247e88a0a2f051f0420b243d415691e4879
MD5 bf9acace0c4622ca1cd65cd3050bd5aa
SHA1 ba3f1364d6cbbcb32ca9f87a26673c30c07eed72
SHA512 414f6a503e5b4c811c908f4e132807fdefb73436b45bc975248fe3d7c40b33716daf1e5002f6f9ea826cd15b6fc80016d10f6a40ae8cf17c68ce72f95b18eccd
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1B934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqlg.exe

Path C:\Temp\i_tolgeywqlg.exe
Size 226KB
SHA256 c81718aaf9306b3494deb27be0fcb68a20938bdedac1de49673233ba0b4d78e8
MD5 14137e18385b4d39476d7947f041f0fe
SHA1 827d6e3ac9b84f0a248860b94a9378399ec03448
SHA512 2532f6e24eb117a3e21b9f16a099e954c0ce67138af02debb823974667f395a382c1ce9be333fb89926efde1d4b7f94e42d3a59449d77cdb9ad85b98864b55ac
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvtnlgd.exe

Path C:\Temp\igdyvtnlgd.exe
Size 226KB
SHA256 9d647b6e88052100b0f522842bec31aa1896bb15c51239404020219041929936
MD5 2345433d6848dac8d37cafe935f091a0
SHA1 a6daa9a9fbaa82fafc7083e133cd86494adf4d44
SHA512 a7be82f8c139fe929d046d0640f59ac7c78b42ab729d8b6b39de1001a29195d54a67a71d7e0c3efb49832a80e66e50f672bf4d53e18c41ae94da9ee277c37d6b
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T13934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfd.exe

Path C:\Temp\kicavsnlfd.exe
Size 226KB
SHA256 8b1229383eb5002a3f735003041ae3b70c9c700f5c6b7e170e6fe541b61e48b5
MD5 810c6931e9ee2a8af1ad1b1c0dc9ddf2
SHA1 66c8d7e8e1031edca656bd1a816a6edd5b6dee9a
SHA512 072543a1c1c990a061903f456f491df17d3356381d78f2ca9cbc0fc2a3510c6ba5f5cd9edf3e55e355038235b54b90d5eb1ce72f2179a7bcc85713fe2cadd242
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczxrpjh.exe

Path C:\Temp\mkhczxrpjh.exe
Size 226KB
SHA256 3130fa6399c282ce97bc672552846fe6859eaf005249d4fb8af5929b535c4b95
MD5 02817dace06687ad6c70a9815a9225b0
SHA1 e6a6f5a1cc4544463819293ee45ccdc4bc5b2a3b
SHA512 e5a1c29f5f6436baab1032f3b8c91889b60e5d7e104ab8d6115b4f355697ad38cb38ea43d270dedd4caf146df9b2dc605b4b533408c38d70577084f2842eb7b2
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1A634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxpnhfa.exe

Path C:\Temp\nhfzxpnhfa.exe
Size 226KB
SHA256 ab3060fcd1b8c849e08d3ebe7d125899c4835242e54ae259e815ea76ec93756b
MD5 5f316a3352835120dcce786c7fee7357
SHA1 33b698a7139d920b3aafed3ca0dfd6992f5a7785
SHA512 75043084458d6729bb4523549834065ca8a06555950b0d40bdc09bdae1ab6a107eae6c732ad22f6085efa5750c8fec6535f6eb991658523ccc25404535cba6ac
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczxrpkh.sys

Path C:\Temp\pkhczxrpkh.sys
Size 141KB
SHA256 aafa2a3813ed96309c385447f3d046c79e9ce3662069bfe913c1571e3379c98e
MD5 44c8c54da47d9cf966dc361f71f929db
SHA1 ebff31a4ef05b59acf9c1fde4ec9cccc7ec9275d
SHA512 a5d5272f41fdceb4c5c270e84e97a0b939720d5c281c1cbe22e0e765e3436eea9a2a416eda2491376919759f10c29bc460361e3b19a8b0b883f388435c6e48b7
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T194E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicausnk.sys

Path C:\Temp\snkicausnk.sys
Size 141KB
SHA256 c6af88f85ceb57a58be57f8515ec4162b5bf4cc4ca900cd499179f420a578255
MD5 2d12378b7f80d5549e81756cfe46e3c0
SHA1 0e39e95aec58365cca5bd0c48fa7e8aaa7b12b23
SHA512 76512be6957e45728533a68715bef9484b43cd9e098f3ce4e192b37097737d49a02c0b0a53335e0204c5a5d57c427072c92a568d78978e39ea3da18f38af7790
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqk.sys

Path C:\Temp\sqnigaysqk.sys
Size 141KB
SHA256 d95e513357b57b401c328ea6dac5ec47cab91a090609cb0aa2eab6f01a22716e
MD5 c41688a62adb41abcd0e06020e35d440
SHA1 1f471ef22e260d222c8370b3aaab1012f141c744
SHA512 2b7e24bcd4c2f5ad89d415311f5eafa8840b8d248ae008c5570a7185066b151e4d6b52af7e29c3adfd98d0f939f0760f8cc132d7ec663baa9ca8b498f9bcef72
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqlg.exe

Path C:\Temp\tolgeywqlg.exe
Size 226KB
SHA256 87eef0a57a4071aac0a632f539300cc9defecc93a3c38d56bb7245d8de60791e
MD5 bb7fc84b1172e7d171ba1daa948be707
SHA1 d345eedd20b2be3d87df7da59e3fc4544572f119
SHA512 afaa5dfd8c172bceb72cc67b3ede708d2b27b02561719a224380b8bf1b839dd440e8e4f0a3b03fb8744c57cd9dde6af68ef00c6e3d41ee19dfb7af0263850091
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T15E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtnl.sys

Path C:\Temp\tqlidbvtnl.sys
Size 141KB
SHA256 1eff7237ab88d20ed4ffad8ec341325b7aba743ad72db6d8a84954b44ab341e6
MD5 27bc4f7bbf658590a8c1f758d9383c9d
SHA1 f08c72d77d7a916308f8d1f0b77498fcdae0ec18
SHA512 1f8923bc23c588641a40426d7b5cf734d42f0f05dcedb4c3029ba7e19deef30eab7848982a71375e4361870dd3d067d39a78b57686c21d17005b9b89f92e6c6d
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicausn.sys

Path C:\Temp\uspkicausn.sys
Size 141KB
SHA256 5c96fdb490d97bcfcaf1c5880608477717cdad7d5578b427222fa66a3144149e
MD5 c45996f47690993371a18378bd32d4e2
SHA1 aee958f4c568230c609b886148e0f450b12903bb
SHA512 fe344dc9d81fff243565b47c354e1d0ba815de9e856e66e4a9e9c4aba53e7a23fbaf3923b47061773b6212266da89cbc541887017ea7dfad4d034e29c34ae3df
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T119E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e92a2775e07f5af54e4acf9d1b975185c4780f45f6982ec3837c6d0848073439
MD5 b30396e12206c8a871b984a39fe1d3c2
SHA1 74cdd3b2c851fffb9c2229ce8f140b3ea0059ef2
SHA512 046e18379b23340ef505a8be9d9b1dd0c7ec9080b159b3225e6f90ff5c3d5a82b4ef52c5c97aabef53915e6316f8bd3e96386fd922be5714e7d7f6a53ae2e48d
TLSH
T1A221DC54AB3F5AC1F7AD69B155DBD59A7239A75DCB036FF100D0357CCC077051011550
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2eafbf30d66f704ee8429660b95f02e82df30ad9721279ca99c7568e0cd6e1e7
MD5 159ad315d4c617fb16f8dbfb3fb3b9ad
SHA1 2b939003392b33f2852e0889c9f9e787f4add2aa
SHA512 6b8724bbd3bb57ab5fba67802ed43128407457e0e9bbebda78ee2e3c2c57455c05b2bb693b86b7fe67e1c2d46803d2e03ebb8cce71a46ba8c9294344c3f5e912
TLSH
T11E418EF3C7E8967D8A0155F4B7143E2BCE1D0914432C3D5AC9E4AE1BA7E2871D14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f28667b3879a545b066e6e6cfba8960d9d07281535c37d3e49ce6706d21cb6e3
MD5 7cc2c46ca6902c599185245d92d37ac8
SHA1 8daba96fdb8705acad887b42919f1af0a35dc47d
SHA512 4052abac1b404129a2f640d6d708ddaf253c6ce9687e2530c8ee4b4b7c02d93fdab1c6340bb23fe0e79a44e29e0c452c22234b9170030c9b1dc02e555563707c
SSDEEP 192:sxRHrCH/fLsj8DrZfmzoD8pi/g6+WNIYCsuO/GVIgtJ:sxRHeH/fLsj8DFii/5Ieo3
TLSH
T1F232B6166E28993B9CC7E25DBB65BF53D2F95032A1D02E48A7FC871C04EA6DD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6f2f7778d7446d77a05498d9f9596824c6893557b67a4cfd4a0c7e67810453a4
MD5 55f2388d49781c0631a483ddfde0c46a
SHA1 b742c00b547999161553c91635af05c7a2a6d464
SHA512 72175e57c89ea08bacefc1576d85a64c9da72ae329edfa4af5ea60a8fca0b02ddb014643b1db749ec6eb23455b337749655a37dcbe4b1f949e05bd77791c5466
SSDEEP 192:sxRsrCH/fLs28DrZfmzoD8pi/g6+WNIYCsuO/GVIgDAOJ:sxRseH/fLs28DFii/5Ieo8a
TLSH
T1A832C6166E28993B9CCBE25DBB65BF53D2F95033A1D02E48A7FC870C04EA6DD520741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e06e4801d8427e1cf5771d1b26fcd8f55485aa489a19dd7d940b71556fc0d35e
MD5 3e4a5ce27749e895ff2ccb1a23a433f0
SHA1 0e0b7fae26b43cdee5ed6ce9cf1aa224e538a1f5
SHA512 3756d3665f54a4d231459002fee4a7f6c38178f7b973aacabcf639fb0b7e4ea9a6d47c7891b4da5450b2dda78ca9688d92c7d5f832aabb3e267c1889a4800092
SSDEEP 192:sxRsrCH/fLs28IrZfqzoD8p91/g6+WNCZP/YC1uO/GVIgDAAJ:sxRseH/fLs28IFOr/5o/do8k
TLSH
T1AF42B6166A28993B9CC7E25DBB55BF53E2F95033A1D02E08A7FC970C14EA6DD620341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5dd007f62f92900d27d415571ebe5f19fce01bb5f3be5d4c79c95661d9115af7
MD5 24533b67a90ea0e9ee42d1b18b70f57d
SHA1 70256ec65771ace24b3679a301e1cca715350d9c
SHA512 36e51b8860017d5836acf966dfb3bcddb9853e1b6cd019d26aa3fb9b552721afd337f636c7d0751d93de5257b300634463541d0b2ff4e4c580c6e45c21069a2c
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaF0QqcYroZX:jC+vf7E7JQWgQ+f4+u1ja5F0Vcjd
TLSH
T1F2D2EA7B640DCB7F4F804ADDEC197A9B6DA802CB9698CD4047FE941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2081559c7e7691e99e5cfc0d64a0a4baceff0c877b0eaa9dec1856791b85b6eb
MD5 d19a07430efe07b3177fd481f5a85678
SHA1 4962490bb9cdf57c775e6921bb24fb0245745449
SHA512 6bcc609ada910ec5535f1fcd14ad67e132dc4ac41a5ea6abbeff9bc9df3fec8cba96a6f9699b5a2a545cc2a345fdedfdcfbf3ca86bfaa123df475d91ba78e7e3
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mbX:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxTg
TLSH
T18D912011317B02C17C3DA54C84B9C86F82C1B066341AB76B3FA946664B66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a65c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a65c0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 594b8234915ea3c296fbf6146d30de5a19448387cf312aff8e9e83624b623725
MD5 7be0394a0eef6c147b2949edd95d4969
SHA1 b1bfec4af2c08cdd982af8043ce5d9b66e73767b
SHA512 39f1dd401e748656a268bf44c0d4950c55c985ff406e60cbe9c6e2f0b0922243844823198ab64b1deb1ec93cdc86b5a81f5e5c75372407b700de5e7186cd703f
SSDEEP 768:Irv+4UNbdD3QcDtFNp8+p3bd66j+4BRv86aLIiB2bwCl1:Ibsbp3jL8+p3Z6n4yH0ww
TLSH
T14003CE73F96899339CF6C644B2467A837FF851A396C10EC4E5DD2B4E419A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb430130b73a174f5582c3778426c345773bc83c5800d18d359bbb67938f0b05
MD5 dcde7c638cda9a7863e01c81f4aba614
SHA1 836aeae8d429306dc23cb24e3234138ef47d5699
SHA512 9a56a71c0a052298ab83794ee6056fc9271664f90bc107cf49f0ae89a6bbacc614d4190e123e1fcd5552e3d061f50de9c47f03d13b51c4b599c313ea0a2fa9b1
SSDEEP 768:hj+9d3z/FCDt/9+p8+p3bd66j+4BRv86aLIW5b9Mm:89d3q48+p3Z6n4yLb+m
TLSH
T1B3F2AF72E86ADD739CE5C685B2873B83AFF411B356C41EC4E5D9AB0E01C325D5B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 836c38d8b82e93dc00b25681e362685b5786698b6aae2b353217eac6317ac37b
MD5 236730832d6b49407b40e773f1460f34
SHA1 f6f1b158de79a2ece1b2099c3beea18a677d83a6
SHA512 d90284c770c74b7406033605df0aaf68959c9e85e223d45535c35336785f0657a3088f1e37940f4d1dd6dceb36762e84dab5c35aade8fb021a395410938b448b
SSDEEP 768:Prv+4UNbdT39/8CDt/9+p8+p3bd66j+4BRv86aLIW52bwClP:Pbsbx3r48+p3Z6n4yL0w6
TLSH
T1DE13BE72F968DD339CF6D644B1867B837FB820A395C00EC4E5D96B4E019A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0bef6f3e8fef5410e1791c54edc3a63b489a1407ae7400b1aec16ec5cff7d76d
MD5 2d390c9577163328117f74871805a879
SHA1 8073acfc409582733a962b6c088f185af2b77a75
SHA512 838c291466470cf49a277803cb9fcc66289347f101bc4f1652185add722a24abcb1535d1c9031293d0a27b3308bd1e44862f6ab02021ea03c350ad0fdbdc62af
SSDEEP 768:TF1j+9D3TwgH/85At/Z9p8+p3bd66j+4BRv86aLIW5b9Mm:C9D3R8+p3Z6n4yLb+m
TLSH
T1CD1328F298D78937D8AE8787A37D2E869EBCD1A375845984F7C45E0CCC821BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ef9552bb-56cb-4725-b62c-d599ec2696e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ef9552bb-56cb-4725-b62c-d599ec2696e8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5828_1130924102\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1236-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1976-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2584-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-177-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3652-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3652-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-402-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-482-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4564-377-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4844-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4844-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4948-249-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5124-309-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5248-224-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5344-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download