924e516e6fb8c38b3a9d01c34c041954ec443201fac07b17e702dd7c62effa69

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260718-a4befaex3x
SHA256 924e516e6fb8c38b3a9d01c34c041954ec443201fac07b17e702dd7c62effa69
MD5 df5d1c27a39b6002ef9549d93a754783
SHA1 5a971a1ac0740d77b6e94a2c766526bffec72a65
SHA512 b7f01380ef703313a8eb2d653e9966335e2ff7acea94f7b97e198991359a4b82a608c7cf17aec5985b2b802e6681b0157f181bd7a68b30d35dbf3aa41ec1f4fd
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3392	CP.exe
2032	urmhzxrmje.exe
5788	CP.exe
4824	CP.exe
4756	i_urmhzxrmje.exe
1420	ebwuomgeyw.sys
1116	CP.exe
5632	qojgbytrlj.exe
5668	CP.exe
5540	CP.exe
2520	i_qojgbytrlj.exe
4516	lgdbytrljd.sys
3924	CP.exe
2724	gbytrljdbw.exe
1296	CP.exe
1872	CP.exe
4528	i_gbytrljdbw.exe
4512	bvtnlgdywt.sys
2940	CP.exe
2856	yvtqlidayv.exe
1604	CP.exe
3904	CP.exe
1432	i_yvtqlidayv.exe
2100	gaysqkiday.sys
5080	CP.exe
5096	vtnifaysqk.exe
1160	CP.exe
1484	CP.exe
5508	i_vtnifaysqk.exe
2060	ysqkicaysq.sys
2044	CP.exe
3604	pnhfdxvpni.exe
4732	CP.exe
200	CP.exe
4528	i_pnhfdxvpni.exe
588	vpnkifzxvs.sys
2620	CP.exe
52	xsqkhfcxup.exe
2876	CP.exe
3408	CP.exe
1680	i_xsqkhfcxup.exe
3504	hecxupmhfz.sys
2484	CP.exe
5956	khcausmkhc.exe
2624	CP.exe
4912	CP.exe
4628	i_khcausmkhc.exe
5340	mkeuomjhcz.sys
5608	CP.exe
4612	czuomhezwr.exe
1672	CP.exe
3780	CP.exe
4584	i_czuomhezwr.exe
2752	gezwrojhbz.sys
2948	CP.exe
1932	ezwjgbztro.exe
4620	CP.exe
2320	CP.exe
1060	i_ezwjgbztro.exe
3468	hbztrljebw.sys
1900	CP.exe
4436	bztrljhbzt.exe
4600	CP.exe
2520	CP.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1813123836\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1813123836\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_1283953326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_859210893\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4644_859210893\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmhzxrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwjgbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrpjzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtqlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtqlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmhzxrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrpjzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwjgbztro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5688	ipconfig.exe
5636	ipconfig.exe
5068	ipconfig.exe
5592	ipconfig.exe
1464	ipconfig.exe
3248	ipconfig.exe
4724	ipconfig.exe
1820	ipconfig.exe
3284	ipconfig.exe
3568	ipconfig.exe
3512	ipconfig.exe
1420	ipconfig.exe
2088	ipconfig.exe
5492	ipconfig.exe
1308	ipconfig.exe
5536	ipconfig.exe
4384	ipconfig.exe
4848	ipconfig.exe
1912	ipconfig.exe
3068	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288091379151551"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2D10E02F-A828-42FF-B37D-CA86A0B458A3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
248	msedge.exe
248	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	i_urmhzxrmje.exe
Token: SeDebugPrivilege	2520	i_qojgbytrlj.exe
Token: SeDebugPrivilege	4528	i_gbytrljdbw.exe
Token: SeDebugPrivilege	1432	i_yvtqlidayv.exe
Token: SeDebugPrivilege	5508	i_vtnifaysqk.exe
Token: SeDebugPrivilege	4528	i_pnhfdxvpni.exe
Token: SeDebugPrivilege	1680	i_xsqkhfcxup.exe
Token: SeDebugPrivilege	4628	i_khcausmkhc.exe
Token: SeDebugPrivilege	4584	i_czuomhezwr.exe
Token: SeDebugPrivilege	1060	i_ezwjgbztro.exe
Token: SeDebugPrivilege	2848	i_bztrljhbzt.exe
Token: SeDebugPrivilege	3644	i_vtnlgdywqo.exe
Token: SeDebugPrivilege	4480	i_yvqnlfdyvq.exe
Token: SeDebugPrivilege	3708	i_snkicavsnk.exe
Token: SeDebugPrivilege	588	i_hfdxsqkica.exe
Token: SeDebugPrivilege	1904	i_nhfcxupnhf.exe
Token: SeDebugPrivilege	3808	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	5068	i_jhbztrpjzt.exe
Token: SeDebugPrivilege	4892	i_jhbztrmjeb.exe
Token: SeDebugPrivilege	2392	i_ljdbwtolgd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2980	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2980 wrote to memory of 4644	2980	iexplore.exe	90
PID 4644 wrote to memory of 5888	4644	msedge.exe	91
PID 4644 wrote to memory of 2164	4644	msedge.exe	92
PID 4644 wrote to memory of 108	4644	msedge.exe	93
PID 4644 wrote to memory of 108	4644	msedge.exe	93
PID 4644 wrote to memory of 108	4644	msedge.exe	93
PID 4644 wrote to memory of 120	4644	msedge.exe	94
PID 4644 wrote to memory of 120	4644	msedge.exe	94
PID 4644 wrote to memory of 520	4644	msedge.exe	97
PID 4644 wrote to memory of 1064	4644	msedge.exe	96
PID 4644 wrote to memory of 520	4644	msedge.exe	97
PID 4644 wrote to memory of 520	4644	msedge.exe	97
PID 4644 wrote to memory of 1064	4644	msedge.exe	96
PID 4644 wrote to memory of 1064	4644	msedge.exe	96
PID 4644 wrote to memory of 4416	4644	msedge.exe	98
PID 4644 wrote to memory of 1876	4644	msedge.exe	99
PID 4644 wrote to memory of 4416	4644	msedge.exe	98
PID 4644 wrote to memory of 4416	4644	msedge.exe	98
PID 4644 wrote to memory of 1876	4644	msedge.exe	99
PID 4644 wrote to memory of 1876	4644	msedge.exe	99
PID 4644 wrote to memory of 3936	4644	msedge.exe	100
PID 4644 wrote to memory of 3936	4644	msedge.exe	100
PID 4644 wrote to memory of 5356	4644	msedge.exe	102
PID 4644 wrote to memory of 5356	4644	msedge.exe	102
PID 4644 wrote to memory of 4896	4644	msedge.exe	103
PID 4644 wrote to memory of 4896	4644	msedge.exe	103
PID 4132 wrote to memory of 3392	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 4644 wrote to memory of 5740	4644	msedge.exe	108
PID 2032 wrote to memory of 5788	2032	urmhzxrmje.exe	109
PID 4644 wrote to memory of 1332	4644	msedge.exe	112
PID 4644 wrote to memory of 1332	4644	msedge.exe	112
PID 4644 wrote to memory of 3564	4644	msedge.exe	113
PID 4644 wrote to memory of 3564	4644	msedge.exe	113
PID 4132 wrote to memory of 4824	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4132 wrote to memory of 1116	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5632 wrote to memory of 5668	5632	qojgbytrlj.exe	122
PID 4132 wrote to memory of 5540	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4132 wrote to memory of 3924	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2724 wrote to memory of 1296	2724	gbytrljdbw.exe	131
PID 4132 wrote to memory of 1872	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4132 wrote to memory of 2940	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2856 wrote to memory of 1604	2856	yvtqlidayv.exe	140
PID 4132 wrote to memory of 3904	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4644 wrote to memory of 5636	4644	msedge.exe	146
PID 4644 wrote to memory of 4972	4644	msedge.exe	147
PID 4644 wrote to memory of 1844	4644	msedge.exe	148
PID 4132 wrote to memory of 5080	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5096 wrote to memory of 1160	5096	vtnifaysqk.exe	153
PID 4132 wrote to memory of 1484	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4132 wrote to memory of 2044	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 3604 wrote to memory of 4732	3604	pnhfdxvpni.exe	162
PID 4132 wrote to memory of 200	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4132 wrote to memory of 2620	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 52 wrote to memory of 2876	52	xsqkhfcxup.exe	171
PID 4132 wrote to memory of 3408	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4132 wrote to memory of 2484	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5956 wrote to memory of 2624	5956	khcausmkhc.exe	180
PID 4132 wrote to memory of 4912	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4644 wrote to memory of 6096	4644	msedge.exe	185
PID 4644 wrote to memory of 6096	4644	msedge.exe	185
PID 4132 wrote to memory of 5608	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4612 wrote to memory of 1672	4612	czuomhezwr.exe	193
PID 4132 wrote to memory of 3780	4132	2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_df5d1c27a39b6002ef9549d93a754783_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x358,0x7ffc66e2c188,0x7ffc66e2c194,0x7ffc66e2c1a0
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17204035029178612648,542889555033204627,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
      4⤵
      System Time Discovery
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,8775535705626411563,3143542306586966351,262144 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,3999530706544951474,10168305641833861787,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,8822979128715356902,4221606673254812831,2097152 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,5922488652290554223,8857008171266597932,2097152 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,12830163471480678592,4862540872551649579,2097152 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,16304580409905860519,10267026532762103401,2097152 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,12147685259756779579,14980405316428339991,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16580354962604119083,14167947799739833034,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11975760150430752646,17427929597396021268,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2613970784956074282,10078102707120431619,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2613970784956074282,10078102707120431619,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,12063328985510991967,8634465829681924493,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16573263354407872448,76248357017061155,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,12386209427839331778,13942026385704089808,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,14069036407494013750,758817453699653434,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9272843792784136439,4701315092245294427,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,9105317725135827279,13704644383825295914,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,3467267273854500057,15037023437721531302,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18226493002878936581,12170326822411973710,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,4514922798624011533,14059128462363935779,262144 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8156589234325282236,6000471335638785871,524288 --field-trial-handle=2340,i,7816323287542628877,12276541353212573691,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:14
      4⤵
      PID:5960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmhzxrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3392
- - C:\Temp\urmhzxrmje.exe
    C:\Temp\urmhzxrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmhzxrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Temp\i_urmhzxrmje.exe
    C:\Temp\i_urmhzxrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1116
- - C:\Temp\qojgbytrlj.exe
    C:\Temp\qojgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5540
- - C:\Temp\i_qojgbytrlj.exe
    C:\Temp\i_qojgbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3924
- - C:\Temp\gbytrljdbw.exe
    C:\Temp\gbytrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\i_gbytrljdbw.exe
    C:\Temp\i_gbytrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtqlidayv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2940
- - C:\Temp\yvtqlidayv.exe
    C:\Temp\yvtqlidayv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtqlidayv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\i_yvtqlidayv.exe
    C:\Temp\i_yvtqlidayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnifaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5080
- - C:\Temp\vtnifaysqk.exe
    C:\Temp\vtnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnifaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1484
- - C:\Temp\i_vtnifaysqk.exe
    C:\Temp\i_vtnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2044
- - C:\Temp\pnhfdxvpni.exe
    C:\Temp\pnhfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_pnhfdxvpni.exe
    C:\Temp\i_pnhfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkhfcxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2620
- - C:\Temp\xsqkhfcxup.exe
    C:\Temp\xsqkhfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:52
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkhfcxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_xsqkhfcxup.exe
    C:\Temp\i_xsqkhfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Temp\khcausmkhc.exe
    C:\Temp\khcausmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\i_khcausmkhc.exe
    C:\Temp\i_khcausmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czuomhezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5608
- - C:\Temp\czuomhezwr.exe
    C:\Temp\czuomhezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czuomhezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Temp\i_czuomhezwr.exe
    C:\Temp\i_czuomhezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwjgbztro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2948
- - C:\Temp\ezwjgbztro.exe
    C:\Temp\ezwjgbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwjgbztro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2320
- - C:\Temp\i_ezwjgbztro.exe
    C:\Temp\i_ezwjgbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\bztrljhbzt.exe
    C:\Temp\bztrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2520
- - C:\Temp\i_bztrljhbzt.exe
    C:\Temp\i_bztrljhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdywqo.exe ups_run
  2⤵
  PID:5728
- - C:\Temp\vtnlgdywqo.exe
    C:\Temp\vtnlgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdywqo.exe ups_ins
  2⤵
  PID:4104
- - C:\Temp\i_vtnlgdywqo.exe
    C:\Temp\i_vtnlgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlfdyvq.exe ups_run
  2⤵
  PID:2272
- - C:\Temp\yvqnlfdyvq.exe
    C:\Temp\yvqnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlfdyvq.exe ups_ins
  2⤵
  PID:688
- - C:\Temp\i_yvqnlfdyvq.exe
    C:\Temp\i_yvqnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkicavsnk.exe ups_run
  2⤵
  PID:4632
- - C:\Temp\snkicavsnk.exe
    C:\Temp\snkicavsnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkicavsnk.exe ups_ins
  2⤵
  PID:2408
- - C:\Temp\i_snkicavsnk.exe
    C:\Temp\i_snkicavsnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdxsqkica.exe ups_run
  2⤵
  PID:1280
- - C:\Temp\hfdxsqkica.exe
    C:\Temp\hfdxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdxsqkica.exe ups_ins
  2⤵
  PID:2824
- - C:\Temp\i_hfdxsqkica.exe
    C:\Temp\i_hfdxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcxupnhf.exe ups_run
  2⤵
  PID:1076
- - C:\Temp\nhfcxupnhf.exe
    C:\Temp\nhfcxupnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcxupnhf.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_nhfcxupnhf.exe
    C:\Temp\i_nhfcxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run
  2⤵
  PID:2064
- - C:\Temp\ezxrpjhbzu.exe
    C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
  2⤵
  PID:5264
- - C:\Temp\i_ezxrpjhbzu.exe
    C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrpjzt.exe ups_run
  2⤵
  PID:3632
- - C:\Temp\jhbztrpjzt.exe
    C:\Temp\jhbztrpjzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrpjzt.exe ups_ins
  2⤵
  PID:1232
- - C:\Temp\i_jhbztrpjzt.exe
    C:\Temp\i_jhbztrpjzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run
  2⤵
  PID:3192
- - C:\Temp\jhbztrmjeb.exe
    C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
  2⤵
  PID:960
- - C:\Temp\i_jhbztrmjeb.exe
    C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtolgd.exe ups_run
  2⤵
  PID:4860
- - C:\Temp\ljdbwtolgd.exe
    C:\Temp\ljdbwtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtolgd.exe ups_ins
  2⤵
  PID:1756
- - C:\Temp\i_ljdbwtolgd.exe
    C:\Temp\i_ljdbwtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5900

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:1420

C:\Temp\lgdbytrljd.sys
C:\Temp\lgdbytrljd.sys
1⤵
- Executes dropped EXE
PID:4516

C:\Temp\bvtnlgdywt.sys
C:\Temp\bvtnlgdywt.sys
1⤵
- Executes dropped EXE
PID:4512

C:\Temp\gaysqkiday.sys
C:\Temp\gaysqkiday.sys
1⤵
- Executes dropped EXE
PID:2100

C:\Temp\ysqkicaysq.sys
C:\Temp\ysqkicaysq.sys
1⤵
- Executes dropped EXE
PID:2060

C:\Temp\vpnkifzxvs.sys
C:\Temp\vpnkifzxvs.sys
1⤵
- Executes dropped EXE
PID:588

C:\Temp\hecxupmhfz.sys
C:\Temp\hecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:3504

C:\Temp\mkeuomjhcz.sys
C:\Temp\mkeuomjhcz.sys
1⤵
- Executes dropped EXE
PID:5340

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
- Executes dropped EXE
PID:3468

C:\Temp\dbytqoigdb.sys
C:\Temp\dbytqoigdb.sys
1⤵
PID:5576

C:\Temp\yvtnlgdxvt.sys
C:\Temp\yvtnlgdxvt.sys
1⤵
PID:1076

C:\Temp\fdxvtnlfdy.sys
C:\Temp\fdxvtnlfdy.sys
1⤵
PID:3028

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
PID:5052

C:\Temp\nhfcxusmkh.sys
C:\Temp\nhfcxusmkh.sys
1⤵
PID:672

C:\Temp\usmkecxuhf.sys
C:\Temp\usmkecxuhf.sys
1⤵
PID:5692

C:\Temp\pjhezxrpjh.sys
C:\Temp\pjhezxrpjh.sys
1⤵
PID:5696

C:\Temp\jgebwuomje.sys
C:\Temp\jgebwuomje.sys
1⤵
PID:2140

C:\Temp\jgeywqoigb.sys
C:\Temp\jgeywqoigb.sys
1⤵
PID:1148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywt.sys

Path C:\Temp\bvtnlgdywt.sys
Size 141KB
SHA256 3c85b5839cae2f751b49269a44840988d34bfcbdaf414cdac59b84f237ff203b
MD5 726fe65f8faaf32805e272e7e6618fd0
SHA1 fe7fae1973a5052efcb671fb66537c26f69c8bca
SHA512 cfa8c5b840fc70e0c512e2971fb9ec91bd58bf349a7b588ab7d359c5a554cc446b16927b99ee758a8118340c3cf7756f204dd582f9034013a57b2985fe02ad69
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T181E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.sys

Path C:\Temp\ebwuomgeyw.sys
Size 141KB
SHA256 126e091063c3b3072e3f1134c6f033a7dfa0fa55be1fedb55569bc1d2b268e65
MD5 81240ae0357fd04ad359c315a2fdcc4b
SHA1 568b421c83617ca2815176d84446f8459efb129a
SHA512 d2d2452546bf792db566db4bc9a508e696827d02bfdea0f02c1fc1d632f0d8c4188748284f70991a63dab757428ebc14bd63c787d79520cc0a6a0186c7c95118
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkiday.sys

Path C:\Temp\gaysqkiday.sys
Size 141KB
SHA256 4f5ee4207dedc84e48931e8a82a9b261d49e6d4dce2d980b8b349ac3359f24fd
MD5 bbb2197b87a4e67f295e0da161f1edf2
SHA1 6e30d35090d95b385f3323179f46a6ae9a223d58
SHA512 9c53de60b7bf0a9a06e94f747734321a9380060f70c310099221aec4c8f089fe83d7a8943c9d613fe2099811fa906abcc888281372325f202a1c37bd9dcd90b6
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.exe

Path C:\Temp\gbytrljdbw.exe
Size 226KB
SHA256 939e94a4f4749b8cc369fccd774dc288e8b197cd6afce40d55e6354d7ed25bd3
MD5 5ce877eca5a8bfd0c7873c830337bb3b
SHA1 c350b2335f191b4733f7ea61f37f819d60dfc876
SHA512 8a0b526c8dc2b4e4701bdd4f6e7138eb1e04521f1bbcc77c38b229c13424367bcf522badebe3c577079dc8e4d17d4ec77695928c45da83525e8c98cbc260e0b3
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbw.exe

Path C:\Temp\i_gbytrljdbw.exe
Size 226KB
SHA256 c2c6efe0c4489233321e0e473d46850bf04b3c56947450a2222d536bd25fef96
MD5 b1478fa11e9c8799b339be9ffa40b587
SHA1 14e0dbc2aa99d2dcca8528d74211e5415eed69db
SHA512 0a26500feeead7b3a100aebf804519353d5ba85fbd8b6e58dae1cd6a5e5fe5e641ff5f8b9ce01d2a44c69c57c4470a7b49c2a7835cd1f468457eff069adc08d6
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T15C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfdxvpni.exe

Path C:\Temp\i_pnhfdxvpni.exe
Size 226KB
SHA256 e57a697beb3fbc2c48b55e4935dbaea364db8c513b6fee6cdaa907ca2fef43f3
MD5 838b78f09b04a53bd32309a465a65a6f
SHA1 ee27d9f15295b35708c10a025aa8bfdd69744e3b
SHA512 991fc0f3b3ad2465f2bbb27186a2f78d6143411669b23c24b4ca858153e40660c96da9fc6cbde996bd8c356d74c973000a884acd417cdc629edd0b3afbca16e0
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgbytrlj.exe

Path C:\Temp\i_qojgbytrlj.exe
Size 226KB
SHA256 ac4628eace8dbdbb16fdc04834473cf496cba17ac017cf683864207f7eeea816
MD5 51612a8cb6e649bdf8c8d7007bafef4d
SHA1 b1061cd71f77e6bcaf9d66fe8b1f697a9947ca0b
SHA512 e039bfa59aa35c306803314514aeebf9096cfbce3b0288d363ac4ae515ceab1bd4f045d82182e6850cc918ac2cf9cf9749389c2110f5e43a22b879b571e46b02
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T14034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmhzxrmje.exe

Path C:\Temp\i_urmhzxrmje.exe
Size 226KB
SHA256 bf54c2640b51f14f13f3615e40a2c6a0c8cc6b0f7fcab98f30b2f5b245ee4a6f
MD5 07f1ae6de9afa987e78c51cf1690a582
SHA1 275ff50818a59083d0a574af0b10ab014de9f3d3
SHA512 7a6f35d14e09270a510476e1044af638036d8499def459fcc25fac491d74348d62d1491cfae2a5bb24d5cbac9c28c6eedefa2be9c273c9d9d86d8a74fd745be1
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T15934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnifaysqk.exe

Path C:\Temp\i_vtnifaysqk.exe
Size 226KB
SHA256 8ebcce39268822358004ae3e89761860cbb36da0bc722a90da2fe4aa9b6414be
MD5 7b0002c2fc7d1eaadd5fce8d9ea817ea
SHA1 c8f13e9524f0c8c78bfb5ca58ee3692dde9ecf2a
SHA512 f9dd53fae808ad4c8478b2c9b95fcd12ac6ad9de4e2b5f50f48d772a487c8342e53c8ba7c37375377c4e570a6be0af3659434ce83475f71aaf828751fda8fc86
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T15C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtqlidayv.exe

Path C:\Temp\i_yvtqlidayv.exe
Size 226KB
SHA256 2917338d8085fed00eb4cdb09bab637cea2e31e0a18694b9e45799c3ea18d9a5
MD5 21229112a1a2cc91119d52243e00e9e3
SHA1 cfcf15cabdc002f9b0ff6cd83a315fefd8a72962
SHA512 1788462a3de02a986979692a2e18b6fa4943e1956f0e3d7326251bb8e45188a8e768df58124867f9d532f76af8eab055b8455aabdbdb15298d4921cf7dadc63b
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T15234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbytrljd.sys

Path C:\Temp\lgdbytrljd.sys
Size 141KB
SHA256 cc19d202fea9a0a6d8a51f8727835e35dd41f3b9ecc013969294d1cf13968dfb
MD5 1d9905913748c59880d0fa11ea973dd3
SHA1 049301111e1448d4b8b7de35e833b6352353a36e
SHA512 254b50c254d7a1d64d5ceedcecbdd974a3f2db1f45b034b629fd617a675f158e112bb67a7676557b2f85da683aec440a0394b9e8ee3905812a33ecaf67d15c3d
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfdxvpni.exe

Path C:\Temp\pnhfdxvpni.exe
Size 226KB
SHA256 2523559612455f955b7f537962596424338338b5a0e45357f1f2adcbb576bb96
MD5 1a1aa52ee2cd9df5f95a6c36c3a28b9e
SHA1 6de475e770ab7bc9adcb1175a2f620ac8e7873be
SHA512 3c68b2f7a7d4ef2eeb9e9c9947dd861e0948c5d6cde1f64de8b9ee3071b7866bcb08b80864fe20b1a07474bb61f532dbd767ab5f3671b68a5b1b5f5980add6f9
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T14734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbytrlj.exe

Path C:\Temp\qojgbytrlj.exe
Size 226KB
SHA256 e7b82b9a14870ce8d02c6721b0d0ea5aacf93cdf1a7d46a546d8ef87c207c95c
MD5 c1b3ec442f31debc77846aab5f3719c1
SHA1 6824f9e5d9d558000f7b465fa084061216b08f5d
SHA512 ecacebe9dff4a34172a12df35a1b93c8a04f1748b90f4a551b3dc961da5e1cb54f6ca6999fc638b5d734b8fa072aeff2a268bbfabc812cab7fd53a1706441813
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T1FE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmhzxrmje.exe

Path C:\Temp\urmhzxrmje.exe
Size 226KB
SHA256 4b4cf087848b4e1bbaf3b7b23844410d7e43625671c47fb8e08f282bb0d0bf89
MD5 17e277e21e6de530c80786b41556b577
SHA1 ebe3ec30397bea15f31042a8dae10ffd37c87bc3
SHA512 0f037cc983d8fe95d2440047a7a2d428101f94ea466e2cd9ee6765e53d4c43360132ea25b160c0381abbafe8963d25667d68901d1938a355c95fdb72b73b91da
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T12F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnifaysqk.exe

Path C:\Temp\vtnifaysqk.exe
Size 226KB
SHA256 7177c9fa582fc28e3256f8e008075ade001611fd154e8058ee2097fb86d3fc00
MD5 ca286f0147103799ca2b29f15f176cef
SHA1 86a4bcb9d9847b4193046f09b01c5bdd9b28ccab
SHA512 0dd0a4620750bf0722f37cfc18e10fe5b87ecd0225898c2906719e086295ec75ad5428ebc08d90de74f00663c86e2e6471d7e6f4894f44af836c781914970004
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T19634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicaysq.sys

Path C:\Temp\ysqkicaysq.sys
Size 141KB
SHA256 8836839fd19f2da0a6946f4f85c151dedc5703269d46c458901b88813d8d3ce1
MD5 998e6c01857d0c3230d92f5655656619
SHA1 4f684b78bcabeeebf46754bc81b6c5b2f28acd20
SHA512 8266596e0bbe06aed5182dc09eaa0aac93f2714057c24d9b0bb2858e7b3012ab1e900fa9e23b038429e50a94620fa1298ab389ed66c77e4e8225b1cf3cb3694f
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtqlidayv.exe

Path C:\Temp\yvtqlidayv.exe
Size 226KB
SHA256 76f069e4909d737896d68e3705998f6ab6d67a1c06a54fabf90d713ce5bcb03b
MD5 c69f5f622b8cbff0b14f0f85761d8097
SHA1 a9a3ea55d0f3689a0f7038a0d6fb26568680bbf3
SHA512 d29718053072946ae35741b4e16d059e0a63e673c16b0a91adee0775f57da328a4c2bcf7cf62994dff1a700db789f965968826e616ca1b5a7fbbcfd839772905
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1B934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2c6cfab1dda5aa259e6c153c101d4a6c4ede402188b8a4d9da1e6dda77f696e4
MD5 462d2830e6396dde28b691ac2e1ed5eb
SHA1 a11016c627a70334db1a6f94581859a1debd7f41
SHA512 d73bae7e591d7a8aa8a9dd3529e3064144c62962a519ed73d36875f430d28c9542b72081622e1eebe495265cefa7db6113feb3ab2dd1697a8770ee2fb11c9a08
TLSH
T1DC5165AD23600AF6DB25C4F390D0C4A532F645BB1E831BAA2040AD780586FD891FF8B3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598449.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598449.TMP
Size 2KB
SHA256 3ca9683797279c8ce09a3ea5fc0ddc30931d0e24e0fc20588751b35ad15075ca
MD5 e06b4de5bd282fd4e54f2d6400764de0
SHA1 a35ae05fa73f887debadfb2616ad712c600fccfa
SHA512 35375b9a9e0915ed71fc8533719e710698684b7ad0f288bee42e3c7a44d05e4caf3939ebe582c0c5e0d9fad6d075d25f3447a157566bbf133cf8469b19fba310
TLSH
T1FE5166AD23600AF6DB25C4F390D0C4A532F645BA1E831BAA20409D780586FD491FF9B3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54391415-b26a-4433-8a94-88dd60a8c6c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\54391415-b26a-4433-8a94-88dd60a8c6c1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f5e95a8a05a99b28efa5124865526e733d8a72c5833aef62c14c608bc3f4dd7
MD5 3b871f2cde467dafd93f352954cdb191
SHA1 0634c59ab9a20c409cfc91e40899fe10d60178c1
SHA512 dfaa089cf4900c05640a8e2bbd1aa8975e23eef86d484ef4c8a21d36ec64b0bd9f63f3c444ad9ca742fd62abdc639852965c926699f7039254d7ea2dd51dd79a
TLSH
T11141BEF3C3E8856E890156F0AA187E1FCE2D0915432C3D6AC9E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b72ee37370de2ed010c15c891f3ca567d11e4a8e96291f7369748a83bbd7ee2a
MD5 0e55388d2c02d38d4f6ae1090bb61784
SHA1 a22af86d38066f3b64bd1ce583e987e6c0249fad
SHA512 9048a6bd0c8397b5a47f4e2b17b19c65aa9ebf277c34864e6769195ec2d5caa704a509a5309c8adf9290c9a140674ab629a8c758af13a99274cd3b87ce445476
SSDEEP 192:sxRwRtCU/f6s+vpYZJUzoA8p9A/g6+WNCUi/YodCYEGvIgtJ:sxRw6U/f6s+BmDi/5E/4M3
TLSH
T1C232B8166D28593B5CC7D21DBE65BF53E6F91132A2D42E48A7FCCB0C14E66CD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ea40b9facd5a554ec74fc96f06a04cff3807e6d84e65b61ed8a83f37e5a54f7b
MD5 f1700f80269a696c202476493084a984
SHA1 f97e534fe5d3f2baa25aabeed841f34bdae8548f
SHA512 9b4164ba7ac69457441c942e942e1fc40c71ed9894189758b03aaf5a95e88576985802529b52429740b1adb9c2a01e2eca501b732a3c2f4849795f20ef20271e
SSDEEP 192:sxRHRtCU/f6s8vpYZJUzoA8p9A/g6+WNCUi/YodCYEGvIgD5J:sxRH6U/f6s8BmDi/5E/4MX
TLSH
T1D742B7166E28593B5CC7D21DBE66BF53E6F91132A2D42E48A7FCCB0C14E66CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 befe18b0801a484b92c21da1d337bf1539ab78df0c86442f0f7be3af2d53433b
MD5 4323a0aa7156a25a5f7bf1c71088c9b2
SHA1 4d4bcc184147b5a4106b9814c2ef36fbfab32fd9
SHA512 4cc23c229631d7453f00e99944eb841d376ea7c422424786888ed1e23ab4eec31cfb4a3415e9fccdc54dd9c8903d83c6e7ad27efdb9cbfb093595a0aa50b9082
SSDEEP 192:sxRHRtCU/f6s8XpYZJUzoA8p9A/g6+WNCUi/YoqCYEGvIgD7J:sxRH6U/f6s85mDi/5E/pMx
TLSH
T1F242B716AD28597B9CC7D219BA66BF53E3F91132A2941E48A7FCCB0C14E76CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8420d867ef5b82613cf708231a59817fcf8951522d1c7823c4fdd74dbdd6dba1
MD5 6553e4b7e408a709d8ec84aad18bb5e4
SHA1 e1e9040df113f10a709cdecf8d399d56705c478f
SHA512 d82e02fa4ead8b56384e4e734657ba30c644a677da90f29e5a2386c83925adb113e66fc50dfc5a06aa006db958783e0ef9b8ad874d0abe71fe9396fed5ba17ff
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVurBVuwMro9Xe08:j26HRUE7MRWgs2f02u1jaFrB4wXeP
TLSH
T127D2DB7B740DCABE4F800ADDED197E9F6D6802CB9698CD8047FE851C02C6BEE51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1f80.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2a35607f09b0610e7860092e2a7455b8f99b959321c21df764ff28e2be9702d9
MD5 4a00cf8894214176f2780917eba95181
SHA1 2d1dda2aca0cc9416a611da95a5ca6180a49ce7e
SHA512 047b6c7e54732a77a623da146d6ae9e12066b32b792a4156a6ad1169f2210a3e6386e4d1af09ad95de5922d66fc09df4aa9972162de0cf71cd93d9e6248936bd
SSDEEP 768:/j+9u3XxQ/TBOWhji/ONXyer1IRCzni9vb9MH:y9u3GISIqnIb+H
TLSH
T12CF2BE34A4559E238CE29396B64737C77FF821B7C6C40E84EAD96F4E09C3A6D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3abc5245fb54275b82467e52d37b48baa41a412d3cc946f9e30fcf5d4dc6978f
MD5 97fa31891c9c01a6dbdb7e3eb62fa0f0
SHA1 9e54ea3e88b363f2b408990a272f2fa6be75af15
SHA512 25fc53c6a826a279a1f9b4c0c89d318972cd42c073b4bd21eed63b88a99471cb63e847dd120c4d7bfab5a5bf6067b351308ec2360a7c6977d58edb27cb83fa38
SSDEEP 768:JmF1j+9q3VwgsbjxsOWhjiCONXyer1IRCzni9vb9MH:JT9q3qMSIqnIb+H
TLSH
T14D1328F594D78A32D89E4387B73E2E869EBCD163B5844984BBC55E4DCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ff6564287d82395e511420d1fd291210c0f7e0c9f724d0231d8ce5b4bc05d35
MD5 35b9d09f4604386cf7ad30c87bbcb43a
SHA1 4ef01f2633595f03cd9ae7d8c7d6fcb49b5c9602
SHA512 fe5a2efb4b7d4ad4ac7c034d65b2c217c0c018378cd26915cdb88319744ab7bc0a55edc8a09567231a30e6fe76b2ed4d21bd67bca9b1b3fec6c4e9e903f7d26a
SSDEEP 768:hrv+4UNbdz3hN/TBOWhDONXyer1IRCzniBxeVH1SK7:hbsbV3X/SIqn6EH1l
TLSH
T1EC03CF32A4A89E338CE2A3C6B54777437FB86057C6840B90D9DE2F4E069759D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 93bea5a1f6aeb86128b4707cc880feb9a5555927c0a1573819158ff97356d5aa
MD5 815c1c7bb9f9ec1cb1d71ef84ee2698f
SHA1 77ee576550dca79e9f13866e22a65d376ef94f4f
SHA512 ffc847fc413572231d4b34daa1e68e4ad3a4bb02e193f0e265add69bf4cb16a3cbfc314d3386a9f9fc704c328d51cd0db014c4394ac83e48e3497ebdbc79d38d
SSDEEP 768:mj+9u322Q/TBOWhjixONXyer1IRCzni9vb9MH:19u32wSIqnIb+H
TLSH
T196F2AF31A4559E238CE69396B64737C77FF421B7C6C40E84EAD96F4E09C3A6D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b9b92025e07c3a9d3ed24462680b4feb2391c3cabdcda20beac074683942889a
MD5 af1424f605d19387276d185af0c46e3e
SHA1 080b066a0256975876aaf3ecf54dc4ae12ee222d
SHA512 9c6d482abf8d9ce16598554d491af86011ae5ba6bddc9db1f8cd5c1c562ab79717d46c12a40321a302480b387b1c561810b8b0d7d796120fde257a4e734ea7a4
SSDEEP 768:Tj+9u3X2Q/TBOWhjixONXyer1IRCzni9vb9MH:29u3lwSIqnIb+H
TLSH
T114F2BF35A4559E238CE29396B64737C77FF421B7C6C40E84EAD96F4E09C3A6D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

1da034ca-5b96-439a-b0a1-479c40f9e87d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1da034ca-5b96-439a-b0a1-479c40f9e87d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4644_2034114151\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/588-300-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/672-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1076-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1420-174-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2100-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2140-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-354-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3468-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3504-304-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4512-249-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-221-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5052-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5340-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5576-365-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5692-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5696-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download