1430dd583cd5d53f6ef248f64f8eb38dbc5536df99fa2a3c91751ac6abcf26e2

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260720-calz7aew3w
SHA256 1430dd583cd5d53f6ef248f64f8eb38dbc5536df99fa2a3c91751ac6abcf26e2
MD5 0d62650b228b5a1bfcebe0411ee2f6a7
SHA1 07c8d0e858de981e1d3c8196df9f2c8fe74ebbe4
SHA512 3766c37c28ef7074614d4c50e9e606ce00af920343f6512180efc747f9e0b9566f3c2e8522c81f105875d112be0dbf44a45d26ea2e07095dc79e2e342bb4db97
SSDEEP 3072:GBGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:DXY4LK+a3lLNngoqRttA7
TLSH
T1A434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2476	CP.exe
3684	omgbytrljd.exe
2296	CP.exe
5272	CP.exe
2740	i_omgbytrljd.exe
5424	tnlfdyvqoi.sys
3476	CP.exe
3896	lgdyvqoiga.exe
3532	CP.exe
5948	CP.exe
1276	i_lgdyvqoiga.exe
2664	qnifdavtqk.sys
5324	CP.exe
1692	qnifdxvqni.exe
2400	CP.exe
4132	CP.exe
1496	i_qnifdxvqni.exe
5688	qnifaxsqki.sys
2660	CP.exe
5292	axsqkicavs.exe
5976	CP.exe
5204	CP.exe
2844	i_axsqkicavs.exe
2896	caxspkifzx.sys
4828	CP.exe
4240	xspkhcaxsp.exe
5744	CP.exe
5592	CP.exe
468	i_xspkhcaxsp.exe
200	rpmhfzxrpk.sys
1952	CP.exe
5572	upmhfzusmk.exe
3732	CP.exe
3744	CP.exe
2772	i_upmhfzusmk.exe
3252	romhecztrp.sys
2636	CP.exe
1076	xrpjhbztrm.exe
5748	CP.exe
5984	CP.exe
4136	i_xrpjhbztrm.exe
4400	gecztrmjhb.sys
1872	CP.exe
1192	wrojhbztrm.exe
4252	CP.exe
2084	CP.exe
3212	i_wrojhbztrm.exe
5704	zwrojgbywq.sys
5404	CP.exe
4224	wqojgbztrl.exe
1304	CP.exe
4056	CP.exe
4528	i_wqojgbztrl.exe
4928	roigaytqoi.sys
4076	CP.exe
2236	ljdywtolgd.exe
3428	CP.exe
2624	CP.exe
244	i_ljdywtolgd.exe
5876	lfdyvqniga.sys
2364	CP.exe
2164	gdxvqnlgay.exe
1936	CP.exe
2008	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1339884112\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_427240133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1222446763\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1339884112\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1222446763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1929209995\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1929209995\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1339884112\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping248_1339884112\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdxvqnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxvsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdywtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdxvqnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxvsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgebzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgebzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdywtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausqkid.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5992	ipconfig.exe
2580	ipconfig.exe
1780	ipconfig.exe
5668	ipconfig.exe
5032	ipconfig.exe
4528	ipconfig.exe
3140	ipconfig.exe
3172	ipconfig.exe
5300	ipconfig.exe
5824	ipconfig.exe
2068	ipconfig.exe
5336	ipconfig.exe
904	ipconfig.exe
3136	ipconfig.exe
3488	ipconfig.exe
3656	ipconfig.exe
5656	ipconfig.exe
5876	ipconfig.exe
2200	ipconfig.exe
3300	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289859551606721"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{054A23B3-03BE-4D8A-A51B-31A6829B8E7B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
248	msedge.exe
248	msedge.exe
248	msedge.exe
248	msedge.exe
248	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2740	i_omgbytrljd.exe
Token: SeDebugPrivilege	1276	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	1496	i_qnifdxvqni.exe
Token: SeDebugPrivilege	2844	i_axsqkicavs.exe
Token: SeDebugPrivilege	468	i_xspkhcaxsp.exe
Token: SeDebugPrivilege	2772	i_upmhfzusmk.exe
Token: SeDebugPrivilege	4136	i_xrpjhbztrm.exe
Token: SeDebugPrivilege	3212	i_wrojhbztrm.exe
Token: SeDebugPrivilege	4528	i_wqojgbztrl.exe
Token: SeDebugPrivilege	244	i_ljdywtolgd.exe
Token: SeDebugPrivilege	5704	i_gdxvqnlgay.exe
Token: SeDebugPrivilege	4280	i_hfdxvsnlfd.exe
Token: SeDebugPrivilege	3628	i_kicausqkid.exe
Token: SeDebugPrivilege	2484	i_causpkicau.exe
Token: SeDebugPrivilege	4084	i_hczurpjhcz.exe
Token: SeDebugPrivilege	52	i_mjebwuomge.exe
Token: SeDebugPrivilege	6120	i_uomgebzuom.exe
Token: SeDebugPrivilege	5788	i_vtolgdywqo.exe
Token: SeDebugPrivilege	2992	i_nlidbywqnl.exe
Token: SeDebugPrivilege	5940	i_fdbvtnlfvq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3116	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3116 wrote to memory of 248	3116	iexplore.exe	90
PID 248 wrote to memory of 2828	248	msedge.exe	91
PID 248 wrote to memory of 4584	248	msedge.exe	92
PID 248 wrote to memory of 5008	248	msedge.exe	93
PID 248 wrote to memory of 4584	248	msedge.exe	92
PID 248 wrote to memory of 4584	248	msedge.exe	92
PID 248 wrote to memory of 2428	248	msedge.exe	94
PID 248 wrote to memory of 2428	248	msedge.exe	94
PID 248 wrote to memory of 4872	248	msedge.exe	96
PID 248 wrote to memory of 4872	248	msedge.exe	96
PID 248 wrote to memory of 4872	248	msedge.exe	96
PID 248 wrote to memory of 3592	248	msedge.exe	97
PID 248 wrote to memory of 3592	248	msedge.exe	97
PID 248 wrote to memory of 3592	248	msedge.exe	97
PID 248 wrote to memory of 3560	248	msedge.exe	98
PID 248 wrote to memory of 3560	248	msedge.exe	98
PID 248 wrote to memory of 3560	248	msedge.exe	98
PID 248 wrote to memory of 5104	248	msedge.exe	99
PID 248 wrote to memory of 5104	248	msedge.exe	99
PID 248 wrote to memory of 5104	248	msedge.exe	99
PID 248 wrote to memory of 3532	248	msedge.exe	101
PID 248 wrote to memory of 3532	248	msedge.exe	101
PID 4148 wrote to memory of 2476	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3684 wrote to memory of 2296	3684	omgbytrljd.exe	105
PID 248 wrote to memory of 1556	248	msedge.exe	108
PID 248 wrote to memory of 1428	248	msedge.exe	109
PID 248 wrote to memory of 1556	248	msedge.exe	108
PID 248 wrote to memory of 1428	248	msedge.exe	109
PID 248 wrote to memory of 1444	248	msedge.exe	111
PID 248 wrote to memory of 4056	248	msedge.exe	112
PID 248 wrote to memory of 4056	248	msedge.exe	112
PID 248 wrote to memory of 2996	248	msedge.exe	113
PID 248 wrote to memory of 2996	248	msedge.exe	113
PID 4148 wrote to memory of 5272	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4148 wrote to memory of 3476	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3896 wrote to memory of 3532	3896	lgdyvqoiga.exe	122
PID 4148 wrote to memory of 5948	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4148 wrote to memory of 5324	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1692 wrote to memory of 2400	1692	qnifdxvqni.exe	131
PID 4148 wrote to memory of 4132	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4148 wrote to memory of 2660	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 5292 wrote to memory of 5976	5292	axsqkicavs.exe	140
PID 4148 wrote to memory of 5204	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 248 wrote to memory of 2944	248	msedge.exe	146
PID 248 wrote to memory of 2364	248	msedge.exe	147
PID 248 wrote to memory of 4620	248	msedge.exe	148
PID 4148 wrote to memory of 4828	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4240 wrote to memory of 5744	4240	xspkhcaxsp.exe	153
PID 4148 wrote to memory of 5592	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4148 wrote to memory of 1952	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5572 wrote to memory of 3732	5572	upmhfzusmk.exe	162
PID 4148 wrote to memory of 3744	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4148 wrote to memory of 2636	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 1076 wrote to memory of 5748	1076	xrpjhbztrm.exe	171
PID 4148 wrote to memory of 5984	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4148 wrote to memory of 1872	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1192 wrote to memory of 4252	1192	wrojhbztrm.exe	180
PID 4148 wrote to memory of 2084	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 248 wrote to memory of 3736	248	msedge.exe	185
PID 248 wrote to memory of 3736	248	msedge.exe	185
PID 4148 wrote to memory of 5404	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4224 wrote to memory of 1304	4224	wqojgbztrl.exe	193
PID 4148 wrote to memory of 4056	4148	2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_0d62650b228b5a1bfcebe0411ee2f6a7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a0
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3315379814736611292,11468212745284443806,262144 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,5985079927293548727,15435032028696397342,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      System Time Discovery
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,5871101737867977468,797773037976143853,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,107690926177872476,13927042780904843004,2097152 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,17830052482943631330,7601307420696150904,2097152 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,10336302759031696401,7236669391151708391,2097152 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,7701359954546823771,17689648727118153371,2097152 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,12259588861887271176,690460434613604687,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,3042265706196341589,16736562845877001561,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,10952859477139438549,8363858618492421502,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9001059995660760452,17212837510031134747,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9001059995660760452,17212837510031134747,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8488838264595857345,4017153899171559691,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5609802918160251471,9189186383451141503,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,7587867817089560861,439283381542100730,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,6142663539967214273,2929721407717344637,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,386737741730603227,11121317052162118483,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,14510346624898937855,5848979852116159276,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13547524310774930820,6345596403049225299,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,2633336116551393855,17704729506479110649,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,10274281551879801309,7963288171415337771,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,9516926771061847522,2897503475284058565,262144 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,315007527192109900,4723713501424552868,524288 --field-trial-handle=2392,i,14161404987696829826,1765616303001759374,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2476
- - C:\Temp\omgbytrljd.exe
    C:\Temp\omgbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\Temp\i_omgbytrljd.exe
    C:\Temp\i_omgbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\lgdyvqoiga.exe
    C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\i_lgdyvqoiga.exe
    C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5324
- - C:\Temp\qnifdxvqni.exe
    C:\Temp\qnifdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\i_qnifdxvqni.exe
    C:\Temp\i_qnifdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2660
- - C:\Temp\axsqkicavs.exe
    C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Temp\i_axsqkicavs.exe
    C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkhcaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\xspkhcaxsp.exe
    C:\Temp\xspkhcaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkhcaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5592
- - C:\Temp\i_xspkhcaxsp.exe
    C:\Temp\i_xspkhcaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1952
- - C:\Temp\upmhfzusmk.exe
    C:\Temp\upmhfzusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3744
- - C:\Temp\i_upmhfzusmk.exe
    C:\Temp\i_upmhfzusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\xrpjhbztrm.exe
    C:\Temp\xrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5984
- - C:\Temp\i_xrpjhbztrm.exe
    C:\Temp\i_xrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\wrojhbztrm.exe
    C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2084
- - C:\Temp\i_wrojhbztrm.exe
    C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5404
- - C:\Temp\wqojgbztrl.exe
    C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4056
- - C:\Temp\i_wqojgbztrl.exe
    C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdywtolgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4076
- - C:\Temp\ljdywtolgd.exe
    C:\Temp\ljdywtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdywtolgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Temp\i_ljdywtolgd.exe
    C:\Temp\i_ljdywtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdxvqnlgay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2364
- - C:\Temp\gdxvqnlgay.exe
    C:\Temp\gdxvqnlgay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdxvqnlgay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2008
- - C:\Temp\i_gdxvqnlgay.exe
    C:\Temp\i_gdxvqnlgay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdxvsnlfd.exe ups_run
  2⤵
  PID:932
- - C:\Temp\hfdxvsnlfd.exe
    C:\Temp\hfdxvsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdxvsnlfd.exe ups_ins
  2⤵
  PID:2772
- - C:\Temp\i_hfdxvsnlfd.exe
    C:\Temp\i_hfdxvsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausqkid.exe ups_run
  2⤵
  PID:244
- - C:\Temp\kicausqkid.exe
    C:\Temp\kicausqkid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausqkid.exe ups_ins
  2⤵
  PID:3212
- - C:\Temp\i_kicausqkid.exe
    C:\Temp\i_kicausqkid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causpkicau.exe ups_run
  2⤵
  PID:5584
- - C:\Temp\causpkicau.exe
    C:\Temp\causpkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causpkicau.exe ups_ins
  2⤵
  PID:480
- - C:\Temp\i_causpkicau.exe
    C:\Temp\i_causpkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurpjhcz.exe ups_run
  2⤵
  PID:1180
- - C:\Temp\hczurpjhcz.exe
    C:\Temp\hczurpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurpjhcz.exe ups_ins
  2⤵
  PID:4196
- - C:\Temp\i_hczurpjhcz.exe
    C:\Temp\i_hczurpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  PID:3276
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  PID:5488
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:52
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgebzuom.exe ups_run
  2⤵
  PID:1812
- - C:\Temp\uomgebzuom.exe
    C:\Temp\uomgebzuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgebzuom.exe ups_ins
  2⤵
  PID:4460
- - C:\Temp\i_uomgebzuom.exe
    C:\Temp\i_uomgebzuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgdywqo.exe ups_run
  2⤵
  PID:2176
- - C:\Temp\vtolgdywqo.exe
    C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgdywqo.exe ups_ins
  2⤵
  PID:2996
- - C:\Temp\i_vtolgdywqo.exe
    C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidbywqnl.exe ups_run
  2⤵
  PID:1792
- - C:\Temp\nlidbywqnl.exe
    C:\Temp\nlidbywqnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidbywqnl.exe ups_ins
  2⤵
  PID:2204
- - C:\Temp\i_nlidbywqnl.exe
    C:\Temp\i_nlidbywqnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbvtnlfvq.exe ups_run
  2⤵
  PID:5876
- - C:\Temp\fdbvtnlfvq.exe
    C:\Temp\fdbvtnlfvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbvtnlfvq.exe ups_ins
  2⤵
  PID:5960
- - C:\Temp\i_fdbvtnlfvq.exe
    C:\Temp\i_fdbvtnlfvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5984

C:\Temp\tnlfdyvqoi.sys
C:\Temp\tnlfdyvqoi.sys
1⤵
- Executes dropped EXE
PID:5424

C:\Temp\qnifdavtqk.sys
C:\Temp\qnifdavtqk.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\qnifaxsqki.sys
C:\Temp\qnifaxsqki.sys
1⤵
- Executes dropped EXE
PID:5688

C:\Temp\caxspkifzx.sys
C:\Temp\caxspkifzx.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\rpmhfzxrpk.sys
C:\Temp\rpmhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\romhecztrp.sys
C:\Temp\romhecztrp.sys
1⤵
- Executes dropped EXE
PID:3252

C:\Temp\gecztrmjhb.sys
C:\Temp\gecztrmjhb.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\zwrojgbywq.sys
C:\Temp\zwrojgbywq.sys
1⤵
- Executes dropped EXE
PID:5704

C:\Temp\roigaytqoi.sys
C:\Temp\roigaytqoi.sys
1⤵
- Executes dropped EXE
PID:4928

C:\Temp\lfdyvqniga.sys
C:\Temp\lfdyvqniga.sys
1⤵
- Executes dropped EXE
PID:5876

C:\Temp\qkigaxvtqk.sys
C:\Temp\qkigaxvtqk.sys
1⤵
PID:2964

C:\Temp\pnkfdxvpni.sys
C:\Temp\pnkfdxvpni.sys
1⤵
PID:4104

C:\Temp\fcxupnkica.sys
C:\Temp\fcxupnkica.sys
1⤵
PID:5824

C:\Temp\fzxupmhezx.sys
C:\Temp\fzxupmhezx.sys
1⤵
PID:6008

C:\Temp\xrmkeczurm.sys
C:\Temp\xrmkeczurm.sys
1⤵
PID:1760

C:\Temp\rojgezwrom.sys
C:\Temp\rojgezwrom.sys
1⤵
PID:1448

C:\Temp\wqojgeywqo.sys
C:\Temp\wqojgeywqo.sys
1⤵
PID:5704

C:\Temp\bywqgaytqo.sys
C:\Temp\bywqgaytqo.sys
1⤵
PID:4044

C:\Temp\dbvsqolfdx.sys
C:\Temp\dbvsqolfdx.sys
1⤵
PID:476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.exe

Path C:\Temp\axsqkicavs.exe
Size 226KB
SHA256 f4b63e1d9d24f31a449bd06f863c5a5e9ea17d008aed1946e8c1be122a5afada
MD5 a2b9b00828e51fa2bf920dca163c9fe0
SHA1 bf02284f925f4eab2c6898def5252cd5a050309f
SHA512 ec4933dda5f2100946c6af8eb267d2a05acd6f5399752d984b0299a4cefc7b4e390766e137918da0294501cd9f84bfac958142633d29dae25a5695ff64d9b964
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxspkifzx.sys

Path C:\Temp\caxspkifzx.sys
Size 141KB
SHA256 ee833a7c077ef2595fbb99c9ec455f56ed6d140d0d0cb3bd389c7f332a92b902
MD5 0f895aad5a5c579c3bb3b948d9fdc2cd
SHA1 a38dd74523d9983c49896df11b32dc3e61f790f1
SHA512 aaaeadbac7300f6d565d04d0142fdd1eb8ab422dc528627b11da91ac58c47874c2577869437a1aaf0e18816d86ef048b46cf9474f35eb09ea22b78b990ec3dfd
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicavs.exe

Path C:\Temp\i_axsqkicavs.exe
Size 226KB
SHA256 9fc7e7223d2c5c2c36f9c3bd10a2b785da5825a5e978e5ac16632e202d96334e
MD5 3abf669312e2983e69426ce734203f11
SHA1 9cf204da6a9648e6c511bf40ffcdf3260e135369
SHA512 88828e42c5f48b57f606dc8dde9ea6b180ac49b24d13dc65ae48230ad69aee353001ead71edc19ffb7456b396ecc9e3b25c60cdb679947adbd9adfd7e801b6b4
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T11A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvqoiga.exe

Path C:\Temp\i_lgdyvqoiga.exe
Size 226KB
SHA256 4fcb9c6cd89c6831c4fc3f3d92b347610aca20bcab9fd5e1668f4a68e22c0693
MD5 b1b9ade4ed29d7d7fc8d2da4deca7dfc
SHA1 451d367ebc56a6e2f9565459b4288d70febd6aa2
SHA512 ce0b0f37d4681381eb551a3473922c0b8523edb1ad3d574c4fbd11808ef8107d4e82c56de80b4fe94159af366525b60367ca24754926f5215b320f31040c02a4
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgbytrljd.exe

Path C:\Temp\i_omgbytrljd.exe
Size 226KB
SHA256 f6052c46e29c4da9d7e512118209d96f95a9be0885fd168632395b5511560945
MD5 c93de89359dd71e1bc172a82ae3589cc
SHA1 1688e65b16b86f57e5b12a76978a148c7e7d7b8b
SHA512 d7b6b00e78246e0c84fbde04020b63ae73440959f03cc0d409810424166a4bbf8583159b8372e90f704ead47b3a687e258642bfd1041dece51bde52ed866e561
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1EA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifdxvqni.exe

Path C:\Temp\i_qnifdxvqni.exe
Size 226KB
SHA256 66c3facacee00814361f08ea85c147909b909255c33b0b42eaa05a1887109f02
MD5 d41196c5e58adf2136aebd9e60f6af36
SHA1 f1a7fa04ad1efdff0e544dff81df10374f6faec9
SHA512 3e876b57725d5bff6d8e87b917046fb89c2bade8b8e46d3df1913ff94d4cb0236a06c8d5554cf3e0d27136846816bcfe65e37620180059f17aa25fae0eac5ec7
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T12E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhfzusmk.exe

Path C:\Temp\i_upmhfzusmk.exe
Size 226KB
SHA256 107c51d11df9df6ac6024ab0004d2ee9d5ff79cc9f729f9a92a81e96b51932f7
MD5 b94ca09310d1263d72436fd5f6595745
SHA1 dadb9d3549c8308ba4484fb525ea931ad35aca40
SHA512 b3eae1957663caf2e49ebc84ddf73569a898aefda3fa260c82d978b167ecc19a6a9a69a8cd7db03388b5eaecd7f533246775f045366ec71a8d67e8083e1447fa
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T1E634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhcaxsp.exe

Path C:\Temp\i_xspkhcaxsp.exe
Size 226KB
SHA256 57c41a1f7230078fdffcbf86d9b0d1f45a6d86053aa3935887d6e239a2089f57
MD5 4b58cb1cd2cdd68e5deedf0a47ee4820
SHA1 8f013a8fa6f1f85df76ea643fd62cc07ee8a31f8
SHA512 ad614018eded7f64c9f03830016654883cf37e83a12920505598ac49829fd1b1fdcf4ebeae580bc100dac9ad9ef766ae71c14cb416a991e9ada64bd111c2fab5
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T10034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.exe

Path C:\Temp\lgdyvqoiga.exe
Size 226KB
SHA256 26a938c429172cd12a304880f2ce0c3953e141e0bb7cf8e74a8ff2fe67e90c3d
MD5 952707856324b479e113f8802288a487
SHA1 cec08debb3cc274f280951542fed3ed0a207ed30
SHA512 10b480675e9f66fe62ec0711098ed7537fa2824d114e67f2820d3deefb97587f662663d24df523ae738492f5001d15b12c5b1d5c97d6fb316c60f932695061b3
SSDEEP 3072:2fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:9XY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgbytrljd.exe

Path C:\Temp\omgbytrljd.exe
Size 226KB
SHA256 cce323923d90fcaf504c8d4471107121520a11f521fb64e280f61984a81a3d9e
MD5 c44784b188cac330c36ea7487ce44cb4
SHA1 bd2a07b1af932bf9d3b84e5a3627a1ffdf319702
SHA512 345e3f86af3f3c7176ae7f892d0a35ebe370afa59cd1ca14718184654d2a5361d03624d4b10191ac62afd385c3257fa95b622dcd46cb078f16908bdaecd93636
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T18634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaxsqki.sys

Path C:\Temp\qnifaxsqki.sys
Size 141KB
SHA256 8ff512cebaccfb73c4f535ec26824a9ea4596cd558f450d9dc5f0c962711d90e
MD5 f6e722b227207d740c02b0e420c71383
SHA1 50fde6125e13970048fe007fd40d265d9e26270d
SHA512 6b58c000142d8dcdb75ee16d990b62dc3a29c9306254c646fb9197fd887fb68f9fbf6f71f37e6ec8abd121147c089b8a9de712d8577a016dd1ac0becfabc8f6d
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdavtqk.sys

Path C:\Temp\qnifdavtqk.sys
Size 141KB
SHA256 ccf8b81d0ee999e18eb35aa5a0691be590a6782e318a9ba3ce6d61ec078a1f8a
MD5 424a344afc7ce04341e81691a1cfb074
SHA1 79732672a77e4ee2cceed33acc749d2bd05af940
SHA512 be4141b0bf39ed4bbfa49fb46acae433d36d25c9412a38d83b1793f41cde0e1a7eaff6a0a6b8b85671f3c241d202816208b5915f19f015c1d0db736f75df737e
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdxvqni.exe

Path C:\Temp\qnifdxvqni.exe
Size 226KB
SHA256 3bf00c4661829c9bff4e0ca9881e28504227bad52b5853340ce848ed23989f48
MD5 159bcb88eb9c8532d66fc4845160c43a
SHA1 2fca02eea6beb44228efb7de590b3f7567248a0f
SHA512 1280b2fbd9151feb9deb8f826219a51d29d00b8c0b69383ab352d5022d03dc2a9bcbb643b35b1634323d951ecbe2ae3e571f31e3d7d849f116fad643b38dab68
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhfzxrpk.sys

Path C:\Temp\rpmhfzxrpk.sys
Size 141KB
SHA256 75ffdaebbebb6274189362bc0ac6332fc115618598842a2323a575519c675bb7
MD5 13f7df07f1007eb26e2f5ae21fd687ac
SHA1 0c6be36b3baffff28581bf42ea40d9a97f9d9d95
SHA512 b1c9d1e6f7f7aabbb22cc45db54aae568616eb353cd6e65a128111dfe02845dd6fd27b90fa431e9a0021a8907c346e299c38b74accd2755af8fb98856b00b3b4
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.sys

Path C:\Temp\tnlfdyvqoi.sys
Size 141KB
SHA256 bd1a5f5cfd1337ce2378183b4408c55ea0fdd84b6f41a7f3b0330da4e9ff433f
MD5 44069555c7d1082bc80494f8699a6da6
SHA1 83a62d35b807f6e76dc10d2ee75f6bcc756f5ed6
SHA512 d500e54d3fe4545935441cce736ac0f171148b41cc4d6fbdf6dd553e0e169a339cbf6044e9dc34a209d1385095e835108f6c43acdc82af0a1c8aaa91246d799c
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfzusmk.exe

Path C:\Temp\upmhfzusmk.exe
Size 226KB
SHA256 68399fad81eaf16ea3b8e2653abfbe232ace285e9bec2f27f1fda1650ccb4ce0
MD5 88d0ade62bf6471e972fadc8f76ea1d0
SHA1 18775014e886766be712301349ef9d2a51222f1b
SHA512 d29c78c7c1d4fb8fd1ddfbc8697439263770737372ee0f81ed18bb44cb8ef1729198c9b73142a3923ce7b3f9c01cedde9f3372c99ebdf10073bc57dc7d24632d
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T16734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcaxsp.exe

Path C:\Temp\xspkhcaxsp.exe
Size 226KB
SHA256 3185f3471306a27c04843af2bbb406ff99ae432990eae875e5bd43332f170875
MD5 f2eca20ea62df949e38c725c51b9a886
SHA1 10279bdd16de1e3481d330c425697d8d926c1836
SHA512 0d88284e3c9161842ea43b5dbeb28730103f17398d87a2457fe25edc5a86d5fe4e113a55141d07be1d66e8dfb8e6356b430d7db2d02fa610ad321fc9828dc5b2
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 45de4d84f3406b164231e72b9d04f283970471886f3ab271133b83809b909cc6
MD5 27275cbfdbbcfb0559d1ff8dc7b37bc0
SHA1 3e88f22002dbe1fc03b4768ad9861bc1ea74afa9
SHA512 da3311e180fc5b69471098d51878a46176f7c8564ae6f7abe43b3de96bff0e937d4340f8d17313e8e13252377fc9a304ad70d576cb45ae0ce48614ec9acd0c8c
TLSH
T1DC41E9D40BE90AC2DBFC8EF520E166DD37F0D49E01176E8064462E700B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c3d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c3d3.TMP
Size 2KB
SHA256 cb68f4256c331d4bc3d08194800a2f453cefd6e8a0ac1a93134f76108fad25bd
MD5 59320a1562e20928334842e3ed1c3aea
SHA1 a9c1e2248a031c550fb349f5252fd5707a35520f
SHA512 8782d37bf869ff50cc5c8a92cdf019e602ca99d64b993d4ca9de9a3bd62cd4a5dc3e2db922f32714bbded65e2b9e810e5dbcdedc43cec587be57de8b822eaf31
TLSH
T10A41F8D40BE90AC2DBFC8EF560E16ADD37F0C4AE01176E8164422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ac5a24640f985683d932c339554952108dd916f1c44485c619a29ff8e4b88153
MD5 c3c8a973bf8164055e187d8e316bde07
SHA1 69e3b977aeef509bb2e7081c3ef74869cb1e50bc
SHA512 9daba0621885497d70455d1be7437716207361daa970552edbbcddc4531e8e5df1319eaafb046eee652a378b4d4c56d761e29c2466d4604bf4233e2850a478aa
TLSH
T195519EF3C7E8866E890156F0BB147E2BCE2D0914832C3D5AC9E4AF2BA3E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9827918c49165d5dcead98dc435ef88738fccc90c8cab6d57f2e2cb2ba318548
MD5 39470e96282f809a9971b90767b5d53e
SHA1 29369feb74c0a32c1ff247ca341af1c62f889bf2
SHA512 d65bb20e8e4ecfc5860c03751b2b1ec027489f3cb8a387ea735ec12db07f2091cb635cb240b8b7640998f457bf40902f473812c2d10f73cf6d23404d1857de09
SSDEEP 192:sxRzRZCK/fqsYkkiZ0ezoD8p9I/g6+WNCgf/YCKuOXGzIgD7J:sxRz6K/fqsYkkkz+/5R/UGh
TLSH
T18942A7166A289D3B9CC7D21DFB55BF53D6F95033A1941F48A7FC8A0C04EA6DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca83bb5bf5e20b3d2b5ce854df0aa61c5d58d2234a2942dfdc8830817177e937
MD5 09cf5f950bdb26ff7aebe8ccff83b02b
SHA1 f937bbfac84762f9b1048b6a587b8c74dca0e419
SHA512 8a3342add2ee687d2321e7f1763d94c356959fb0b39d902e415e2fba02da398577e143dd470a8cc5c47b19e44d7aaed480850278260901b582ef745c0dc4df2f
SSDEEP 192:sxRzRZCK/fqsYk4iZ0ezoD8p9I/g6+WNCgf/YCUuOXGzIgDxJ:sxRz6K/fqsYk4kz+/5R/GGv
TLSH
T12C42A5166A289D3B9CCBD209BB55BF53D6F95032A1941F48A7FC8B0C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 76b9ab0a1053969a31c7c244faa5cea5b9411b915b693b9e142b7f65f3141904
MD5 635d0d702d8bc800781d1661a6f25c76
SHA1 90574547c11983dab3d8a7fde681716d45d9c684
SHA512 d74752ac555a513acbfd5378f11835b9c6d1d159d882a231cbd0320cadeb4e6c736ab74c57d25de8b9c472ead5aad99817b9ff4bfeed2f231a4e6bea012e1456
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCz0QqchroZbK:jC+vf7E7JQWgQ+f4+u1ja9z0VcalK
TLSH
T131D2EA7B640DCB7F4F804ADDED197A9B6DA802CB9698CD4047FE841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 25a5a9c72571fbfa74220bc14e733119d59f29d4391cc7d2bc293f689366e0b2
MD5 b2d200ddae334552858663ba69a619ae
SHA1 b92c17ebf3f1ff89718a5f553219ffa02c621aba
SHA512 77e2fee912b66170e733d223932fd69611dd393459541f89a153e9fb503c894a26ca0474a113cd7c149f97768e3428b675326cdf5740fc0477b7d62e5c0fb030
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lYiUKDSC+8:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPg
TLSH
T1EB91971031BB17403D7D7A0C95B89C6A82C170B73419A56B3BA801AA1F6BE53DDFDADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5a89e5c-bf0a-466c-b5d9-c10b6646785c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5a89e5c-bf0a-466c-b5d9-c10b6646785c.tmp
Size 11KB
SHA256 6051fe1ed6a17d3fcf1abf53ccea53b23c53efddcd45c5c469d376a4055d9e42
MD5 27342e0aa7573acabdd3649797314593
SHA1 b6cc73875536332b05a26c989ecb60b211afc6a5
SHA512 d78f316c88fb0a692eb551822696b699e6504100c2af6340a185891eecbc9510726823a271731aae4a63bfe6ef78f6d517832ac93a16dae1f6316e30e0d64ed2
SSDEEP 192:sxRARZCK/fqstkkiZ0ezoD8p9I/g6+WNCgf/YCKuOXGzIgtJ:sxRA6K/fqstkkkz+/5R/UG3
TLSH
T19A32A6166A289D3B9CC7D21DFB65BF53D6F95033A1941F48A7FC8A0C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f852c4f1-23d8-4cec-a5b5-5082376dc634.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f852c4f1-23d8-4cec-a5b5-5082376dc634.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7a4ee80fe01e5bac5c00f40a2df788a884a0fedd684064d534ffccba00ccdf1a
MD5 ccf537b646c8bd8c67258c40706882ac
SHA1 680ee896eccca8ded5df3b169d017debdc776f39
SHA512 9d70588e952c32a6b5adc87d085b63f668dc6d20d91c760d538bb473b2c2aa724e94233363bf68b92771e1ea988f2dfa9bf0f1be203530c7b9d14c85b826fe02
SSDEEP 768:4rv+4UNbdd3VdrQVNEp8+p3bd66j+4BRv86aLIW9b9Mm/:4bsbz3kS8+p3Z6n4yXb+m/
TLSH
T10613BE72E8689E339CF6C614B1873A837FF811A396C00E94E5D96B4D45971AE270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e21b650e00de6bc527fd49e374a50a3e377417d363a5be890c958f4f1a2cf112
MD5 108c548c5f2c441a47edf71e8ab9d402
SHA1 1cc3db5b8b876c635231a65164cec27053d6f1cf
SHA512 86f9707560a4dc424d084d7e7e0a8cf31c9afc791065ce8dcb6c7a7db8c0946d996c0aa82d388c36b21f3bab7a0c107cc3c5173e5f1b4b7e7f516489cb49048a
SSDEEP 768:zj+9P3+hrQVNAp8+p3bd66j+4BRv86aLIW9b9Mma:W9P3Ze8+p3Z6n4yXb+ma
TLSH
T103F2AF71EC658E738CE6C758B2973B836FF411A396C01E94E9DD6B0D04932AD570B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d9f77cf319607cbc831585decb628949d20adfa41a562a9b5abd849572f7eb72
MD5 e9255d22258c62b804b25b862f540bc5
SHA1 53f72b46fbffa6aa0834b7a6d7ace6e100f384bc
SHA512 38549d938cf48c427b461d9917b8be61540fdbb416b72b8f122dd012ad9800af3dd31b00269aab7e5cd4b7768e0a51a0e907c588dd9751b8a5ff9422845338a2
SSDEEP 768:Irv+4UNbdD3NcQVTNp8+p3bd66j+4BRv86aLIiq2bwCl1:Ibsbp3RL8+p3Z6n4yI0ww
TLSH
T19103BF33E8A899739CF6C644B2467B433FF851A396C10AD4D4DD2B4E41AA19E230BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 30012b46b3772122114330cdc4fdccbecb70f42595ce9e5608e30c62fae0b9cf
MD5 561c62b114206102bf4072eec9b7ad6e
SHA1 9bbaf7507144cf151d14442d8fbd3b5b988c95ee
SHA512 a547e6afd3985de6aefe976ea7c75e25ff5932016191dd79cededf7c21eb331f9e89a64306463cbfb50a7d914ac827af3e0464dc499455fdcffd0f220fb2b7a0
SSDEEP 768:bF1j+9f3TwgyxQRVip8+p3bd66j+4BRv86aLIW9b9Mma:69f3e8+p3Z6n4yXb+ma
TLSH
T1DB1318F2D8D78A36D8AE8747637D2E469EFCC16375845984B7C86E0CCC821BFD60A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

49b2ef87-803c-455c-9c5b-7a7d11cb3eac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49b2ef87-803c-455c-9c5b-7a7d11cb3eac.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir248_158571916\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/200-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/476-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1760-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-377-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3252-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4104-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4928-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4928-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5424-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-254-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5704-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5704-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5876-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5876-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6008-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download