350c61e4872e0cf1c978153a52399794423d9e2f5f48d9ceac7c8330b19e0bc7

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260814-pc184saq4x
SHA256 350c61e4872e0cf1c978153a52399794423d9e2f5f48d9ceac7c8330b19e0bc7
MD5 ec6ee55cf8649bab5e74a1d702cac6b3
SHA1 7d4201710427c7f24ec2d7e6d2f38cc02ca37e51
SHA512 c1c537eda9dabd0d62968b15768ea8a4feab9b09fe00b1cfec6ea17fe245fad2ad84e061977c7c0babb0133b6c2a20f6a79c947941e6317692e7f97fd2a66de5
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3456	CP.exe
3688	sqkicauskf.exe
4976	CP.exe
4036	CP.exe
2484	i_sqkicauskf.exe
6104	pjhfzxrpjh.sys
4556	CP.exe
3884	mkhcausmke.exe
4412	CP.exe
4768	CP.exe
1232	i_mkhcausmke.exe
3352	zwurmjhezw.sys
4668	CP.exe
4188	zwuomhecwu.exe
4252	CP.exe
2872	CP.exe
5588	i_zwuomhecwu.exe
3252	omgebwuomg.sys
4640	CP.exe
4376	ljdbztrojh.exe
1720	CP.exe
2868	CP.exe
1392	i_ljdbztrojh.exe
1840	jdbzwuolgd.sys
5752	CP.exe
5376	oigbytqljd.exe
720	CP.exe
1056	CP.exe
3212	i_oigbytqljd.exe
5340	olidaywqol.sys
3152	CP.exe
1740	nljdbvtqoj.exe
2532	CP.exe
3620	CP.exe
5684	i_nljdbvtqoj.exe
5524	sqlidbvtnl.sys
4936	CP.exe
1924	qkidbvtnlf.exe
3924	CP.exe
2396	CP.exe
3796	i_qkidbvtnlf.exe
5092	icausnkica.sys
712	CP.exe
5724	caxvpnkica.exe
1748	CP.exe
4772	CP.exe
3420	i_caxvpnkica.exe
2416	pnkicavsnk.sys
5056	CP.exe
3940	ausmhfcxvp.exe
5088	CP.exe
3452	CP.exe
3204	i_ausmhfcxvp.exe
5480	cxupnkfcxu.sys
3252	CP.exe
3184	rpnkfczxrp.exe
616	CP.exe
3640	CP.exe
3376	i_rpnkfczxrp.exe
3988	urmkhecwup.sys
2020	CP.exe
4176	zusmkecwuo.exe
5080	CP.exe
1804	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_1950985753\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_1798067158\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_1798067158\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_2127353653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_2127353653\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_457074397\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_457074397\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_457074397\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5984_457074397\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicauskf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnkfczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicauskf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmkebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnkfczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmkebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbztrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhfzxrpj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5908	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5084	ipconfig.exe
4276	ipconfig.exe
5704	ipconfig.exe
2112	ipconfig.exe
4860	ipconfig.exe
2616	ipconfig.exe
124	ipconfig.exe
1600	ipconfig.exe
4464	ipconfig.exe
1352	ipconfig.exe
1524	ipconfig.exe
5664	ipconfig.exe
2912	ipconfig.exe
556	ipconfig.exe
3056	ipconfig.exe
3796	ipconfig.exe
2324	ipconfig.exe
3056	ipconfig.exe
3076	ipconfig.exe
5836	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311831169478542"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2E477430-90C8-43E6-94F7-17AFC146C00A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5220	msedge.exe
5220	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe
5984	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2484	i_sqkicauskf.exe
Token: SeDebugPrivilege	1232	i_mkhcausmke.exe
Token: SeDebugPrivilege	5588	i_zwuomhecwu.exe
Token: SeDebugPrivilege	1392	i_ljdbztrojh.exe
Token: SeDebugPrivilege	3212	i_oigbytqljd.exe
Token: SeDebugPrivilege	5684	i_nljdbvtqoj.exe
Token: SeDebugPrivilege	3796	i_qkidbvtnlf.exe
Token: SeDebugPrivilege	3420	i_caxvpnkica.exe
Token: SeDebugPrivilege	3204	i_ausmhfcxvp.exe
Token: SeDebugPrivilege	3376	i_rpnkfczxrp.exe
Token: SeDebugPrivilege	2360	i_zusmkecwuo.exe
Token: SeDebugPrivilege	4860	i_eywrojhbzt.exe
Token: SeDebugPrivilege	5912	i_ywqomgeywt.exe
Token: SeDebugPrivilege	3320	i_bvtolgbywq.exe
Token: SeDebugPrivilege	3420	i_vqnlfdyvqo.exe
Token: SeDebugPrivilege	3204	i_fdxvqnifay.exe
Token: SeDebugPrivilege	2848	i_vsnkfcaxsp.exe
Token: SeDebugPrivilege	2312	i_xvpnhfzxvp.exe
Token: SeDebugPrivilege	2992	i_usmhfzxrpj.exe
Token: SeDebugPrivilege	3744	i_rpmkebwuom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 5916	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5916 wrote to memory of 5984	5916	iexplore.exe	90
PID 5984 wrote to memory of 5420	5984	msedge.exe	91
PID 5984 wrote to memory of 2524	5984	msedge.exe	93
PID 5984 wrote to memory of 5908	5984	msedge.exe	94
PID 5984 wrote to memory of 2524	5984	msedge.exe	93
PID 5984 wrote to memory of 2524	5984	msedge.exe	93
PID 5984 wrote to memory of 3324	5984	msedge.exe	95
PID 5984 wrote to memory of 3324	5984	msedge.exe	95
PID 5984 wrote to memory of 3988	5984	msedge.exe	116
PID 5984 wrote to memory of 3304	5984	msedge.exe	97
PID 5984 wrote to memory of 3988	5984	msedge.exe	116
PID 5984 wrote to memory of 3988	5984	msedge.exe	116
PID 5984 wrote to memory of 3304	5984	msedge.exe	97
PID 5984 wrote to memory of 3304	5984	msedge.exe	97
PID 5984 wrote to memory of 5088	5984	msedge.exe	98
PID 5984 wrote to memory of 5088	5984	msedge.exe	98
PID 5984 wrote to memory of 5088	5984	msedge.exe	98
PID 5984 wrote to memory of 2908	5984	msedge.exe	99
PID 5984 wrote to memory of 2908	5984	msedge.exe	99
PID 5984 wrote to memory of 2908	5984	msedge.exe	99
PID 5984 wrote to memory of 2768	5984	msedge.exe	119
PID 5984 wrote to memory of 2768	5984	msedge.exe	119
PID 5984 wrote to memory of 4732	5984	msedge.exe	102
PID 5984 wrote to memory of 4632	5984	msedge.exe	103
PID 5984 wrote to memory of 4732	5984	msedge.exe	102
PID 5984 wrote to memory of 4632	5984	msedge.exe	103
PID 5984 wrote to memory of 1380	5984	msedge.exe	105
PID 5984 wrote to memory of 5084	5984	msedge.exe	106
PID 5984 wrote to memory of 5084	5984	msedge.exe	106
PID 5984 wrote to memory of 4864	5984	msedge.exe	107
PID 5984 wrote to memory of 4864	5984	msedge.exe	107
PID 2440 wrote to memory of 3456	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 3688 wrote to memory of 4976	3688	sqkicauskf.exe	112
PID 2440 wrote to memory of 4036	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 2440 wrote to memory of 4556	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 3884 wrote to memory of 4412	3884	mkhcausmke.exe	123
PID 2440 wrote to memory of 4768	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2440 wrote to memory of 4668	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4188 wrote to memory of 4252	4188	zwuomhecwu.exe	132
PID 2440 wrote to memory of 2872	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 2440 wrote to memory of 4640	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4376 wrote to memory of 1720	4376	ljdbztrojh.exe	141
PID 2440 wrote to memory of 2868	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 5984 wrote to memory of 5840	5984	msedge.exe	147
PID 5984 wrote to memory of 3168	5984	msedge.exe	148
PID 5984 wrote to memory of 4152	5984	msedge.exe	149
PID 2440 wrote to memory of 5752	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 5376 wrote to memory of 720	5376	oigbytqljd.exe	154
PID 2440 wrote to memory of 1056	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 2440 wrote to memory of 3152	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 1740 wrote to memory of 2532	1740	nljdbvtqoj.exe	163
PID 2440 wrote to memory of 3620	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 2440 wrote to memory of 4936	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 1924 wrote to memory of 3924	1924	qkidbvtnlf.exe	172
PID 2440 wrote to memory of 2396	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 2440 wrote to memory of 712	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 5724 wrote to memory of 1748	5724	caxvpnkica.exe	181
PID 2440 wrote to memory of 4772	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 5984 wrote to memory of 4100	5984	msedge.exe	186
PID 5984 wrote to memory of 4100	5984	msedge.exe	186
PID 2440 wrote to memory of 5056	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 3940 wrote to memory of 5088	3940	ausmhfcxvp.exe	194
PID 2440 wrote to memory of 3452	2440	2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_ec6ee55cf8649bab5e74a1d702cac6b3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd075cc188,0x7ffd075cc194,0x7ffd075cc1a0
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2016,i,6021080954653025937,3848290265206615710,262144 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,10312432675376220722,10318164472411820230,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,17061868431074293296,10097476010878578065,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:13
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7829136009294369504,2571516286755049210,2097152 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15006541281019118414,17701239568085538371,2097152 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,5667035009642472883,4008872997863671661,2097152 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:9
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,2262554077081087309,5484070623303513695,2097152 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,2957763250408271528,15145562079109649475,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3833721635871540139,3372426784996251551,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,16355606160749610430,12019836397435180872,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10876164346724595087,14336722797924673247,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10876164346724595087,14336722797924673247,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10710292739988565147,3834178097341697548,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10317508442882176557,13615940764129359782,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1324,i,18099417741906245636,341942409925537396,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,16371592601752933239,9439908149731689012,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,12275143343693597593,14212909734401205688,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13908817244877910247,11052871864271850386,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5456395685551617304,15819743231247172453,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,2446789416912261571,652367772180067226,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,7731901592106032800,1133372858135989378,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=1312 /prefetch:14
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,16637056985207761497,16889076775854630296,262144 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3244,i,16917852887800432576,1577946680175618826,524288 --field-trial-handle=2500,i,16673987770774720084,399063991102422646,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
      4⤵
      PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicauskf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3456
- - C:\Temp\sqkicauskf.exe
    C:\Temp\sqkicauskf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicauskf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4036
- - C:\Temp\i_sqkicauskf.exe
    C:\Temp\i_sqkicauskf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Temp\mkhcausmke.exe
    C:\Temp\mkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_mkhcausmke.exe
    C:\Temp\i_mkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomhecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\zwuomhecwu.exe
    C:\Temp\zwuomhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomhecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2872
- - C:\Temp\i_zwuomhecwu.exe
    C:\Temp\i_zwuomhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbztrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\ljdbztrojh.exe
    C:\Temp\ljdbztrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbztrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Temp\i_ljdbztrojh.exe
    C:\Temp\i_ljdbztrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5752
- - C:\Temp\oigbytqljd.exe
    C:\Temp\oigbytqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1056
- - C:\Temp\i_oigbytqljd.exe
    C:\Temp\i_oigbytqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\nljdbvtqoj.exe
    C:\Temp\nljdbvtqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3620
- - C:\Temp\i_nljdbvtqoj.exe
    C:\Temp\i_nljdbvtqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidbvtnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4936
- - C:\Temp\qkidbvtnlf.exe
    C:\Temp\qkidbvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidbvtnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_qkidbvtnlf.exe
    C:\Temp\i_qkidbvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxvpnkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:712
- - C:\Temp\caxvpnkica.exe
    C:\Temp\caxvpnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxvpnkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4772
- - C:\Temp\i_caxvpnkica.exe
    C:\Temp\i_caxvpnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmhfcxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\ausmhfcxvp.exe
    C:\Temp\ausmhfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmhfcxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\i_ausmhfcxvp.exe
    C:\Temp\i_ausmhfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpnkfczxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3252
- - C:\Temp\rpnkfczxrp.exe
    C:\Temp\rpnkfczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpnkfczxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3640
- - C:\Temp\i_rpnkfczxrp.exe
    C:\Temp\i_rpnkfczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Temp\zusmkecwuo.exe
    C:\Temp\zusmkecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\i_zusmkecwuo.exe
    C:\Temp\i_zusmkecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run
  2⤵
  PID:2712
- - C:\Temp\eywrojhbzt.exe
    C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins
  2⤵
  PID:3336
- - C:\Temp\i_eywrojhbzt.exe
    C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqomgeywt.exe ups_run
  2⤵
  PID:4888
- - C:\Temp\ywqomgeywt.exe
    C:\Temp\ywqomgeywt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqomgeywt.exe ups_ins
  2⤵
  PID:1452
- - C:\Temp\i_ywqomgeywt.exe
    C:\Temp\i_ywqomgeywt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgbywq.exe ups_run
  2⤵
  PID:1616
- - C:\Temp\bvtolgbywq.exe
    C:\Temp\bvtolgbywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgbywq.exe ups_ins
  2⤵
  PID:5092
- - C:\Temp\i_bvtolgbywq.exe
    C:\Temp\i_bvtolgbywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnlfdyvqo.exe ups_run
  2⤵
  PID:6104
- - C:\Temp\vqnlfdyvqo.exe
    C:\Temp\vqnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnlfdyvqo.exe ups_ins
  2⤵
  PID:5628
- - C:\Temp\i_vqnlfdyvqo.exe
    C:\Temp\i_vqnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnifay.exe ups_run
  2⤵
  PID:4964
- - C:\Temp\fdxvqnifay.exe
    C:\Temp\fdxvqnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnifay.exe ups_ins
  2⤵
  PID:5384
- - C:\Temp\i_fdxvqnifay.exe
    C:\Temp\i_fdxvqnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfcaxsp.exe ups_run
  2⤵
  PID:5928
- - C:\Temp\vsnkfcaxsp.exe
    C:\Temp\vsnkfcaxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfcaxsp.exe ups_ins
  2⤵
  PID:3564
- - C:\Temp\i_vsnkfcaxsp.exe
    C:\Temp\i_vsnkfcaxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxvp.exe ups_run
  2⤵
  PID:2568
- - C:\Temp\xvpnhfzxvp.exe
    C:\Temp\xvpnhfzxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxvp.exe ups_ins
  2⤵
  PID:5892
- - C:\Temp\i_xvpnhfzxvp.exe
    C:\Temp\i_xvpnhfzxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmhfzxrpj.exe ups_run
  2⤵
  PID:6000
- - C:\Temp\usmhfzxrpj.exe
    C:\Temp\usmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmhfzxrpj.exe ups_ins
  2⤵
  PID:4180
- - C:\Temp\i_usmhfzxrpj.exe
    C:\Temp\i_usmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmkebwuom.exe ups_run
  2⤵
  PID:1488
- - C:\Temp\rpmkebwuom.exe
    C:\Temp\rpmkebwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmkebwuom.exe ups_ins
  2⤵
  PID:2604
- - C:\Temp\i_rpmkebwuom.exe
    C:\Temp\i_rpmkebwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3988

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2768

C:\Temp\pjhfzxrpjh.sys
C:\Temp\pjhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:6104

C:\Temp\zwurmjhezw.sys
C:\Temp\zwurmjhezw.sys
1⤵
- Executes dropped EXE
PID:3352

C:\Temp\omgebwuomg.sys
C:\Temp\omgebwuomg.sys
1⤵
- Executes dropped EXE
PID:3252

C:\Temp\jdbzwuolgd.sys
C:\Temp\jdbzwuolgd.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\olidaywqol.sys
C:\Temp\olidaywqol.sys
1⤵
- Executes dropped EXE
PID:5340

C:\Temp\sqlidbvtnl.sys
C:\Temp\sqlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:5524

C:\Temp\icausnkica.sys
C:\Temp\icausnkica.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\pnkicavsnk.sys
C:\Temp\pnkicavsnk.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\cxupnkfcxu.sys
C:\Temp\cxupnkfcxu.sys
1⤵
- Executes dropped EXE
PID:5480

C:\Temp\urmkhecwup.sys
C:\Temp\urmkhecwup.sys
1⤵
- Executes dropped EXE
PID:3988

C:\Temp\ezwuomjecw.sys
C:\Temp\ezwuomjecw.sys
1⤵
PID:3404

C:\Temp\jgbzwromjd.sys
C:\Temp\jgbzwromjd.sys
1⤵
PID:1564

C:\Temp\bytqligbyt.sys
C:\Temp\bytqligbyt.sys
1⤵
PID:5928

C:\Temp\tqoigdbvtn.sys
C:\Temp\tqoigdbvtn.sys
1⤵
PID:2616

C:\Temp\lidavqnlca.sys
C:\Temp\lidavqnlca.sys
1⤵
PID:5764

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
PID:3284

C:\Temp\xvpnkfcxvp.sys
C:\Temp\xvpnkfcxvp.sys
1⤵
PID:4092

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
PID:1344

C:\Temp\pmhecztrom.sys
C:\Temp\pmhecztrom.sys
1⤵
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

i_ljdbztrojh.exe

Path C:\Temp\i_ljdbztrojh.exe
Size 226KB
SHA256 c76db585b5472ddbe269d7996975a2e8eee1987a62eb41f30605d152e68d4370
MD5 970d275c7ea08e103485b34a034ae64e
SHA1 94e513e13f52c2f4e9ece2d98624384749af9661
SHA512 190cf6ddd7af7340c6f61042cce2b36e123d04b0024334ed90d8adcb126be5c35799cc5c00b06ead12e1fabc2ef5196f55fb239635c106c9eef2017b59fbcd78
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhcausmke.exe

Path C:\Temp\i_mkhcausmke.exe
Size 226KB
SHA256 70e76a9a2383fa5ad1b2f43f7eb71ef9c22fbb26a0a36437622e3365c810a230
MD5 bd1562c7ec3ae8b797169c01aaa849a5
SHA1 3a5aac10d0fbde6141942ef9c99c2ecb569d78e5
SHA512 a759056fdf07e2a1318c916e901dd2e1f0ec1b6929b16e51f3836c48c69b9e9207760803f2cf4d4a5ad02749890feeaf047875d0b33beacb1b4d4012e7d17b84
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T16234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtqoj.exe

Path C:\Temp\i_nljdbvtqoj.exe
Size 226KB
SHA256 a6a0be09847b0e15a09c2fad618cf919e1f6cad900f37c6ea5365f72b2812994
MD5 e07c3cbfe1a53823cfc7c691efb3088f
SHA1 532e68486d428b9d4a92c934f12b0564635ef8ac
SHA512 003ef3dee06712568de289b7e1e1b4594075dc60314320eed9cc7b69d08ba6c30f6cdaf6ff3acf35e6803661f71483d61f67d95505d8c1f55e69d99b9178f165
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T17234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytqljd.exe

Path C:\Temp\i_oigbytqljd.exe
Size 226KB
SHA256 69f8fbe692b6783d439432882bf43007c672b45088bbb60a32bee36f2a7ac601
MD5 cbedfc4fddbfe9837650beddc3669a3a
SHA1 4ab8ca0ecb758d660c9187a041ad7aab8117e87c
SHA512 a92134eb91b3c580780ff5c03d0b3120ecaba9de9b817445e815af4cf27644be26ee44530339f9ee4de61fb3115cb4362819a99cae906610b8ed53d5c2798c31
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1E234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicauskf.exe

Path C:\Temp\i_sqkicauskf.exe
Size 226KB
SHA256 e9796bd6646e5a15be8204c54e81ad33aeec73ffb12fc94906ead6d8d6c251f1
MD5 4369de915885995e856f7755e1a51bce
SHA1 8beab32fcf9eef6820216ed88543f372f5c6efc8
SHA512 8c0a36607ab6c3aee248ed97b467430ac40d46e4d9b0293670767dc4246ed59120401a4381a021d286ef9f6ad7ef132aeb3049eaa753350bf68de90606312efb
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwuomhecwu.exe

Path C:\Temp\i_zwuomhecwu.exe
Size 226KB
SHA256 ff20e3052656713a5dacfbea4f83d161cf50555f3f9de8368bb95dd2e1c55cdb
MD5 60d292539162bff680b319cb0ab98284
SHA1 ee17c60bd328f611aeea8ba222b058bba2dfa8df
SHA512 efb57c228321e33c3a1a5216c3ae75f326e8ea11af7af642ec13fc0c68b9dcf6f3dcf0c32ef0f214a8bfa536048a910ffd876742ac43c0f10926b3c9f2c89053
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbzwuolgd.sys

Path C:\Temp\jdbzwuolgd.sys
Size 141KB
SHA256 cb420681d8d07b79ab1f868751fbd6a38af2826a5235c6ce6c2bb5bd09f81063
MD5 e7ed176b0420948b608f4b1b671630eb
SHA1 04838f94e4d368e1f6971fa1558adec33c84532c
SHA512 33725a955d4fe15e820a7c5bd43dd3bb73f6c69c6499a98528f4a94779f487cf5ed779742026b3ebd73694abd33c3265702251ff2636e48f46854121aa339dd2
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T107E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbztrojh.exe

Path C:\Temp\ljdbztrojh.exe
Size 226KB
SHA256 994a6d0d3a7283fa2385218022ca3c0d9d5fe8d3f8447875361f78646a0dabb0
MD5 7cbaf952b27ca5aa342212fa2e51a0da
SHA1 6f64b83f88ed53c284262cece8741da81d9b3dcf
SHA512 614c8fe79c6409e0b3e2a326df77ba019463d354641912ca7e28c9f7d50a80b5f240c7eb387b16aff1fdef3c6f282b08ca605becf95739d2509677e9b983e3d3
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcausmke.exe

Path C:\Temp\mkhcausmke.exe
Size 226KB
SHA256 c816cb3881dd23f3c69ded8e1075af86e14f27f30e95a80a4c65c02d2ed64f92
MD5 adbc6a14b3c69deb2ad96db01e7f12d8
SHA1 65aec24eb432db4c9e69bcbd139a61721d8c1399
SHA512 218fd1b88cb13e15cf1ab828ec4b54fa31d1d497b903d74e7f7320a3a30b3b877c413b0fc4670ad7a9f6a7e6705817ffc7d2fd7a731693c688351a8f4a739aaa
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtqoj.exe

Path C:\Temp\nljdbvtqoj.exe
Size 226KB
SHA256 78480cb58390b95493f7dcb42b6d366148662d0289990af286b705d4b8f9e1fe
MD5 444a7f10cd8e1efc0818d569e15b5ea6
SHA1 b4327e90d877ea0f2a83cd43bc10ab9290896b84
SHA512 322b8dc33aaea83989c0cd73921a73520582545527d9811dfc53d23b456b5f07863ee6027a055c8a161c8bd62c129b4c2c4bd5a2013affce1c400825c157647e
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T10234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytqljd.exe

Path C:\Temp\oigbytqljd.exe
Size 226KB
SHA256 f4f68a5c83645378498db67b53f984bb0299eabdeaf6d4985f8bd9eb1a417040
MD5 5859a4777f8c13bb96405e114e284466
SHA1 cf2dcc17a6ec2999df5eac2e6eaa6659ae4162c9
SHA512 f257ea738a475269579629ec221c9d13f50507926d3191c27f758c493cd9ea3fb6839b4bb499a98b72efdde38183a7248aa1cdd43d05988ea85884d7c9c91f1e
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1FF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olidaywqol.sys

Path C:\Temp\olidaywqol.sys
Size 141KB
SHA256 5a258ce8a37087429897c938cff36cc01330ace6af9bfb63d36a7afe8150e873
MD5 41b00d0c6f6f4106148fab4af4544027
SHA1 49f40992cb1c14b2c3c1e1427cf32ae21ce18779
SHA512 1271af0a53eddf8fdf7979cecef4501dc5266cad946055582a472b68cbddb897ece0c5f2746997cffd0c4c1cdc54fa5f55ced261c0f4f409f06c4e7ec1c98f38
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwuomg.sys

Path C:\Temp\omgebwuomg.sys
Size 141KB
SHA256 af204e20230159e0cb7a5cc0e3e924941d9e441c4a3be6232146bc7b01d16818
MD5 dbee0b7fbb01c93b00f1d57a29372bf3
SHA1 dbc612342da5cbf5a3ba70a49d1eb55d576095f3
SHA512 3db784cf0c58438dd625e6fe37d92d218b4783dbe2681bdc856a4a399faa576f1ac5649ede33c3e3ef3c93c3ad7f1c5c57c6d5c20e028e6cacf5f926be64b91a
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfzxrpjh.sys

Path C:\Temp\pjhfzxrpjh.sys
Size 141KB
SHA256 2915586a2f27781c0919248316c4944c8c23b7c5a7c5ee0dd64005361e6aecf0
MD5 5d1571c4d2822946a9e9a564730872bb
SHA1 c4695921bde9ab76e3e9253d09674ff51e49d459
SHA512 73b435579f2536ee38cf422fa45fff677eadf720d0145e5540ad63cbc252c2e0e5b10425fd4cda6e5359985ab2ae58aa20e04d9ca8e34fe1e1f69c64210e82b6
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicauskf.exe

Path C:\Temp\sqkicauskf.exe
Size 226KB
SHA256 7a4904cdbf9f5f61a3f081d1ed5902e9f9b30d7bd83b110939f6043f35bdf134
MD5 e67a168bbc2b169f93e12f8ce15a6fce
SHA1 c4056dab335a1be1111a831b6aba606debef730d
SHA512 977129276bf7fd27b10a756434cc4191852da37496839d688068059862e31fbe4068c2287df8d6ea02a1e26395729e294d19f23e5d43dc9f9bfcde3420f8f744
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T18234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtnl.sys

Path C:\Temp\sqlidbvtnl.sys
Size 141KB
SHA256 587d47a12616e4e2c5afd6bc1e84299dd91d8772314741bfa69b242f836ca0d0
MD5 27b6e534db473c6e99420c36a7efe9f7
SHA1 937e0c7f123a3ce0e12f9ef4a95870f8299057da
SHA512 5f5ec92497547e1fd7ef3326b46b6c4927a2242d490468abc8bed07023f576596639309fd469cc6ce9328bd1d82029b8d88f23678bcb79b3e795f713f5149af7
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomhecwu.exe

Path C:\Temp\zwuomhecwu.exe
Size 226KB
SHA256 85759975b0b6e999431682b62e8e3d4183782596d2f465ac9639654b69a1ccf9
MD5 e185a8c48ec33d8af6e7be14f268d96c
SHA1 08c839614226703685c5eff09518d7025206c71d
SHA512 22799010e1a2a75eab7e5e47f10299b5eb6ed0de6b9e86c4049eff1f73f4dd00cf4c99a7a2d1d8330c7b2ad1cda3fa00bb25d95566660532a6f14c56134ec9fb
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwurmjhezw.sys

Path C:\Temp\zwurmjhezw.sys
Size 141KB
SHA256 40e18268d9ce7f69650a6319d19d0fb07889b8ce9be8e3fa2aca83978a08a019
MD5 a8e202f241e907a06efb9d1d71965a85
SHA1 2a0d06094009ebcb6ca6b2504c68289df60d4e8b
SHA512 c73abbf1b8ab1972a526e62ea635ffb61a945ac27cd739d19b338ec1898f486c91295c96fc2cdb21d4c8c78b601b97cb48d632a0f27ed45c82d5e93d5ce97c1b
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 38699760dd727655a4af5831df2b1296a7dc888e4d7b3975cdbd7bc6ef07a963
MD5 bc5b1c02982829cd87a96e248b21a9b8
SHA1 3dabb097611624dda22547aa42f1f70e55d2d348
SHA512 a2471d7b6b112809c614d38df0240b6119d83f8045ec7b56c67e3a402f0b1ded21e3266b0140b4be40953d095dee07f50e3086b65dbdefce37dc8a4b522ab29a
TLSH
T18B3161708F3426FFDBAF45B657D24A9C3371885B37076F5023546DB44A49377101001D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8e3082bddb4fddf1fc8e628773fa08d50f5f363d34c5d71e957a3bfb16f29e0b
MD5 378f423e94104a15d3ca39939684acc2
SHA1 00e839b939b37f10f9ef649a54153a9c58deaeda
SHA512 f4d338ecc75efe4816401cbb687dd5f40c4480a6b6456a9a7a89af69d3db09b98839d1fe1efeb08a8be4b4ad546e7cd61c0d74f95dab3e3a891fed1564925cdc
TLSH
T1D04180F387F4856E890156F0AA146F1FCE1D0515432C7D5AC9E4AE2793F3871E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d777edcf99cbd4985f1db1be091125b781854047770982998573a982fbd26ab7
MD5 05651b5d553596f35d3d2cad4737ec60
SHA1 0b6702f64bd218bc036f7a2f8dc3da09d2e23c13
SHA512 d65aff547659c89c6d444e0de3eef43ab350490bdc88fdb710366bf9412cf3ff4dfc2e6e511f8b53e061af6d2ce1186be54e6435c63d2e7da9024a77d4ab5864
SSDEEP 192:sxRsR9Cp/f0s9LgZszoA8p9G/g6+WNCp+/Yo6y9YXG8IgDZgJ:sxRsap/f0s9L+dQ/55/HCS
TLSH
T1D942C9156E28A93B4CC7E21DBA55BF53D3F91032A1D56F48AAFC8A1C04E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 15c9077856d6c136ee2011c833ff3706084db083524f126f5f5c979a094b951f
MD5 607623af2f338193bd2f5e6870100fa8
SHA1 70eb6fddf96f1271f1c6024e78497f9718e91231
SHA512 74e1f807c2a6d596390e0f35f185d0056dd4fb361878e6a5d32b940379407505ab8878faa027338bef37b45dedb12cec56836afcd9eeb95902008e6965f8a043
SSDEEP 192:sxRbR9Cp/f0sYLgZszoA8p9G/g6+WNCp+/Yo6y9YXG8IgVgJ:sxRbap/f0sYL+dQ/55/HCK
TLSH
T14D42C8156E28A93B8CC7E219BA55BF53D3F91032A1D56F48AAFCCA1C04E66DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c9575e32872c6ba726091d84ac00aab60c12912957ee993b422ee7482b932603
MD5 1f502f725be03ccf2d760194000ae9cc
SHA1 951bc91a43890e1fa276ebac9b823cec47173f5a
SHA512 3e41706b4dfc641fa20d651835a08f719cf990271e177b11f6d1e5dd96c2a30178cd2774645bc9ff76123223cc2839553c1604702c7bd5d556b01f4c04528158
SSDEEP 192:sxRsR9Cp/f0s9MgZszoA8p9G/g6+WNCp+/YoMU9YXG8IgDzgJ:sxRsap/f0s9M+dQ/55/dCk
TLSH
T16442C8156E28693B9CC7E209BA55BF53D3F91032A1D56F48AAFCCA1C00E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e52042cd9f385b8b60e31945da5379f0e575337e535844be1f8d42674564cd80
MD5 c0dcc130f5af669367d9995b844b6ebf
SHA1 81145e94aa22c12c2ca948f30e8e34d98f22183c
SHA512 2c93008d7a67051989c9ac03f7cd29a1aab516d088b572a5954c306dff0443142d6a7350f30b5b3a32724a312b0373c161e2e4d6b2fa384543c589ff0f52b611
SSDEEP 768:j26Hio7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVy2BVuwrro9oe0Y:j26HiUE7MRWgs2f02u1jat2B4wYD3
TLSH
T1A8D2DA7B640DCABF4F800ADDEC197EDF6D6802CB9698CD8047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3d4d3a408c8264ac53473c787da602443d2e11bfbff18d84e8af023368f6b0aa
MD5 b5d8f6695ec35aef1ceb5d1da71eadab
SHA1 30d8c8980df25041f385ee558992df052e81ff3f
SHA512 f3458328e58b3d1a19a48bda4cb3209949db54301afbe74ecc36ed6f6940afe3ef53a44e29c93d7f5705f072025f24de0a0311b0c05d61ed43228fbff1665a9b
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyLR:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgIL
TLSH
T166910321733713803C7EA99D9179941BD2C171A23214B52B3BA813A65F27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad998.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad998.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1fbf9a359d8fd0c9e5857c2e563272e4352a3492c39f5c4712664bff56e689c0
MD5 49a40d61f5a6b0d00d23799e414d8cb4
SHA1 71afe7882808e4ea22b502deb0776880d5c48bf4
SHA512 9c5828a23b0e890a9a789cea40f10eb428c5fc1e7167365d9fe04585b85bfced279593fc1e48a1b406e762e40882d859f55d3f7569a75c54772e75cb6868ec07
SSDEEP 768:CFQ137wgIwh/psOW773njt1ONXyer1IRCzni95Pi9PItT:Z131wSIqnqPTtT
TLSH
T1D51328F595D79937D8AEA783A73D6E429EBCC063B5848680BBD55E0CCC8217FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 06bcc620591200f6fa387324436a1f98fbb8b88573c39cd0a487ee150b578f95
MD5 b2ebf2d9bff426548694a01f8f66c1fb
SHA1 3c55ee7ad44f1eb7ee00379b18758c7ce00f9da6
SHA512 6481514161b0349d315093b3cb63dd3afcf4b91384541ff07c4981d87347db8cfe28767d2bf9bb10d5a43a91eabc9b9f9ba984a25d63d42814fceb1b115d5e4a
SSDEEP 768:tq3cqhM/TBOW773njtrONXyer1IRCzni95Pi9PItT:tq3e/SIqnqPTtT
TLSH
T1C0F2BF30E5A99D234CE6F3C6B6466783BFF81067D5C44B50EEE99B0D058362E170B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1f9bc4e1e23c42f6a6fc26345a7e841c7ee7f78d9a1dadbbc2c298c5b1b93c93
MD5 2ff8bd04839fc7c4db2a2c6ce7126b5d
SHA1 38d83e01344273172f25070fa8adb1ba42e2500c
SHA512 2ee7e9228ef77bd59b3d40ef0aa3f1f13a7796f3d41f158facf4a3beb115d3c369322358d06f4f8c519b178849ce20774a7030c55a384ef8da736eec40f32b78
SSDEEP 768:Bq3JqhM/TBOW773njtrONXyer1IRCzni95Pi9PItT:Bq3p/SIqnqPTtT
TLSH
T140F2BF30E5A99D234CE6F3C6B6466783BFF81067D5C44B54EEE99B0D058352E170B42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a77b1efe6d6f84ee9d1b97769544f90a3573fa06da9f8884d075aae44fda64f0
MD5 f952a55ddce5899d99745a8a8967891f
SHA1 848cc790370016f5080b9491303f5497f207518a
SHA512 e64e63264bd5e1925ab58f8e5bf250d4f0dd11d7a107a27fc6d7104f2bdd506e33302788e4d88cf9f1e8eb0d646cbcae1f4cc6743fbf18baf4ae43ce477bffd7
SSDEEP 768:rrv+4UNbdl3RfhM/TBOW773njtaONXyer1IRCzni95Pi9PItF:rbsbL342SIqnqPTtF
TLSH
T14F13BE31E1689E238CE2E3D6B14767837FB810A7D5C04790EEEA5B4D058756E270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e899aeed1c7f74ca56119bcf7ccc02161760fcd7e340bcf243c32dcc8d1651ff
MD5 e8f2c817c3472b5974b6dfebcd0a6c43
SHA1 f7a12449ee96847d253ce608e6b93096af6f6bcb
SHA512 83b736fe97e244eeb1df7939fedf2018ebbb46faff230f5ea644aebe1d7d78a77331b9d0756ad20b52c8d6619d3f3f5b2161e9835c2ce860c0667ec79ae5df53
SSDEEP 768:Hrv+4UNbdz3Hh+/TBOW773njtaONXyer1IRCzniw5eVH1SK7:HbsbV3U2SIqn1EH1l
TLSH
T1E403BF31A198DE334DE2A396B147B7837FB82067C5804B90EDEA1F4E059759E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b51147af024ba46722b2f8b41f73b61628b14649f4f1735210e1d47b788271e
MD5 3ca596b4af3e91ce53fca37d6af652a0
SHA1 d2a35a8595c988624f462bd98ba7ac6761c00e16
SHA512 2817e73c6d30b582c8af847049b93b27e3133e13f0953091497cd3c0c6e0168ded200ef83f8bb1ec37d21817cf04996913e4dbb6de2039f2e0158be4a160345f
SSDEEP 768:hrv+4UNbdz3Bs+/TBOW7734ONXyer1IRCzniBqeVH1SK7:hbsbV39mSIqnNEH1l
TLSH
T10403BE36A4A89E338DE2A385B14776437FB86057C6840B90EDEA2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

b37ada56-17bb-4fd4-b295-9c1bc649cbb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b37ada56-17bb-4fd4-b295-9c1bc649cbb1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5984_1263166855\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1344-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1344-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1424-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1564-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1840-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2616-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3252-255-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3284-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3352-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3988-385-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3988-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5092-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5340-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5480-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5524-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5764-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5928-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download