1447f560efb3fa48dccc8987e43fcca96c4b1f3e6f461aee4a4ac06b968e396a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260720-bdz6jsdv2s
SHA256 1447f560efb3fa48dccc8987e43fcca96c4b1f3e6f461aee4a4ac06b968e396a
MD5 8bd03de6afd0d679045fa4e4c9c8b162
SHA1 112e173207c1e17a678e25204df3e6455bc8fa9d
SHA512 4de6c67e246c607d5c0d1592d055f74e13a896e2eb30ba4078980321ea42b395b8cfe3b50ec3ec3b9172c8b9879c04b75d22b26e3c8af68b4af3cb5e36710fae
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
572	CP.exe
4776	xspkicaupm.exe
4764	CP.exe
3816	CP.exe
4136	i_xspkicaupm.exe
4652	pkhcausmke.sys
1348	CP.exe
5956	hecwusmkec.exe
1196	CP.exe
624	CP.exe
2684	i_hecwusmkec.exe
3908	kecwupezwr.sys
1996	CP.exe
992	wurmgezwrp.exe
5384	CP.exe
5976	CP.exe
2944	i_wurmgezwrp.exe
5408	bztrmjebwu.sys
2936	CP.exe
4988	ywuomjetol.exe
3588	CP.exe
4216	CP.exe
1116	i_ywuomjetol.exe
5016	ztrljdbvto.sys
1212	CP.exe
1408	ljdbvtolge.exe
1076	CP.exe
4344	CP.exe
4476	i_ljdbvtolge.exe
2584	idbvtnljga.sys
1352	CP.exe
920	gaywtnlida.exe
3672	CP.exe
2556	CP.exe
5408	i_gaywtnlida.exe
5840	idavsqoiys.sys
4360	CP.exe
6040	vsqkidavsn.exe
1140	CP.exe
5888	CP.exe
5520	i_vsqkidavsn.exe
1872	idavtnlfdx.sys
4768	CP.exe
4140	faysqkican.exe
5008	CP.exe
5524	CP.exe
5648	i_faysqkican.exe
4612	caxvpnkfdx.sys
5584	CP.exe
5400	xvpnhfaxsp.exe
3016	CP.exe
4624	CP.exe
3464	i_xvpnhfaxsp.exe
2392	rpnhfzxrpk.sys
3012	CP.exe
5884	mkecwupmhf.exe
5876	CP.exe
6108	CP.exe
3632	i_mkecwupmhf.exe
4944	rmjhfzxupm.sys
5416	CP.exe
1976	kebzxupmge.exe
5372	CP.exe
2460	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_338758218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1420257679\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1987863191\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1420257679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_817148333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_817148333\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1987863191\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1987863191\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1987863191\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkican.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomjetol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kebzxupmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqcausnkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicaupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomjetol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkifdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kebzxupmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqcausnkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxspnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxspnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicaupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkifdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkican.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4784	ipconfig.exe
6136	ipconfig.exe
5840	ipconfig.exe
4336	ipconfig.exe
1400	ipconfig.exe
4264	ipconfig.exe
2304	ipconfig.exe
4540	ipconfig.exe
816	ipconfig.exe
3452	ipconfig.exe
3140	ipconfig.exe
1452	ipconfig.exe
5520	ipconfig.exe
2368	ipconfig.exe
4172	ipconfig.exe
4336	ipconfig.exe
5052	ipconfig.exe
2764	ipconfig.exe
5784	ipconfig.exe
5784	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289829533228907"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{0DC7F26B-6434-4E32-9C95-8360E3808457}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	i_xspkicaupm.exe
Token: SeDebugPrivilege	2684	i_hecwusmkec.exe
Token: SeDebugPrivilege	2944	i_wurmgezwrp.exe
Token: SeDebugPrivilege	1116	i_ywuomjetol.exe
Token: SeDebugPrivilege	4476	i_ljdbvtolge.exe
Token: SeDebugPrivilege	5408	i_gaywtnlida.exe
Token: SeDebugPrivilege	5520	i_vsqkidavsn.exe
Token: SeDebugPrivilege	5648	i_faysqkican.exe
Token: SeDebugPrivilege	3464	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	3632	i_mkecwupmhf.exe
Token: SeDebugPrivilege	5860	i_kebzxupmge.exe
Token: SeDebugPrivilege	932	i_uomgezwrmj.exe
Token: SeDebugPrivilege	3404	i_rljdbwtolg.exe
Token: SeDebugPrivilege	2812	i_ywqoigaytq.exe
Token: SeDebugPrivilege	1116	i_vsqkifdysq.exe
Token: SeDebugPrivilege	1392	i_sqcausnkif.exe
Token: SeDebugPrivilege	2840	i_icaxspnkfd.exe
Token: SeDebugPrivilege	2516	i_kfcausmkfc.exe
Token: SeDebugPrivilege	2796	i_pmhezwurmj.exe
Token: SeDebugPrivilege	1392	i_ezwurmkecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4928	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4928 wrote to memory of 5368	4928	iexplore.exe	90
PID 5368 wrote to memory of 5640	5368	msedge.exe	91
PID 5368 wrote to memory of 4316	5368	msedge.exe	92
PID 5368 wrote to memory of 2760	5368	msedge.exe	93
PID 5368 wrote to memory of 4316	5368	msedge.exe	92
PID 5368 wrote to memory of 4316	5368	msedge.exe	92
PID 5368 wrote to memory of 3864	5368	msedge.exe	94
PID 5368 wrote to memory of 3864	5368	msedge.exe	94
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 2696	5368	msedge.exe	98
PID 5368 wrote to memory of 2696	5368	msedge.exe	98
PID 5368 wrote to memory of 2696	5368	msedge.exe	98
PID 5368 wrote to memory of 2476	5368	msedge.exe	99
PID 5368 wrote to memory of 2476	5368	msedge.exe	99
PID 5368 wrote to memory of 2476	5368	msedge.exe	99
PID 5368 wrote to memory of 3516	5368	msedge.exe	101
PID 5368 wrote to memory of 3516	5368	msedge.exe	101
PID 2676 wrote to memory of 572	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5368 wrote to memory of 5624	5368	msedge.exe	105
PID 5368 wrote to memory of 2960	5368	msedge.exe	104
PID 5368 wrote to memory of 5624	5368	msedge.exe	105
PID 5368 wrote to memory of 2960	5368	msedge.exe	104
PID 5368 wrote to memory of 1524	5368	msedge.exe	108
PID 4776 wrote to memory of 4764	4776	xspkicaupm.exe	109
PID 5368 wrote to memory of 5840	5368	msedge.exe	112
PID 5368 wrote to memory of 5840	5368	msedge.exe	112
PID 5368 wrote to memory of 3068	5368	msedge.exe	113
PID 5368 wrote to memory of 3068	5368	msedge.exe	113
PID 2676 wrote to memory of 3816	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 2676 wrote to memory of 1348	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5956 wrote to memory of 1196	5956	hecwusmkec.exe	122
PID 2676 wrote to memory of 624	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2676 wrote to memory of 1996	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 992 wrote to memory of 5384	992	wurmgezwrp.exe	131
PID 2676 wrote to memory of 5976	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 2676 wrote to memory of 2936	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4988 wrote to memory of 3588	4988	ywuomjetol.exe	140
PID 2676 wrote to memory of 4216	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5368 wrote to memory of 940	5368	msedge.exe	146
PID 5368 wrote to memory of 4172	5368	msedge.exe	147
PID 5368 wrote to memory of 2900	5368	msedge.exe	148
PID 2676 wrote to memory of 1212	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 1408 wrote to memory of 1076	1408	ljdbvtolge.exe	153
PID 2676 wrote to memory of 4344	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2676 wrote to memory of 1352	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 920 wrote to memory of 3672	920	gaywtnlida.exe	162
PID 2676 wrote to memory of 2556	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2676 wrote to memory of 4360	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 6040 wrote to memory of 1140	6040	vsqkidavsn.exe	171
PID 2676 wrote to memory of 5888	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 2676 wrote to memory of 4768	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4140 wrote to memory of 5008	4140	faysqkican.exe	180
PID 2676 wrote to memory of 5524	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 5368 wrote to memory of 4196	5368	msedge.exe	185
PID 5368 wrote to memory of 4196	5368	msedge.exe	185
PID 2676 wrote to memory of 5584	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 5400 wrote to memory of 3016	5400	xvpnhfaxsp.exe	193
PID 2676 wrote to memory of 4624	2676	2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8bd03de6afd0d679045fa4e4c9c8b162_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffac4f0c188,0x7ffac4f0c194,0x7ffac4f0c1a0
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,12544206407233285443,3874076754186943174,262144 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,3143676330608161547,15259166499717960126,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
      4⤵
      System Time Discovery
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,5743808818513355289,3391822564992118051,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:13
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,11561868728815464763,2484115952267091819,2097152 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,3943372681831334487,13545281494048404616,2097152 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,823124571749178047,13135035331421858721,2097152 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,9354401470672943121,9684164066777824676,2097152 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:9
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,9075611918930889988,1813039434092424445,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,7031084454502106636,3312983312654853869,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,894751074984942273,16873163867533844595,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12590660202319397371,9963346048057606235,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,12590660202319397371,9963346048057606235,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:1524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,17179581671749758863,7687895435867164972,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,6503722876743442136,9028038949860445617,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,898241711978008692,4993182114451160839,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,17724974251190936471,5862951350139411766,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,11796245773634015898,3367761476631812069,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,11910899422267910374,14245465224826946679,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,11493794984410523135,9397750128042027762,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,12055200269811411359,15461919602035691801,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,18150802022064731467,12619872791332443138,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6460,i,10042345862671573501,12885960794413474900,262144 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1192,i,17438625480872771554,18356279143789352773,524288 --field-trial-handle=2284,i,4737693220826126201,14508670326017102085,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:14
      4⤵
      PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicaupm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:572
- - C:\Temp\xspkicaupm.exe
    C:\Temp\xspkicaupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicaupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\i_xspkicaupm.exe
    C:\Temp\i_xspkicaupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1348
- - C:\Temp\hecwusmkec.exe
    C:\Temp\hecwusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:624
- - C:\Temp\i_hecwusmkec.exe
    C:\Temp\i_hecwusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurmgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1996
- - C:\Temp\wurmgezwrp.exe
    C:\Temp\wurmgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurmgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5976
- - C:\Temp\i_wurmgezwrp.exe
    C:\Temp\i_wurmgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomjetol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\ywuomjetol.exe
    C:\Temp\ywuomjetol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomjetol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\i_ywuomjetol.exe
    C:\Temp\i_ywuomjetol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaywtnlida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1352
- - C:\Temp\gaywtnlida.exe
    C:\Temp\gaywtnlida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaywtnlida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\i_gaywtnlida.exe
    C:\Temp\i_gaywtnlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkidavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\vsqkidavsn.exe
    C:\Temp\vsqkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkidavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\i_vsqkidavsn.exe
    C:\Temp\i_vsqkidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkican.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\faysqkican.exe
    C:\Temp\faysqkican.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkican.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5524
- - C:\Temp\i_faysqkican.exe
    C:\Temp\i_faysqkican.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5584
- - C:\Temp\xvpnhfaxsp.exe
    C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\i_xvpnhfaxsp.exe
    C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6108
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kebzxupmge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5416
- - C:\Temp\kebzxupmge.exe
    C:\Temp\kebzxupmge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kebzxupmge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\i_kebzxupmge.exe
    C:\Temp\i_kebzxupmge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwrmj.exe ups_run
  2⤵
  PID:1552
- - C:\Temp\uomgezwrmj.exe
    C:\Temp\uomgezwrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwrmj.exe ups_ins
  2⤵
  PID:2884
- - C:\Temp\i_uomgezwrmj.exe
    C:\Temp\i_uomgezwrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  PID:2904
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  PID:988
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  PID:5432
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  PID:5296
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkifdysq.exe ups_run
  2⤵
  PID:5608
- - C:\Temp\vsqkifdysq.exe
    C:\Temp\vsqkifdysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkifdysq.exe ups_ins
  2⤵
  PID:5780
- - C:\Temp\i_vsqkifdysq.exe
    C:\Temp\i_vsqkifdysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqcausnkif.exe ups_run
  2⤵
  PID:1332
- - C:\Temp\sqcausnkif.exe
    C:\Temp\sqcausnkif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqcausnkif.exe ups_ins
  2⤵
  PID:5272
- - C:\Temp\i_sqcausnkif.exe
    C:\Temp\i_sqcausnkif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaxspnkfd.exe ups_run
  2⤵
  PID:3328
- - C:\Temp\icaxspnkfd.exe
    C:\Temp\icaxspnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaxspnkfd.exe ups_ins
  2⤵
  PID:4820
- - C:\Temp\i_icaxspnkfd.exe
    C:\Temp\i_icaxspnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausmkfc.exe ups_run
  2⤵
  PID:4940
- - C:\Temp\kfcausmkfc.exe
    C:\Temp\kfcausmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausmkfc.exe ups_ins
  2⤵
  PID:5320
- - C:\Temp\i_kfcausmkfc.exe
    C:\Temp\i_kfcausmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezwurmj.exe ups_run
  2⤵
  PID:3836
- - C:\Temp\pmhezwurmj.exe
    C:\Temp\pmhezwurmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezwurmj.exe ups_ins
  2⤵
  PID:5420
- - C:\Temp\i_pmhezwurmj.exe
    C:\Temp\i_pmhezwurmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwurmkecw.exe ups_run
  2⤵
  PID:1100
- - C:\Temp\ezwurmkecw.exe
    C:\Temp\ezwurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwurmkecw.exe ups_ins
  2⤵
  PID:3888
- - C:\Temp\i_ezwurmkecw.exe
    C:\Temp\i_ezwurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1780

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\kecwupezwr.sys
C:\Temp\kecwupezwr.sys
1⤵
- Executes dropped EXE
PID:3908

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
- Executes dropped EXE
PID:5408

C:\Temp\ztrljdbvto.sys
C:\Temp\ztrljdbvto.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\idbvtnljga.sys
C:\Temp\idbvtnljga.sys
1⤵
- Executes dropped EXE
PID:2584

C:\Temp\idavsqoiys.sys
C:\Temp\idavsqoiys.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:1872

C:\Temp\caxvpnkfdx.sys
C:\Temp\caxvpnkfdx.sys
1⤵
- Executes dropped EXE
PID:4612

C:\Temp\rpnhfzxrpk.sys
C:\Temp\rpnhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\rmjhfzxupm.sys
C:\Temp\rmjhfzxupm.sys
1⤵
- Executes dropped EXE
PID:4944

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
PID:2408

C:\Temp\trljebwtom.sys
C:\Temp\trljebwtom.sys
1⤵
PID:4584

C:\Temp\jdbytqolgd.sys
C:\Temp\jdbytqolgd.sys
1⤵
PID:4148

C:\Temp\ayoifdbvtn.sys
C:\Temp\ayoifdbvtn.sys
1⤵
PID:240

C:\Temp\axvqnigays.sys
C:\Temp\axvqnigays.sys
1⤵
PID:3780

C:\Temp\nkfdausqni.sys
C:\Temp\nkfdausqni.sys
1⤵
PID:240

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:3720

C:\Temp\xrpjhfzxuh.sys
C:\Temp\xrpjhfzxuh.sys
1⤵
PID:4852

C:\Temp\bzxrpmhezx.sys
C:\Temp\bzxrpmhezx.sys
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebwu.sys

Path C:\Temp\bztrmjebwu.sys
Size 141KB
SHA256 aa85ba1d1efd7d65b2aa1dbc4fe17e883593b57050f07b3a15caeeab53d63854
MD5 195ac70881e8bfb26f6e239b56196367
SHA1 92b0b3c348054a2e77c0ffcb87a68dacdd656e4b
SHA512 8753d5a262a8b11eaa245882d48f32a427638e640ea7bff43cd19f69ecddec3c813d193b107dcd7e4bc3d906c07dd8052c4f1b776b26838db37806b1e7d2a259
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37D12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaywtnlida.exe

Path C:\Temp\gaywtnlida.exe
Size 226KB
SHA256 07cd352141e66de8242717d0027af4899b3f8ed4c58f201f5b4f5b5d98ee4f71
MD5 bc7d2f9fbab3454486656ad8a24d981e
SHA1 84bbac41729bb7b124c167da8b004dd37573ba45
SHA512 dbab68808879a9fbee21bf668f0baaa4c7b97f8a7b7da1608cfe4e7390ac6c4302e26d7a5fd724e0321583573873539be29375895f9672d28854b67ca9d9261d
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T1A934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwusmkec.exe

Path C:\Temp\hecwusmkec.exe
Size 226KB
SHA256 ef66889514b0eb8309993c388d99dd70eb6f50d10d0308ef387bedd198a01d1a
MD5 4a50729260bd090b363b6933c4fe6cae
SHA1 a15eb4239695371dae07a6c2b8a26dfe2e68c4fc
SHA512 c7c04d6bb72f35cb5ecdde611201e844c74c37d6b9d2cc87b0c3c095d82bc2460f10f3ae1fe0129a6799f9af402aff577f20d834f2e4fccc5587c6543606bceb
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaywtnlida.exe

Path C:\Temp\i_gaywtnlida.exe
Size 226KB
SHA256 7e437651fbe5c3443e56949c44fc94d2245294795801d627aba4fb8e7947d451
MD5 e8c342d33b714c6e691058885da9bca1
SHA1 707371d6f0a1b1ed76600bf1ca4ee3f655fa1fea
SHA512 7b31b0c554b55a28e03fc48b5e97625be5f99e7c5e721ef41822c0197614602b9878bd19c5a97053dd1bdfbaec4b7dd81ef220b4c9c57cb17386149992481ddb
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T12B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecwusmkec.exe

Path C:\Temp\i_hecwusmkec.exe
Size 226KB
SHA256 59cc91f83654d4c0ff88bde535b6aa56682e0d71e29dd78d861cae86fb30031e
MD5 5a23fda4a4e42df693c5ac622a294eec
SHA1 9cba2a60776ca1626cfadb1841c1f4db44b41789
SHA512 28aefdc26ff6d285ccd7d716a92b9f6aa14f61cd09225961861469bf48f5ae80d7c3feafe527d400618b1619efeef65ee04705b45b1a52609600fc079debfb12
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtolge.exe

Path C:\Temp\i_ljdbvtolge.exe
Size 226KB
SHA256 cf82807f8fa630c52250ac43ed368c8e2146f05217481b172d85f224e4bfed97
MD5 d97fd995da4a927173afbc1ae9c8caa5
SHA1 2d063f13d2f01f7c448700291c288a89c550e593
SHA512 4df2424f707b0e72848de3276ab8a33815edb6cd01ce1647c45b16d3db1a491a24a6066f4faf159a0a0e95d528ffb6060be7f8bbaf3cc482b737dc9aae127498
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1F634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wurmgezwrp.exe

Path C:\Temp\i_wurmgezwrp.exe
Size 226KB
SHA256 b18370c595029dc2c63a68f7b2b4d1bb6144f28d68de181271b17e317da88f16
MD5 75cf70e11e8ed7b6f7f11f045e0be38e
SHA1 d31accbab1f38d77cd9fa68ca2644b4a4795d7b4
SHA512 03bba536e5b9b08885fd503d2d372be2e9afb6d45d09575d5b002a052996ece954db78cf164a4bf0767a292b634699946b1ce14cc52492f35bef84d8bb00bfb7
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicaupm.exe

Path C:\Temp\i_xspkicaupm.exe
Size 226KB
SHA256 d72b21c30ff3f139f1ef2f310f4550019d7971fc8c7321f535259961ccab413c
MD5 b30aa14d4f5280e1641d3e89daca9dd9
SHA1 27e4f7de8f93c32580ab55abc2636c64ca69092a
SHA512 73a5867ce14d95476e5472bd267f2e341aac23cfc307fa2ef4f72ce2dbac41f49e6a393b8913372adaaaf8c3bf2fd1e4e9a67981f03f72af6f04bc64a608b6aa
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T17D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywuomjetol.exe

Path C:\Temp\i_ywuomjetol.exe
Size 226KB
SHA256 fa5ae9ade4881122a5afefeb7ce7db6f5676f5e5000768011edb653601fc7b31
MD5 d041559ff5196d0fdff6a7b0a5df10c3
SHA1 f746ad468af8a630d63c8c9e1069ecadb757ed2b
SHA512 bf17b671666363ba7cb77456c0d92bf3f328596a1b72b10e6090bde4477f21b43a5f33090df93860c75217aad68f4cf0eaa90f3e14ec5efaa0b48233bd3ad52b
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavsqoiys.sys

Path C:\Temp\idavsqoiys.sys
Size 141KB
SHA256 2883d4f1bed97bc5bae04edafc440b1de268c72ee30f510f6ccfb4f604ad15e1
MD5 460b7e5d71529e51e29e2244d6795f5f
SHA1 4540abba13b02558c20682a961cb0d14729ed188
SHA512 9ea55b786b1eea5e82a4895245f16597611c545edb4c59acaeea5fda75b0719cc2e7c93c978510d0403267ca31f7323cdf1fda9a3a16e6a58c47cc6ad16dd3f6
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnljga.sys

Path C:\Temp\idbvtnljga.sys
Size 141KB
SHA256 2abf6113d40a4bacc7d07778c0421ae89facfb537f627c0bafd9ea45ec82a126
MD5 8e9a6182d408eba214b5e07a51a261b7
SHA1 1380151101aa7385e1f305a4568cc9feb841e32d
SHA512 d74508b7e925a41cca8e5be14263acd2a59d44c7e6972a1c5c521623b6b48af55fd1505f5df23071ce6f306348e16274799c17eeaa0312d69fa587076164ef89
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupezwr.sys

Path C:\Temp\kecwupezwr.sys
Size 141KB
SHA256 cd9ee53242fae3c5eb427b5eb51741826348ec489fc2743694343e46534c2a3f
MD5 74178c4392e84ddb919fd893bfb1992f
SHA1 c462c94d425dbe788b13f6b1b9c21c8950f3cff8
SHA512 b038ac546b08494a669e60b7e98e44a7b9e3f434a219f825e4a8a8bada475e37cee7601e1cc010f62a5aeceb07e958f2425af7aa4a9e803fd4036c8a49990dc5
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ABE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.exe

Path C:\Temp\ljdbvtolge.exe
Size 226KB
SHA256 368bf3831f3b06d89e1f83b862dc9d954105f9d0d6c433bf337bf8a8e72fe012
MD5 5c443571a48c8b04904eda7771e012a5
SHA1 6a4e3c4f07ff270bb2782e40ff28f5c648156022
SHA512 768bae479ea4d45b40810ca414f615320fc83deeb3fe3b1e35a946c750fea1a5b1907a40c506cef5cab5f1ada0c19717d3ccd88efeae383e10b8c060af03be8e
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.sys

Path C:\Temp\pkhcausmke.sys
Size 141KB
SHA256 fc7c1c1ea74aadb7c4fb6586cd9d414e2a634b5565bbe5a77bb073e81a622b9f
MD5 b09d8134b653b4967f602b4c3f91d8a2
SHA1 b4f049f6aafc39d0db5fe7f8acd652abba2838b6
SHA512 bcc3451aa5865ae3a5a4d319fe2fcb5c2dc4ca9b29d1f606e9a7e2868ac38241615faaae1c7e3606127845cfba6fe94987b1d9198e59d544ba75ab18ac1368a7
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmgezwrp.exe

Path C:\Temp\wurmgezwrp.exe
Size 226KB
SHA256 7d6320b9540cfddb45a2f3eebe8e3e769d520a018be7d1241431b2b0b7216de1
MD5 3da85223512dd04c8a47d0ada3eee066
SHA1 db445ef90bcea244b02d879a830a5848d1cd6873
SHA512 14da98c83e2cb1254b48773d572bf30d693d70cb952b58e1a8cb8ef7f1d265af9e7642db5f1bc48a7505c66692eb72989efc8505e9827acb847fea685c7e8eee
SSDEEP 3072:rrGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:eXY4LK+a3lLNngoqRttA7
TLSH
T1C534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicaupm.exe

Path C:\Temp\xspkicaupm.exe
Size 226KB
SHA256 40a814bdfacb928d38c7a9baa3fa8fec52209a2203aae442c96f1b0edc643533
MD5 4d4122baa4f54bc86b0d2bd6bcb38255
SHA1 a28133aacff9a105a24e55f04843da500f7f201d
SHA512 5e1285e2ad36ad62505c1d0778ac2cffb3d317d239bc83e28bdebbdd0d2c58189d53f29aa258474fc1460be501293e58e874389f884501af014f984abf7117fc
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywuomjetol.exe

Path C:\Temp\ywuomjetol.exe
Size 226KB
SHA256 73404262bfca7ce0a692dbfbe4953f0deb403b3652871d35ad43875396c1b0a2
MD5 d2f9e1456300b2579c13191466d4ead9
SHA1 fb6672702d5cde07b0d66eb09c1faefcaa6ee788
SHA512 7d23161ce8b5b257f5eb16edb07bf7ca81ba9012887b6f5de348be92d8d49b76ebe386b5825475c025e97e297bb6ce6f91f088fac926fe04b9791b293cb46f12
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbvto.sys

Path C:\Temp\ztrljdbvto.sys
Size 141KB
SHA256 e1bfa4e76ef1bc69ce4469eab53a947406bac0c65bfda2e302ebc240426acb4f
MD5 450396b248f7ed76d0fd4cd73f345af5
SHA1 5303ee2af29ce3bab17aae9408d9bed2c387ab7a
SHA512 39af59eeaa133630530dd9ca2b9067d2a4d31ac83e0cd4bf4548b5e59ca803a911b3c4ba8af6f4b2a6fa8ec744c1b1311afb9d21211a03085765f5f7115f0e73
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 521fa4a593ecf03efdfa1aef7f2eb21d61608774a9638af8fe8dcaa90055cf1c
MD5 ffebce4ffbc983de09f386df067fd362
SHA1 dc7a62787adc0585d40cee5e46f721ada63b386c
SHA512 f64e02ad64103036ba851b4dc384988585cdf4b93c7b19b20ef8d7832b639e84215fface59ab969efb5ac609c55ea954e0361b6eb6af2b7f83478af71eab85a0
TLSH
T1A95122F7E3EFCED1CF5544BF60E2E5D43238895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594646.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594646.TMP
Size 2KB
SHA256 0dacf4c110dc4a1a1aed33496227cbfa138b8d408ffc5bcb9ec78bcd77d72f8e
MD5 afe7d39bdeb995f112e4d5ea2ae4d485
SHA1 16b7ac496bd5fd5efed609d97366e7c4b427a909
SHA512 3d44da6c4af6b3cfb60c3d62cf7d16c771d700efb6f769b870bec7a21e028b2c4dd5403e330c32a4c754c9a39f8e30d05d0646c708739e404e668d9768af7753
TLSH
T10F512FF7E3EFCAD1CF5644BF60E2E5D43238895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 54286431410e83c5bc6c58990789055e4eded66cebbba531dc7f199456897d0a
MD5 831b9d08fa2edfc51bbf4cc8cb22f41e
SHA1 3b575f6b127dc09ff30dec821ee5a94ab221a97d
SHA512 51e4de09f4c5ec659596a32b693db93a7671270c015d4db791ebbf6f44cb59b3e46985b445d5e725e212045b0115fcae7e4c0ac0641f3b29631d443079c9457e
TLSH
T110419EF3C7F8866E8A0155F4AB187E1BCE1D0954832C3D5AC8E4AE1BA3E3471D18195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d98a34566e67900e36f93f058fed9cd3f602d815130b62fd1303983a2fb31f25
MD5 c29ed530a0fb770da611cc6555c0c4ec
SHA1 eb96b3a5ff68adefe70b1e709000778e3e289fc5
SHA512 ab975736db8aac08c2cfa2a99421ca55c2399808e312866f5f0c796dfdb30a855f969e239c3f35dfdf6b086da659d76a134d58c060feb55f40c56fe82ce95eb9
SSDEEP 192:sxRuprC9/fmsCg0bZ6f0zoA8p9ey/g6+WNCie/YZ7tKsvGPIgVyJ:sxRupe9/fmsCg0VqVP/5e/Kak
TLSH
T17442A616A928993B9CCBD21DFB55BF53E6F95062A1D41E48ABFC8B0C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b16a1ed1f3f9d9115efd366e7687173708486a9593f71b827862ca55df8a0a26
MD5 ec811d20f704ace7972a03d51d34951a
SHA1 a542a4f0ada298b2221709a38564c3598247fafc
SHA512 dc2bc323cc297335bbfc13fd9282a6100daa44bf0041cdd9a30ff7ce93e07984b5c5e39286be0f718806cf97ea855d7e2707e2f7d575c5030a8b437467699301
SSDEEP 192:sxRuyrC9/fmswgGbZ6f0zoA8p9ey/g6+WNCie/YZ7t9svGPIgD6yJ:sxRuye9/fmswgGVqVP/5e/LaZ
TLSH
T1BC42B816A928997B9CCBD21DFB557F53E6F85032A1D01E48ABFC8B0C04E76DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f9aa7909f2d28b35aafffd61638d14446b1c354e02fbea46a2a6c1c8f3f572f0
MD5 68ee3618ee4ef63ce8892a1879bee980
SHA1 c97b03603eebab81de6766216e5ca387263721f2
SHA512 cfa9138cd344e5ff92aaa8b73cb7bcf9d281ce4cbd6dc49ce1e912fc134dbf765dea59e5996a33f965bc224494ca4a01b230277d63ae7c514ec7f0ced18c4d6a
SSDEEP 192:sxRuyrC9/fmswg0bZ6f0zoA8p9ey/g6+WNCie/YZ7tKsvGPIgDYyJ:sxRuye9/fmswg0VqVP/5e/Kav
TLSH
T15C42A616A928997B9CCBD21DFB55BF53E6F81062A1D41E48ABFC8B0C04E76DD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e2879097cc2f233f1d511c1bf01f84ae5375d51a1863ca0dda605f2d0a586d72
MD5 14546eb11fb02d61898a2b1336085e1d
SHA1 2761e9c2e414a41f80cddcc63c6d1707228318ab
SHA512 98cb5ff79a810884f09995c5a71467b3eb6419a12e53d2017b4ba314c9741a194c306a46ca96c381f317d92a966ed89cbdf8ce6bde866af8e60b422ce9b4eebe
SSDEEP 768:ky2SFS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZ0dSV4DroE+G:ky2SFqE7evWgd5f/bu1ja+0dU4wTG
TLSH
T11BD2DA7B640CCB7F4F804ADDA8197E9E6DA802CB96D8CD8047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1b6af97e8e4cc0987e90e3a8856eeacf4bb58d039cb3e2be3755b38aff3f33a2
MD5 f3a88f1c7f8678c3b37334d07d755c6b
SHA1 ecfea2ec05c0590a604d1b342e34b6f4c458f3b5
SHA512 9b1175df483fd85008d3b02c68419740d699f688dec0c02e5678e7ea86a2a8018398bbc800b0cf77ace89d736ec61f12fb7ec2c678b04597d2ef830fb95ddace
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKticQg9gOgRgtgvgLgngk3gLgIT:KIB2KysCqUgKti7LqKcsO2HKrnR
TLSH
T1A291B552727B4600387F2D09EA54D66AD6C1B1B7301AA52B3BEC00B51F6EF069DFC6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aadbd3e0-72f6-4e47-99ce-a91acd41f5a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aadbd3e0-72f6-4e47-99ce-a91acd41f5a5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a0a1e61924775d58a31d9bc38211f3f3067b6bb3c84d2bd1088f25750a3db13a
MD5 66cc0008db6fb5a81c634654989e5e32
SHA1 8a5077a6c66cc04f1c8cedfec2d946ff805fcb5c
SHA512 42675147cec04bb95c54b10973f5fc71310a3a8ff19d1b8b09fc806cd5de05bf2db695a93b3539c589921e49b97c8898260bedb190587f693d57e79ac9848492
SSDEEP 768:NHj+943D9dZq5OAam6aQMGdjWca4Ghf9FQd:Nq943ogmaME6pFc
TLSH
T152D29D3058699D779CAB9695F32B37C7BEF011B388C40E44DAE95B0D029719E270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5dba1861fcf0b982f59a1c3fba4918f3031a97bf34a08fabfddc1c92c74df455
MD5 90084309b9d4a3fcb6c7a755818d0370
SHA1 2bcffc8908f1529eecfd97ba76128ae938a436c8
SHA512 b25954f205465751efaa2c6b388e9fcde3eb5ca4d968881468d826b3ba2a0804786d4e90308ff20abc442abfef798b03f2a5a11c7127ecedf404dafe2611d5e8
SSDEEP 768:/rv+4UNbdq36Jq+AAam6aQMGdjWca4GhfBPPeU/:/bsbc3MKmaME6pXH
TLSH
T1FBF2BE31A87C9973DDB79A99F21B6787BEB021A385D40E80DAD91B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 51269eb72d0c4ac87e1603801f7c911d31d094207c90285c2243fecd5481a0f0
MD5 227411e21b537abfdde259770fd84963
SHA1 f22d410d75a80f3fead436ff25ebbeafa7c96473
SHA512 07d267eabc6c61923de92fe3f697bb38b6e844a196914c418b526c48679b0bdc282a70cfb86f66f48cd8d33dd3ee62a9f5138fe5c625caf34b96a9bdaa1a85e5
SSDEEP 768:x6rv+4UNbdy3d9VZq50Aam6aQMGdjWca4Ghf9FPxUQ:x6bsbk3uWmaME6pFx
TLSH
T16DF2AE31A8B8DD339CB79295F21B3683BEB411A388C40E44DAD95B0D06974DE370BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6313435642abce26def328329b99905b6d04c7b94dd2ae37071fe6f2944c0ca4
MD5 20d0389ab1cd6c299968c242754dce3c
SHA1 bdafae19107ee69c261dd9d9cc9428f2e7f95b0b
SHA512 1e4ee98b2cff3a92f0e0ffd6c40d5dcce78ffaec73c7f4f895ee5c724eac2226414703e84b0e8c6c516a9d1fa15615d9ec70be6f66f7b6e86bb0a396fbaf0923
SSDEEP 768:1wF1j+9n3Swgq9uNzAam6aQMGdjWca4Ghf9FQd:1d9n3amaME6pFc
TLSH
T1890307F198E78937D8AE4783A33E2E86A9BCC1A374885984B7D45D0CCD821BFD206915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 21ba069ac050cd627558840e13a9de8fe64e9a73bacccb579b94b0eaca7716b6
MD5 84432598a9030443a13f49d1e7bd8f0f
SHA1 63c19c03617c430c7a0e1b8e211b3ab0f7b6f5a2
SHA512 16bbf81da2eed3e09c5dd42554d880b6b0004b9379946ca7444a13d2b6359d56f4feecbb59f79c18e3fe0a2dd604f754805ef99874e7281255cf15e85a4690ab
TLSH
T12A513C6938E353FF8D792E7FEB00D6647998DDA41A63408086120AA549DB07B0C073FD
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

0a2b993d-c534-4955-9d40-9e2c3df6fd0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0a2b993d-c534-4955-9d40-9e2c3df6fd0d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5368_850647649\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/240-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1872-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2584-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3780-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3908-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-495-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4612-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4652-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4852-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4944-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5408-256-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download