de227d027a7378d446e8ff80a1e19647492ab2ad63b693e9876b7c28d7de596d

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260721-ejkjtset2q
SHA256 de227d027a7378d446e8ff80a1e19647492ab2ad63b693e9876b7c28d7de596d
MD5 a223343d284e560b3dc8017860a725cd
SHA1 81cea84c9c637c690e7c9d20580b44abe8882e1e
SHA512 8c561965cd83a94e1f8700800b91a673bf6a5d6ec55c3be97af08fe0843d1ea44569509c9c0e354b684035a464a691da723a9d4589c1e29868c519cc114b3a93
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T19034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2292	CP.exe
1584	wupjhbztrm.exe
1140	CP.exe
5692	CP.exe
5500	i_wupjhbztrm.exe
4544	wrpjhbzwro.sys
3852	CP.exe
4456	ljhbytqojg.exe
760	CP.exe
2448	CP.exe
2608	i_ljhbytqojg.exe
3924	wqolgeywto.sys
996	CP.exe
2372	trljdbwqol.exe
1424	CP.exe
3736	CP.exe
1324	i_trljdbwqol.exe
4600	qljdbvtnlg.sys
3956	CP.exe
256	igayvqnlig.exe
5704	CP.exe
2528	CP.exe
2840	i_igayvqnlig.exe
5000	fdxvsqlidb.sys
4892	CP.exe
4712	xvqnifayvq.exe
1928	CP.exe
1380	CP.exe
1736	i_xvqnifayvq.exe
2836	davsqkidav.sys
1260	CP.exe
2544	yspkicausn.exe
2092	CP.exe
200	CP.exe
5340	i_yspkicausn.exe
716	caxsqkiczx.sys
5632	CP.exe
3192	fcausnkfcx.exe
3592	CP.exe
2640	CP.exe
6072	i_fcausnkfcx.exe
4088	khfzxspkhc.sys
2636	CP.exe
4788	nhfzxrpjhc.exe
712	CP.exe
3352	CP.exe
4536	i_nhfzxrpjhc.exe
2784	smjhfrpmke.sys
4164	CP.exe
4212	hezxrmkecw.exe
6052	CP.exe
3312	CP.exe
5052	i_hezxrmkecw.exe
5616	hezxrpjhbz.sys
1228	CP.exe
4304	cwugeywroj.exe
4716	CP.exe
2644	CP.exe
2712	i_cwugeywroj.exe
3372	wtrojgeywq.sys
4988	CP.exe
4920	wqomgbywqo.exe
2516	CP.exe
5544	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_1348054014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_569121467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_569121467\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_660990503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_660990503\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_2006748261\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_2006748261\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_2006748261\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1664_2006748261\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbytqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxupmjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgecwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgecwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxupmjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbytqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwugeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwugeywroj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
900	ipconfig.exe
3132	ipconfig.exe
5012	ipconfig.exe
3264	ipconfig.exe
580	ipconfig.exe
3020	ipconfig.exe
1644	ipconfig.exe
5976	ipconfig.exe
4756	ipconfig.exe
4692	ipconfig.exe
4184	ipconfig.exe
5492	ipconfig.exe
6104	ipconfig.exe
5956	ipconfig.exe
3348	ipconfig.exe
4716	ipconfig.exe
4444	ipconfig.exe
4156	ipconfig.exe
4200	ipconfig.exe
2576	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290799019338603"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{5007732A-1320-403D-A46A-5EF0460B7961}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe
1664	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5500	i_wupjhbztrm.exe
Token: SeDebugPrivilege	2608	i_ljhbytqojg.exe
Token: SeDebugPrivilege	1324	i_trljdbwqol.exe
Token: SeDebugPrivilege	2840	i_igayvqnlig.exe
Token: SeDebugPrivilege	1736	i_xvqnifayvq.exe
Token: SeDebugPrivilege	5340	i_yspkicausn.exe
Token: SeDebugPrivilege	6072	i_fcausnkfcx.exe
Token: SeDebugPrivilege	4536	i_nhfzxrpjhc.exe
Token: SeDebugPrivilege	5052	i_hezxrmkecw.exe
Token: SeDebugPrivilege	2712	i_cwugeywroj.exe
Token: SeDebugPrivilege	6104	i_wqomgbywqo.exe
Token: SeDebugPrivilege	3408	i_vtqljdbvto.exe
Token: SeDebugPrivilege	3820	i_nlidbvtqli.exe
Token: SeDebugPrivilege	4764	i_vtqnigaysq.exe
Token: SeDebugPrivilege	1264	i_ausqkicaus.exe
Token: SeDebugPrivilege	2000	i_uspnhfcaxs.exe
Token: SeDebugPrivilege	3008	i_cwuomhezxr.exe
Token: SeDebugPrivilege	4408	i_ezxupmjebz.exe
Token: SeDebugPrivilege	4524	i_ljgecwtolj.exe
Token: SeDebugPrivilege	4604	i_qoigbytrlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4520	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4520 wrote to memory of 1664	4520	iexplore.exe	90
PID 1664 wrote to memory of 2628	1664	msedge.exe	91
PID 1664 wrote to memory of 1772	1664	msedge.exe	93
PID 1664 wrote to memory of 1984	1664	msedge.exe	94
PID 1664 wrote to memory of 1984	1664	msedge.exe	94
PID 1664 wrote to memory of 1984	1664	msedge.exe	94
PID 1664 wrote to memory of 2824	1664	msedge.exe	95
PID 1664 wrote to memory of 2824	1664	msedge.exe	95
PID 1664 wrote to memory of 1224	1664	msedge.exe	96
PID 1664 wrote to memory of 1224	1664	msedge.exe	96
PID 1664 wrote to memory of 1224	1664	msedge.exe	96
PID 1664 wrote to memory of 5304	1664	msedge.exe	97
PID 1664 wrote to memory of 5304	1664	msedge.exe	97
PID 1664 wrote to memory of 5304	1664	msedge.exe	97
PID 1664 wrote to memory of 5424	1664	msedge.exe	99
PID 1664 wrote to memory of 5460	1664	msedge.exe	98
PID 1664 wrote to memory of 5424	1664	msedge.exe	99
PID 1664 wrote to memory of 5424	1664	msedge.exe	99
PID 1664 wrote to memory of 5460	1664	msedge.exe	98
PID 1664 wrote to memory of 5460	1664	msedge.exe	98
PID 1664 wrote to memory of 5384	1664	msedge.exe	101
PID 1664 wrote to memory of 5384	1664	msedge.exe	101
PID 4592 wrote to memory of 2292	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 1584 wrote to memory of 1140	1584	wupjhbztrm.exe	105
PID 1664 wrote to memory of 624	1664	msedge.exe	106
PID 1664 wrote to memory of 2368	1664	msedge.exe	107
PID 1664 wrote to memory of 624	1664	msedge.exe	106
PID 1664 wrote to memory of 2368	1664	msedge.exe	107
PID 1664 wrote to memory of 2784	1664	msedge.exe	111
PID 1664 wrote to memory of 4716	1664	msedge.exe	112
PID 1664 wrote to memory of 4716	1664	msedge.exe	112
PID 1664 wrote to memory of 5368	1664	msedge.exe	115
PID 1664 wrote to memory of 5368	1664	msedge.exe	115
PID 4592 wrote to memory of 5692	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4592 wrote to memory of 3852	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4456 wrote to memory of 760	4456	ljhbytqojg.exe	122
PID 4592 wrote to memory of 2448	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4592 wrote to memory of 996	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2372 wrote to memory of 1424	2372	trljdbwqol.exe	131
PID 4592 wrote to memory of 3736	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4592 wrote to memory of 3956	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 256 wrote to memory of 5704	256	igayvqnlig.exe	140
PID 4592 wrote to memory of 2528	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 1664 wrote to memory of 3856	1664	msedge.exe	146
PID 1664 wrote to memory of 1792	1664	msedge.exe	147
PID 1664 wrote to memory of 4864	1664	msedge.exe	148
PID 4592 wrote to memory of 4892	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4712 wrote to memory of 1928	4712	xvqnifayvq.exe	153
PID 4592 wrote to memory of 1380	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4592 wrote to memory of 1260	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 2544 wrote to memory of 2092	2544	yspkicausn.exe	162
PID 4592 wrote to memory of 200	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4592 wrote to memory of 5632	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3192 wrote to memory of 3592	3192	fcausnkfcx.exe	171
PID 4592 wrote to memory of 2640	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4592 wrote to memory of 2636	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4788 wrote to memory of 712	4788	nhfzxrpjhc.exe	180
PID 4592 wrote to memory of 3352	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 1664 wrote to memory of 3868	1664	msedge.exe	185
PID 1664 wrote to memory of 3868	1664	msedge.exe	185
PID 4592 wrote to memory of 4164	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4212 wrote to memory of 6052	4212	hezxrmkecw.exe	193
PID 4592 wrote to memory of 3312	4592	2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_a223343d284e560b3dc8017860a725cd_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x308,0x7ffe26a0c188,0x7ffe26a0c194,0x7ffe26a0c1a0
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8764853992305643848,15172554655008880496,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      System Time Discovery
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,14368053287869371816,4415613160448025669,262144 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2308,i,3497580950244726042,8323583222274916879,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,680473208538992044,4530923630397527284,2097152 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,7459700615402203791,11257395887777052999,2097152 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,2147563860002285632,5696945212203005558,2097152 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
      4⤵
      PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,2194522905682284815,5363905779965862385,2097152 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,300734449581657018,17849624649339927106,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,21007566376678143,18246333513149748351,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,3454318298427705245,12027114522569727262,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1901245759360372719,7964323771768193391,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,1901245759360372719,7964323771768193391,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12693957407000850506,16360374782394145002,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,5469509790798345788,8252550860764016536,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,2794106366931109804,15881823759032233212,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,1104798351527043610,14093086879196076065,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,5401900346391855023,11775409916035898113,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3052,i,938522471754577299,7577707440611267000,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,15150691251276440797,9593584948267660728,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,164012049802214661,11159557027592859343,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,13529309803836924291,2044057032123510127,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,3087734316923056647,5935854524311728694,262144 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1208,i,11906740927095759931,1702918487390200535,524288 --field-trial-handle=2332,i,9335695769920699354,13323050782933471036,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
      4⤵
      PID:1096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2292
- - C:\Temp\wupjhbztrm.exe
    C:\Temp\wupjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5692
- - C:\Temp\i_wupjhbztrm.exe
    C:\Temp\i_wupjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbytqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3852
- - C:\Temp\ljhbytqojg.exe
    C:\Temp\ljhbytqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbytqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_ljhbytqojg.exe
    C:\Temp\i_ljhbytqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwqol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:996
- - C:\Temp\trljdbwqol.exe
    C:\Temp\trljdbwqol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwqol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3736
- - C:\Temp\i_trljdbwqol.exe
    C:\Temp\i_trljdbwqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igayvqnlig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3956
- - C:\Temp\igayvqnlig.exe
    C:\Temp\igayvqnlig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igayvqnlig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\i_igayvqnlig.exe
    C:\Temp\i_igayvqnlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnifayvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\xvqnifayvq.exe
    C:\Temp\xvqnifayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnifayvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1380
- - C:\Temp\i_xvqnifayvq.exe
    C:\Temp\i_xvqnifayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yspkicausn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\yspkicausn.exe
    C:\Temp\yspkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yspkicausn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_yspkicausn.exe
    C:\Temp\i_yspkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcausnkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5632
- - C:\Temp\fcausnkfcx.exe
    C:\Temp\fcausnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcausnkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2640
- - C:\Temp\i_fcausnkfcx.exe
    C:\Temp\i_fcausnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\nhfzxrpjhc.exe
    C:\Temp\nhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\i_nhfzxrpjhc.exe
    C:\Temp\i_nhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\hezxrmkecw.exe
    C:\Temp\hezxrmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3312
- - C:\Temp\i_hezxrmkecw.exe
    C:\Temp\i_hezxrmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwugeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1228
- - C:\Temp\cwugeywroj.exe
    C:\Temp\cwugeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwugeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2644
- - C:\Temp\i_cwugeywroj.exe
    C:\Temp\i_cwugeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqomgbywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\wqomgbywqo.exe
    C:\Temp\wqomgbywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqomgbywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\i_wqomgbywqo.exe
    C:\Temp\i_wqomgbywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqljdbvto.exe ups_run
  2⤵
  PID:5224
- - C:\Temp\vtqljdbvto.exe
    C:\Temp\vtqljdbvto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqljdbvto.exe ups_ins
  2⤵
  PID:5616
- - C:\Temp\i_vtqljdbvto.exe
    C:\Temp\i_vtqljdbvto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidbvtqli.exe ups_run
  2⤵
  PID:5384
- - C:\Temp\nlidbvtqli.exe
    C:\Temp\nlidbvtqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidbvtqli.exe ups_ins
  2⤵
  PID:3856
- - C:\Temp\i_nlidbvtqli.exe
    C:\Temp\i_nlidbvtqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqnigaysq.exe ups_run
  2⤵
  PID:5332
- - C:\Temp\vtqnigaysq.exe
    C:\Temp\vtqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqnigaysq.exe ups_ins
  2⤵
  PID:700
- - C:\Temp\i_vtqnigaysq.exe
    C:\Temp\i_vtqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausqkicaus.exe ups_run
  2⤵
  PID:1000
- - C:\Temp\ausqkicaus.exe
    C:\Temp\ausqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausqkicaus.exe ups_ins
  2⤵
  PID:3336
- - C:\Temp\i_ausqkicaus.exe
    C:\Temp\i_ausqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspnhfcaxs.exe ups_run
  2⤵
  PID:2712
- - C:\Temp\uspnhfcaxs.exe
    C:\Temp\uspnhfcaxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspnhfcaxs.exe ups_ins
  2⤵
  PID:4208
- - C:\Temp\i_uspnhfcaxs.exe
    C:\Temp\i_uspnhfcaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezxr.exe ups_run
  2⤵
  PID:4400
- - C:\Temp\cwuomhezxr.exe
    C:\Temp\cwuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezxr.exe ups_ins
  2⤵
  PID:1596
- - C:\Temp\i_cwuomhezxr.exe
    C:\Temp\i_cwuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxupmjebz.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\ezxupmjebz.exe
    C:\Temp\ezxupmjebz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxupmjebz.exe ups_ins
  2⤵
  PID:1988
- - C:\Temp\i_ezxupmjebz.exe
    C:\Temp\i_ezxupmjebz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgecwtolj.exe ups_run
  2⤵
  PID:4600
- - C:\Temp\ljgecwtolj.exe
    C:\Temp\ljgecwtolj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgecwtolj.exe ups_ins
  2⤵
  PID:4972
- - C:\Temp\i_ljgecwtolj.exe
    C:\Temp\i_ljgecwtolj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytrlj.exe ups_run
  2⤵
  PID:4648
- - C:\Temp\qoigbytrlj.exe
    C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytrlj.exe ups_ins
  2⤵
  PID:1536
- - C:\Temp\i_qoigbytrlj.exe
    C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1600

C:\Temp\wrpjhbzwro.sys
C:\Temp\wrpjhbzwro.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\wqolgeywto.sys
C:\Temp\wqolgeywto.sys
1⤵
- Executes dropped EXE
PID:3924

C:\Temp\qljdbvtnlg.sys
C:\Temp\qljdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\fdxvsqlidb.sys
C:\Temp\fdxvsqlidb.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\davsqkidav.sys
C:\Temp\davsqkidav.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\caxsqkiczx.sys
C:\Temp\caxsqkiczx.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\khfzxspkhc.sys
C:\Temp\khfzxspkhc.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\smjhfrpmke.sys
C:\Temp\smjhfrpmke.sys
1⤵
- Executes dropped EXE
PID:2784

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:5616

C:\Temp\wtrojgeywq.sys
C:\Temp\wtrojgeywq.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Temp\vtrligbytr.sys
C:\Temp\vtrligbytr.sys
1⤵
PID:5460

C:\Temp\yvtnlgdyol.sys
C:\Temp\yvtnlgdyol.sys
1⤵
PID:5672

C:\Temp\vtnlfdxvtn.sys
C:\Temp\vtnlfdxvtn.sys
1⤵
PID:4156

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
PID:4124

C:\Temp\xupmkifzxu.sys
C:\Temp\xupmkifzxu.sys
1⤵
PID:124

C:\Temp\nhfcwurpkh.sys
C:\Temp\nhfcwurpkh.sys
1⤵
PID:3980

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
PID:3200

C:\Temp\jebztromge.sys
C:\Temp\jebztromge.sys
1⤵
PID:3408

C:\Temp\romgeywqoj.sys
C:\Temp\romgeywqoj.sys
1⤵
PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsqkidav.sys

Path C:\Temp\davsqkidav.sys
Size 141KB
SHA256 a30edf650115e6f42dae690410b06d65502b1eec1bc7ac57c4a22417f6f35b1f
MD5 2e38e88fa2bcbbb50fc5050fee9774b2
SHA1 5f1bf76d2e2f3973f12d50feda11faf5774c0a48
SHA512 0d6266b7858f093ab6cf275945b6dabf941aea56b3509c82b3324c742176af3bae1e7522e75d94cea1f6f1bf66c8cc76215d111cc886dc8def29a31dd2157940
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsqlidb.sys

Path C:\Temp\fdxvsqlidb.sys
Size 141KB
SHA256 2ff886a1b5780830ca6f887b92100eb837bc2b792a30505c01ac5efffc43a14a
MD5 0ea5552776a6edb8bca747a077a68f1c
SHA1 8fd0d62e4bd0ac49a5b154b40730596296c8d2d2
SHA512 db5bf6558682b3ef494b6cdb7d751703689e49737a9624ea0a5c5841f88bef42474b632269108bb6b23538270ab37185a1969380147f7d6e4cf3415f3538d180
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igayvqnlig.exe

Path C:\Temp\i_igayvqnlig.exe
Size 226KB
SHA256 f696fffccfe0d07be63ae9203b5f4967cacbfaa9ac2828e7b0a2de107eff2afa
MD5 99f080f51639a3ff103c2d12d9d1964a
SHA1 9514f9857d682abd72505cb3b10b1b7ee7f82f5c
SHA512 2e7810b4eb59e18ddadb5cd999238fa2fb39ab96c07286212409c37880531f375779434e4ca950e12c8fd7404b86ec951571e24dd4a05eebfc84c283d704fbd7
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1D034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljhbytqojg.exe

Path C:\Temp\i_ljhbytqojg.exe
Size 226KB
SHA256 35c4b5b1221075867182623c641679779375f2b6bc8cfbabd926b39df7ff3a26
MD5 a4303bfbc8d778acfed262ddf4958f49
SHA1 561958952e667a3a46577d4b76501137e40ff243
SHA512 1d8b93bba47e535bc166231f57353d57c81ea515ead77cf8f9c5c03c753544cb284c28e2ef2fb80833a72fec2fde8625dae1ac3bc1df90dbc4a7ae9877486a4a
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwqol.exe

Path C:\Temp\i_trljdbwqol.exe
Size 226KB
SHA256 120fd00c3ba5798c00d23ad91bac0d4f416f79d85191fcb283059e6a601162bf
MD5 5fa6db1efd83f2f456d0eff94825aa3b
SHA1 13e52d4d94a973f7ee47bf0fd058e523a181546b
SHA512 c89fa28de91558c11f8a020c34c4e85613520bc78d74d6fc337e009e0b8fb720bb5352f0bbf7d614a81750afad359c940501d3c00784832523675e053a1bae09
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wupjhbztrm.exe

Path C:\Temp\i_wupjhbztrm.exe
Size 226KB
SHA256 28eaa82b8614331284a1e4a88a8c8544ef07bad382295e2e9c5f1fa4426c823b
MD5 42e897b3d29226992f846db7d7c96f9f
SHA1 327868aebe4824673c5d8b3867e2dfb941ace541
SHA512 2ea96be7e5fb78e6c37b5acbd82415f1ac79fe2488737d5dabdbf442778b40af0161e5217692e9201268169371800c2952d8ff4a8c796221dafebb53a4220e56
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1B234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnifayvq.exe

Path C:\Temp\i_xvqnifayvq.exe
Size 226KB
SHA256 ca0a6fbdbfc4feae8437ae02920e8fa3ff9491761a93c460212167b31f1e307a
MD5 76a2c9dcbc68dcb46eecbe1510b288f2
SHA1 a5764912c38f2dfe64e2a9ab9c8333afd50cafed
SHA512 b8b66022cab0a1cd37dff7b25b55760905c2f5c0e3560fa962dfd760de559a9aa408644804acfe9f0ad80cd0a6990334c8f63b4d0c725a7619f6a093a58ea9ea
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yspkicausn.exe

Path C:\Temp\i_yspkicausn.exe
Size 226KB
SHA256 20cc0f21e27bf446946107d1d184ba0cdf74b6eff0e7465ebc845d4c0dd84055
MD5 3581e713576a7afbc773dc9e1b205cd2
SHA1 e40e73c5d7970326c966825d5061fa72d38d893b
SHA512 c203572e4fe08d6670187351f4c4a37441f8aa2dbaf5f4dc7c59f5156bb551f7cc66174be42c22535ca755bcd8e94272e68c4775d4cfedc7ce374a1e829cd4dc
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqnlig.exe

Path C:\Temp\igayvqnlig.exe
Size 226KB
SHA256 040e159ceca1fe2141452acb7f6a3a43349e5c3b4aac649f53fc3f48961efd90
MD5 6cc163df27818991facea954ec350c3c
SHA1 4e7b2398ec3aaeea68723f8cd95c568d4f8502a4
SHA512 6978992b24de2c84fc36a59d2df24e20011c32e26067258a694aa3cd22653004dfae96baa862b48bbd711eb141ef8f2525f2ea1d5bfb00330fbbc18bebe062f5
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T14A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljhbytqojg.exe

Path C:\Temp\ljhbytqojg.exe
Size 226KB
SHA256 1f9b2812883e5da54767a5ba968884e70583367d722ce2de8119a72f41852e1a
MD5 5e0feaa432b2be68ea08ab5f7bf7b206
SHA1 022684274ebc5fa430be3c9dbf3dfc65171b6084
SHA512 48c6d2746bc557ac8cb64e72804cc35c176f365173644982113551288b31e41034bc6c6ffc29fbe1fbb915fbb7998017fdda2f6f6cae0b4cd85f1c5899b031d2
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlg.sys

Path C:\Temp\qljdbvtnlg.sys
Size 141KB
SHA256 90bbb532f1ae1077352427847ca959299f8a2add861111e06b55d1e221089e38
MD5 efbcca9ee487b646c61410fada109cf2
SHA1 07bcfe0303eff597ed0de7e91feb849dbb5d72fc
SHA512 a4eb92ccad4ec524d3b414cc559b108a0ddcb4b223b2bfc23bd7e920a1bb6cabcec8e07add88f2333836229e903fc541d1c0d4085eea4da8f2bce0e792331968
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwqol.exe

Path C:\Temp\trljdbwqol.exe
Size 226KB
SHA256 dee52f5811e8a8a8ea8418e5af275d05eb2273a60109d7a99159de8f72442d49
MD5 49e89422d3ad226d69bac5d56fcc2cd2
SHA1 a0e299e416114af16764c202ed2e035db7c3fd4e
SHA512 9d69363aaffc12c17897c8332a1ee67d9af570d636905e34faf8cebcf3a7b32c4164b0877dbb133df716ac5dea070985f462aa38f309e2ec7d86c4fd6898ae32
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T14F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqolgeywto.sys

Path C:\Temp\wqolgeywto.sys
Size 141KB
SHA256 8d5ac2bf9018c1e8a37e67fc56b6322365788d18f7993ebe2fe0eaa920c2546c
MD5 727a66b54f5e9cdff4b641846fd3acd3
SHA1 55b6aa6f6a54a8b37892d6be5b90dc798ef342e7
SHA512 05bd17606538c6ca53be096872477ae79b208443e5e6babb5b697dc7e923353ca41fc76d43dcb4e21e8a757777741fd769e7724fe84008a50aea9496122b5680
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzwro.sys

Path C:\Temp\wrpjhbzwro.sys
Size 141KB
SHA256 ae9d49ca8ceb3e08f064805ac48e080c206cb97be50df7c02f2648e583af92a3
MD5 1cf95891f39052d4b8e65d8ec069e0c7
SHA1 48648183394ff656994343806f34d845a9c54de0
SHA512 c7b977201104f0a8ae934df9dbfec07c042c048d9e548f003c5e03d6c9286f38af06151e4507df8dc0ab3c93439d7c0aba94ab759110a25e1ccf0b84bc8757a2
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupjhbztrm.exe

Path C:\Temp\wupjhbztrm.exe
Size 226KB
SHA256 25a3f9a453fb1cc1683ae23de263de3934962f82619bf2a2eaccfd3f9a77a37a
MD5 a2d5862146a0bc5a6b3fec04a4ed22bc
SHA1 86a6f3ff514337f1dc24a2f480161f677636ffc8
SHA512 d10676a29b9d1d066198c980a07acc821a953e57f6f1922b1d78b657fe316c2bf472d38aac66ebffc3f63f7abbd3a50fa0eb5b31445a6191e20448a2ce1abf6c
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnifayvq.exe

Path C:\Temp\xvqnifayvq.exe
Size 226KB
SHA256 9ad62e9a59ec8a00cd24f39af83ae4e2bf8e580aba5ef3e2cf8a531b0c5c420d
MD5 788725c24b6de2e8ea461404a28237ff
SHA1 26284a79e4ede5b08102cf2c189ec0c13b7d3c3f
SHA512 008176d4fc9dff037bb354b6959dc1dc46e7156f0e525a9e279a5f64950560560534637a3435d55b7029c31923cf89a821d65c9b1f8699d2109fe0cef73e6d89
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T1EF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yspkicausn.exe

Path C:\Temp\yspkicausn.exe
Size 226KB
SHA256 755d80247ef2b1e086d949c32b8d0f6d2804e8e77512d1c0ea86c3f87c665368
MD5 eca5b79b33d88bfce77d69e38a1c82f4
SHA1 3127b74bfec894456446eae9a9630f5623c7e956
SHA512 1b9fcb5e288a5e522f00c3d5fd749adef7a3fc07ba65c21f3f2bb86ce641ce17dc4e81458425a9bb93e123f74df4ae23bcdbf766cb4175b0a018c5bac37cbf22
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T15D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

8d0958bb-bc7d-4f05-bbdb-d72f9e40fbb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d0958bb-bc7d-4f05-bbdb-d72f9e40fbb8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 6d589d2bd92bde0a2321c9e324d6e69d2dcbd7e301392799590afc95b51daaf6
MD5 6a7eaebb06e51a8a6a207d83c52b8b73
SHA1 44850195a6de9beb3082b51c508a9604f243ce60
SHA512 d9458e0bcd4216826cda7d7151ad729ce96af3dbb768e784255c93682d0a2e65587535c98f6643efd9213db5096a44967c4b57448ca4884daab90da5efb4c2ea
TLSH
T171312B13C72798D6E3B2E1F735D14A5BB2778899CE0BAF54000362F08A823EC13690C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 84456a6192ba92d2611671aa745cafde1477231e5f118843d86833d6c31be8c1
MD5 e06f532c568797dec998405d26f1db3c
SHA1 1780945a8b589e6235f500b907d708b131ebdf6a
SHA512 35e2041aac78cd5dd7cbf1e7aad7246b99c7cb3405855a6f85cfeb868463806a481812eff0801ea279935b3344f63a22c2b4334b5ea01305ac3d38b219375b0f
TLSH
T17E519DF3C7E8866EC91155F0AA187E2BCE1D0914832C3D5AC9E4EF1BA3E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e123b227a6f206705ff136b195537c8981d021f6da2fd151d1c0efd7d634246f
MD5 4a01f1c529a2e0a0d55a87c9fbb4bfd5
SHA1 b99fc19d3281e6116b885305d2852cda7e413030
SHA512 f287476342256d5262ce1b868bbce090ea7f07906d43102cb54648ce93f74ae01d7278147c07165db82c714569ec755492048104a2206a6fa9dfaabc056cd7f0
SSDEEP 192:sxRrRxCR/fJVsmk55ZaRaUzPBzoD8p9p/g6+WNC8t/YG5kky+GNIgVBJ:sxRreR/fJVsmk5XaRJPlT/5z/JynF
TLSH
T10642B71AAD289D3B8CC7D25DFA55BF53D6F95033B1941E48A6FC8A0C04EA6DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9825c024f7f1f2ebac53c8ae09d7bc9b473fcb8dd21cfe23e5933b380c3ebe23
MD5 29f65d7bebcb4c231d1887c3214253c3
SHA1 db1d7387abe9b2ff4f60325a67defeaf8b9645d3
SHA512 04f3503e89011d80e0923dc0426c7fdc9be42267d251ed813f9375abecf21c578338988fa68810c2582ce60e5bba16ec262f564052f3958a6e7c01bdaf7dcb52
SSDEEP 192:sxRIRxCR/fJVs7kv5ZaRaUzPBzoD8p9p/g6+WNC8t/YGeky+GNIgDpBJ:sxRIeR/fJVs7kvXaRJPlT/5z/Vynd
TLSH
T1DD42B71AA9285D3B9CCBD21DFA55BF53D6F95073B1941E48A6FCCB0C04EA6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 573a7cadf34f372aa7096d49ff466ecca0efc6d3c2fe641cb2cc04a3c31c6cf6
MD5 11baea2b62c97f2858c7b56d41af3576
SHA1 cc05e9ad74c2ec106b84136b3eebcd1c49bee159
SHA512 00cd1895b59576b721c5b17d8539babaa3fe95c211ff639aed5e80e243f5ecabb63f22651d940b98c14698ed333444e657b9819bfda051c33dd7344ca59c4daa
SSDEEP 192:sxRIRxCR/fJVs7k55ZaRaUzPBzoD8p9p/g6+WNC8t/YG5kky+GNIgDbBJ:sxRIeR/fJVs7k5XaRJPlT/5z/JynD
TLSH
T12E42B81AAD285D3B8CC7D21DFB55BF53D6F95073B1941E48A6FC8A0C04EA6DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b334eaafc2c97cb25660e9ab8b8316a0da6851469210eba571a9fa2e01a6f276
MD5 c14d55b999a174d977c4222a6d2f0baa
SHA1 432074b0636a8d89c757b3362bdc039e02ac03bb
SHA512 302355e67130834db25e5c2c608ae5292b3e8e9d28f1bf6efa2fc8824fe49c9a337045509f9dd511d28342b333ac3592ce9885722bde651da64530ed714826fc
SSDEEP 768:UQYi637pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfQ5pNKVros:UQYi6xE78NWgv7fxJu1ja4Q5fKus
TLSH
T1F6D2DB7B640CCB7E4F804A9D9D197E9F6D6802CB9698CD8047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a363b9e587f517228d2a7da35cfd0a0e611af043dcf2c2926535c5120772443
MD5 70c5d2501e72dc5cc2fe7e15e5a149db
SHA1 27cbae33e22bd96e9e348e9626fa55d727865cc0
SHA512 00ad66a0fbb0fd3a0358f8b7879cb3cc8d518a1aae409c3a99bbf351f4b2151b7a08d78d8feed31fc22f3b8adeefbd4ed501ae2bed2d25b0a6025e1812ebc63f
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkYp8IamqwWuzjgwwK4lgSwcgwDyYdH/oNJ/9T:Cm7KmgIIJ4tWGm7g09OGlkYp8IamqXuP
TLSH
T16B911465337B1241383DAD4881B8C56B82C1B0A33055A83B7BEC55A65F6AE038DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a231cb09693d9c2292017db9cf0b76f21e1b0c713f9bc9ee19a772097659c7a8
MD5 8146e04f9076e4821f3d1cc5ff5bab73
SHA1 221c14e3c624c397528f5d80eac6216868051f3d
SHA512 563abbcaf96b68af72ebdb60cf54b6a14eccbbd3144d896bc1d6133e68a9ff67ec17865766f9797f818933e4f68ef70879afa48a549d44e17b53c321397672da
SSDEEP 768:3lj+9G3lWlYy1B6CnC7Hucys6BRvi82oP4/z6himo6zb9MJ:3Q9G3YIC33imOz6Imosb+J
TLSH
T19CF2B035E8518E73DCEB8298B54B3F927FE0227395CC1D88E5DAAF0D05C76AD1716822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8acaab7c498e4bc148407ace3313e791f557f600e33ed4941c256c7a824b6ba7
MD5 2509b0ff78b6d170214c56c0374e2413
SHA1 29119ee9b11fdfa9a0ec6013933fd73c7aeecc4e
SHA512 ca5ee8aff30642de0d6df4d25e5762c0fb01ea9d89d75881a15c06bf5fc9809ee9aab2a6281e13c36cb6c32ff780c6ca38ebb9bdbbaec98b1d19c0008a9eb9a2
SSDEEP 768:xGrv+4UNbdS3OSplYy1Bo7Hucys6BRvi82oP4/z6himo+J2bwn+h:xGbsbw3OAD3imOz6ImoG0w+
TLSH
T1EA03CF36F4548973DCE78288B4467B637FF4522395C91A80E6DE6F0E528B99E130BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 24cd861e1941aca7c8a70082277ac8cf6f209e244be9a5f045a6615e34681166
MD5 a8fce9e8e3a23711092282cbee89c61c
SHA1 52323f2ca899c79cff6f76ca1b507cb078b6220f
SHA512 d8df41337e2f76b06e94069f5a2345544a6b7feaa7bfa57815ad7c010a4f3f1b1e34e10d4b41f9c202ec05c8e64c98c2eaf84b5a7350489dcfca5520a8654939
SSDEEP 768:3krv+4UNbdE32WlYy1B6Cnz7Hucys6BRvi82oP4/z6himo6zb9Mr:3kbsbS3hIC63imOz6Imosb+r
TLSH
T17A13BF31F454CE73DCF78258B08A7B937FE4226395CC1994E5DA9F0D06879AE171A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c372121a374bc890eebd7fdbf9d0c5c517e0cbbbc3deb9fc81dfe5a083567bf3
MD5 2de5c0c94c53d81a0f20182aad6b71c7
SHA1 c1a2df785067c8d2c972a933b93bb8e39e3567eb
SHA512 05dad039328cd19f662bbe1628ca37e18343f0e8af3addeaf7d65d8b69d68f71c9421ddcb48f0efc6688af1e7237dae5fcd754a604e9545af059020e022afafd
SSDEEP 768:+lj+9G36WlYy1B6CnC7Hucys6BRvi82oP4/z6himo6zb9MJ:+Q9G31IC33imOz6Imosb+J
TLSH
T178F2B031E8518E73DCEBC298F14A3B927FE0227395CC1D48E5DAAF0D05C7AAD0756822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 be1d91425e0c80406e162afb2f45febbe09f263f2d3f8666727432c8a80b013d
MD5 4f651c1d710ff5da9532ff589c8356e8
SHA1 2e67886e8ea30a1b69e235c2d5b6422db1b66d44
SHA512 6a6eb574481f4ac6f5cf1f04414573596e925ce7b5da00be5e549db2c9e92e7610383033a465fb2b7dc22aac7c355420925816571f8cd3f598c85cee6ae197d7
SSDEEP 768:GTj+9934DSRB6CnP7Hucys6BRvi82oP4/z6himo6zb9MJ:G2993XIC+3imOz6Imosb+J
TLSH
T14B1338F494D38E32D89E4397A33D6E966EBCD16375881884F7D95E0CCC826BFC606811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1664_790159556\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/580-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-303-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2784-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-304-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3408-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3924-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3980-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4088-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4156-389-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4600-251-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-365-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5616-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download