ea3580f5368c8f24c8c0c53b4960ae9f1edd1f8fbe407cc7487ade2eaeabb008

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260818-wefhraer3w
SHA256 ea3580f5368c8f24c8c0c53b4960ae9f1edd1f8fbe407cc7487ade2eaeabb008
MD5 60b8cd766dd61fdc4d9e0526f1682494
SHA1 f823211fa7495f8551ad95a20eb96e3b3324c8a3
SHA512 9d899808b90fd03485273f63f440f6a5747710005136879827aff8370e5a0526db43b12911ffbf1022af1d4219f99ec631a7809e5ed12361bb2fd4971bba9af2
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T18834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
752	CP.exe
4872	naytnlfays.exe
1740	CP.exe
2256	CP.exe
5720	i_naytnlfays.exe
240	tnlfdxvpnl.sys
1696	CP.exe
4104	lfdxvqniga.exe
3508	CP.exe
6112	CP.exe
5172	i_lfdxvqniga.exe
3516	dxvpnhfzxs.sys
4156	CP.exe
4556	xvspkicaus.exe
3148	CP.exe
5200	CP.exe
2240	i_xvspkicaus.exe
2092	pmhfzxrpjh.sys
3372	CP.exe
1856	hecxupmhfz.exe
2040	CP.exe
6044	CP.exe
4108	i_hecxupmhfz.exe
5840	ecwuspkhfz.sys
1520	CP.exe
1968	rpjhbztrmj.exe
1668	CP.exe
3180	CP.exe
3516	i_rpjhbztrmj.exe
4608	ezwrpjhbzt.sys
3868	CP.exe
2268	ezwrojhbzt.exe
5836	CP.exe
3556	CP.exe
3852	i_ezwrojhbzt.exe
252	qoljhbztrl.sys
2764	CP.exe
1476	tromgebztq.exe
4164	CP.exe
5088	CP.exe
6128	i_tromgebztq.exe
4544	dywqoigayt.sys
1468	CP.exe
948	eywqoigbyt.exe
2904	CP.exe
5912	CP.exe
1448	i_eywqoigbyt.exe
3376	geywqoigay.sys
3960	CP.exe
1420	vtnlfdysqk.exe
3160	CP.exe
1772	CP.exe
3188	i_vtnlfdysqk.exe
3048	sqoigaysql.sys
1216	CP.exe
6060	nifdxsqkig.exe
4208	CP.exe
5540	CP.exe
4152	i_nifdxsqkig.exe
4480	ifaysqkifa.sys
2228	CP.exe
2020	fdxvsnkfdx.exe
4464	CP.exe
5172	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1541553057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_1541553057\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2028_2005810907\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzxrmjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzxrmjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxsqkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligayvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgebztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	naytnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoljgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgebztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_naytnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligayvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxsqkhczx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5896	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3220	ipconfig.exe
2824	ipconfig.exe
404	ipconfig.exe
1108	ipconfig.exe
2508	ipconfig.exe
2236	ipconfig.exe
1404	ipconfig.exe
3032	ipconfig.exe
5660	ipconfig.exe
5748	ipconfig.exe
5380	ipconfig.exe
2916	ipconfig.exe
3804	ipconfig.exe
2508	ipconfig.exe
4428	ipconfig.exe
4104	ipconfig.exe
5988	ipconfig.exe
4716	ipconfig.exe
2572	ipconfig.exe
4348	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315489978451347"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{E0D2555A-1166-4667-B56F-5E4A85952C9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5720	i_naytnlfays.exe
Token: SeDebugPrivilege	5172	i_lfdxvqniga.exe
Token: SeDebugPrivilege	2240	i_xvspkicaus.exe
Token: SeDebugPrivilege	4108	i_hecxupmhfz.exe
Token: SeDebugPrivilege	3516	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	3852	i_ezwrojhbzt.exe
Token: SeDebugPrivilege	6128	i_tromgebztq.exe
Token: SeDebugPrivilege	1448	i_eywqoigbyt.exe
Token: SeDebugPrivilege	3188	i_vtnlfdysqk.exe
Token: SeDebugPrivilege	4152	i_nifdxsqkig.exe
Token: SeDebugPrivilege	4484	i_fdxvsnkfdx.exe
Token: SeDebugPrivilege	1424	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	1860	i_zxrpjhezwu.exe
Token: SeDebugPrivilege	236	i_hbzxrmjhcz.exe
Token: SeDebugPrivilege	2444	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	1828	i_ywqoljgbzt.exe
Token: SeDebugPrivilege	4692	i_oigaysqlid.exe
Token: SeDebugPrivilege	5572	i_qligayvqnl.exe
Token: SeDebugPrivilege	5764	i_ifdxsqnifd.exe
Token: SeDebugPrivilege	2700	i_caxsqkhczx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4876	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 4876 wrote to memory of 2028	4876	iexplore.exe	89
PID 2028 wrote to memory of 4568	2028	msedge.exe	90
PID 2028 wrote to memory of 1752	2028	msedge.exe	92
PID 2028 wrote to memory of 5896	2028	msedge.exe	93
PID 2028 wrote to memory of 1752	2028	msedge.exe	92
PID 2028 wrote to memory of 1752	2028	msedge.exe	92
PID 2028 wrote to memory of 4364	2028	msedge.exe	94
PID 2028 wrote to memory of 4364	2028	msedge.exe	94
PID 2028 wrote to memory of 5716	2028	msedge.exe	95
PID 2028 wrote to memory of 5716	2028	msedge.exe	95
PID 2028 wrote to memory of 5716	2028	msedge.exe	95
PID 2028 wrote to memory of 5632	2028	msedge.exe	96
PID 2028 wrote to memory of 5632	2028	msedge.exe	96
PID 2028 wrote to memory of 5632	2028	msedge.exe	96
PID 2028 wrote to memory of 3420	2028	msedge.exe	97
PID 2028 wrote to memory of 4184	2028	msedge.exe	98
PID 2028 wrote to memory of 3420	2028	msedge.exe	97
PID 2028 wrote to memory of 3420	2028	msedge.exe	97
PID 2028 wrote to memory of 4184	2028	msedge.exe	98
PID 2028 wrote to memory of 4184	2028	msedge.exe	98
PID 2028 wrote to memory of 1728	2028	msedge.exe	100
PID 2028 wrote to memory of 1728	2028	msedge.exe	100
PID 4172 wrote to memory of 752	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 2028 wrote to memory of 4856	2028	msedge.exe	103
PID 2028 wrote to memory of 4856	2028	msedge.exe	103
PID 2028 wrote to memory of 3256	2028	msedge.exe	104
PID 2028 wrote to memory of 3256	2028	msedge.exe	104
PID 4872 wrote to memory of 1740	4872	naytnlfays.exe	106
PID 2028 wrote to memory of 5224	2028	msedge.exe	110
PID 2028 wrote to memory of 4444	2028	msedge.exe	111
PID 2028 wrote to memory of 4444	2028	msedge.exe	111
PID 2028 wrote to memory of 820	2028	msedge.exe	112
PID 2028 wrote to memory of 820	2028	msedge.exe	112
PID 4172 wrote to memory of 2256	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4172 wrote to memory of 1696	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4104 wrote to memory of 3508	4104	lfdxvqniga.exe	122
PID 4172 wrote to memory of 6112	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4172 wrote to memory of 4156	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4556 wrote to memory of 3148	4556	xvspkicaus.exe	131
PID 4172 wrote to memory of 5200	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4172 wrote to memory of 3372	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 1856 wrote to memory of 2040	1856	hecxupmhfz.exe	140
PID 4172 wrote to memory of 6044	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2028 wrote to memory of 6008	2028	msedge.exe	146
PID 2028 wrote to memory of 4152	2028	msedge.exe	147
PID 2028 wrote to memory of 1328	2028	msedge.exe	148
PID 4172 wrote to memory of 1520	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 1968 wrote to memory of 1668	1968	rpjhbztrmj.exe	153
PID 4172 wrote to memory of 3180	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4172 wrote to memory of 3868	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 2268 wrote to memory of 5836	2268	ezwrojhbzt.exe	162
PID 4172 wrote to memory of 3556	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4172 wrote to memory of 2764	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 1476 wrote to memory of 4164	1476	tromgebztq.exe	171
PID 4172 wrote to memory of 5088	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4172 wrote to memory of 1468	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 948 wrote to memory of 2904	948	eywqoigbyt.exe	180
PID 4172 wrote to memory of 5912	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 2028 wrote to memory of 696	2028	msedge.exe	185
PID 2028 wrote to memory of 696	2028	msedge.exe	185
PID 4172 wrote to memory of 3960	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 1420 wrote to memory of 3160	1420	vtnlfdysqk.exe	193
PID 4172 wrote to memory of 1772	4172	2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_60b8cd766dd61fdc4d9e0526f1682494_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x304,0x7fffa11ac188,0x7fffa11ac194,0x7fffa11ac1a0
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,15523269573718907880,9712080326760436406,262144 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:2
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,11224657600550832299,17834375719073091679,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:11
      4⤵
      System Time Discovery
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,11453963649561498422,12501298431880653300,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,14259418630395904380,708911123997862179,2097152 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,15782666294922942552,8173715456732482910,2097152 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4372,i,7793221125037189529,11378888369419502586,2097152 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,8406042671302659480,8414266936401372839,2097152 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:9
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,8014826221351528020,17361673742383309648,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,3584712619431493515,16781742940516495262,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9388557675642855914,3344329153859232922,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9108153869366841523,13636677599341669428,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9108153869366841523,13636677599341669428,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,3958817844115509259,11448978191823426079,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,3457965070007013526,2643774509803399840,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,16346421003777965247,14656178020486388182,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,7288995356148415105,13209808773237050030,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,10249367280461884928,7114587915934085618,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,5129409494261721219,1293240054183405323,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,4663482184427724226,14101529141685192815,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5180,i,1151817822726217531,3255982955867933542,262144 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6069639182396769776,4203587973545423141,524288 --field-trial-handle=2660,i,17697781762852385880,14039356321222129939,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\naytnlfays.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:752
- - C:\Temp\naytnlfays.exe
    C:\Temp\naytnlfays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_naytnlfays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2256
- - C:\Temp\i_naytnlfays.exe
    C:\Temp\i_naytnlfays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6112
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvspkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4156
- - C:\Temp\xvspkicaus.exe
    C:\Temp\xvspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvspkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5200
- - C:\Temp\i_xvspkicaus.exe
    C:\Temp\i_xvspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecxupmhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\hecxupmhfz.exe
    C:\Temp\hecxupmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecxupmhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6044
- - C:\Temp\i_hecxupmhfz.exe
    C:\Temp\i_hecxupmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1520
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3180
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3868
- - C:\Temp\ezwrojhbzt.exe
    C:\Temp\ezwrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3556
- - C:\Temp\i_ezwrojhbzt.exe
    C:\Temp\i_ezwrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tromgebztq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\tromgebztq.exe
    C:\Temp\tromgebztq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tromgebztq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5088
- - C:\Temp\i_tromgebztq.exe
    C:\Temp\i_tromgebztq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1468
- - C:\Temp\eywqoigbyt.exe
    C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5912
- - C:\Temp\i_eywqoigbyt.exe
    C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3960
- - C:\Temp\vtnlfdysqk.exe
    C:\Temp\vtnlfdysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\i_vtnlfdysqk.exe
    C:\Temp\i_vtnlfdysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdxsqkig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1216
- - C:\Temp\nifdxsqkig.exe
    C:\Temp\nifdxsqkig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdxsqkig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5540
- - C:\Temp\i_nifdxsqkig.exe
    C:\Temp\i_nifdxsqkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvsnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2228
- - C:\Temp\fdxvsnkfdx.exe
    C:\Temp\fdxvsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvsnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5172
- - C:\Temp\i_fdxvsnkfdx.exe
    C:\Temp\i_fdxvsnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  PID:3656
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  PID:5640
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhezwu.exe ups_run
  2⤵
  PID:3128
- - C:\Temp\zxrpjhezwu.exe
    C:\Temp\zxrpjhezwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhezwu.exe ups_ins
  2⤵
  PID:5780
- - C:\Temp\i_zxrpjhezwu.exe
    C:\Temp\i_zxrpjhezwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzxrmjhcz.exe ups_run
  2⤵
  PID:5348
- - C:\Temp\hbzxrmjhcz.exe
    C:\Temp\hbzxrmjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzxrmjhcz.exe ups_ins
  2⤵
  PID:4480
- - C:\Temp\i_hbzxrmjhcz.exe
    C:\Temp\i_hbzxrmjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:4812
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:2360
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoljgbzt.exe ups_run
  2⤵
  PID:3492
- - C:\Temp\ywqoljgbzt.exe
    C:\Temp\ywqoljgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoljgbzt.exe ups_ins
  2⤵
  PID:1644
- - C:\Temp\i_ywqoljgbzt.exe
    C:\Temp\i_ywqoljgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run
  2⤵
  PID:5028
- - C:\Temp\oigaysqlid.exe
    C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins
  2⤵
  PID:972
- - C:\Temp\i_oigaysqlid.exe
    C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qligayvqnl.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\qligayvqnl.exe
    C:\Temp\qligayvqnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qligayvqnl.exe ups_ins
  2⤵
  PID:5004
- - C:\Temp\i_qligayvqnl.exe
    C:\Temp\i_qligayvqnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxsqnifd.exe ups_run
  2⤵
  PID:2980
- - C:\Temp\ifdxsqnifd.exe
    C:\Temp\ifdxsqnifd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxsqnifd.exe ups_ins
  2⤵
  PID:2684
- - C:\Temp\i_ifdxsqnifd.exe
    C:\Temp\i_ifdxsqnifd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxsqkhczx.exe ups_run
  2⤵
  PID:2280
- - C:\Temp\caxsqkhczx.exe
    C:\Temp\caxsqkhczx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxsqkhczx.exe ups_ins
  2⤵
  PID:1244
- - C:\Temp\i_caxsqkhczx.exe
    C:\Temp\i_caxsqkhczx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3372

C:\Temp\tnlfdxvpnl.sys
C:\Temp\tnlfdxvpnl.sys
1⤵
- Executes dropped EXE
PID:240

C:\Temp\dxvpnhfzxs.sys
C:\Temp\dxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:3516

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\ecwuspkhfz.sys
C:\Temp\ecwuspkhfz.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\qoljhbztrl.sys
C:\Temp\qoljhbztrl.sys
1⤵
- Executes dropped EXE
PID:252

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\geywqoigay.sys
C:\Temp\geywqoigay.sys
1⤵
- Executes dropped EXE
PID:3376

C:\Temp\sqoigaysql.sys
C:\Temp\sqoigaysql.sys
1⤵
- Executes dropped EXE
PID:3048

C:\Temp\ifaysqkifa.sys
C:\Temp\ifaysqkifa.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\zxupnkicau.sys
C:\Temp\zxupnkicau.sys
1⤵
PID:4520

C:\Temp\nhfausmkec.sys
C:\Temp\nhfausmkec.sys
1⤵
PID:4376

C:\Temp\kecwurmkec.sys
C:\Temp\kecwurmkec.sys
1⤵
PID:5352

C:\Temp\jhbztrmjey.sys
C:\Temp\jhbztrmjey.sys
1⤵
PID:5916

C:\Temp\bwtoljgbzt.sys
C:\Temp\bwtoljgbzt.sys
1⤵
PID:3964

C:\Temp\bywqojgbyt.sys
C:\Temp\bywqojgbyt.sys
1⤵
PID:3124

C:\Temp\tqligaytql.sys
C:\Temp\tqligaytql.sys
1⤵
PID:3336

C:\Temp\kifaxvpnlf.sys
C:\Temp\kifaxvpnlf.sys
1⤵
PID:4952

C:\Temp\causqkicau.sys
C:\Temp\causqkicau.sys
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnhfzxs.sys

Path C:\Temp\dxvpnhfzxs.sys
Size 141KB
SHA256 12998069ca4973a5cdd32023b4441eb8975eefd1291c4539f92089eaa026596e
MD5 359b07861db808b02ebd6ea005b293fc
SHA1 4c0501b20d51fbb93528a08984dfee73248db60f
SHA512 6af0d632ccc7486f67e8aa3944056a5835f6c6da12971649ca68e5aa6d81082b95b24b00f7c7dfdcd9dfcedaff50a03ec0d7692da391341b3c2bda98793fcba7
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T191E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuspkhfz.sys

Path C:\Temp\ecwuspkhfz.sys
Size 141KB
SHA256 78a65113a60fa115a238d5022e961a3146e454e9f0d5f4c6829b79f433900817
MD5 8dc67807bbfe1c7be0769ed5db28da55
SHA1 d4e717f121b99aa953d462a5dd93b0bfb010bf9f
SHA512 347a30067a4ac860bbd688ee70cc27558642a74bde7630aa9f823d348edb83af502c76f0b72a7107bf2020f175803933abe88b9ccb080674fa349b550cfacb90
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrojhbzt.exe

Path C:\Temp\ezwrojhbzt.exe
Size 226KB
SHA256 53478661939775f4d8ced0258640988c8bd378676c114702745f274aaeaed575
MD5 a2c3166f47221771d319c5aadf056dd8
SHA1 e52259976a3f3c7f65686ea9a104ec393b03e4d8
SHA512 f04beef4a5e29842e14f1ea2c78dc0bed891dac83230b1094ea7bf03f232c5152b635a3285f15fbe47920a2c1571385449fa992ff4af76b3780acc3789ccb04f
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.sys

Path C:\Temp\ezwrpjhbzt.sys
Size 141KB
SHA256 91527723f609317446bba17e03053b2ad0cdf423af2653f762e8c6d07c0ab6ea
MD5 8ca27f43998db42bed5a6b3f0407389b
SHA1 92610bd71ddea1996c833483f6669c09f098d4c9
SHA512 02d0989b7abad41065d0dad5e95d3e067a36ca5de7f6b66054fb337324445baca3b8ad3e4fb5c01205a7a63294dbc557d3e670052cacd80cf37c30bbaa95c03d
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxupmhfz.exe

Path C:\Temp\hecxupmhfz.exe
Size 226KB
SHA256 581ed4f16ed5965d084736ab820193a43d61079fa5469abafb874954e80163e8
MD5 2066bf3a89c7bc1d0eea5d890bfe5fbb
SHA1 f850121a38356209554dbe9cde8516d892329c48
SHA512 96073ca585d35eb9dd532e97477fcfed32af34f3bbc79621bf9bd9f603d2d104d96841a2d9e3f4ad4855f46ebaba75c6ce340f540d3bcde71ee295fc17af189a
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T16734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrojhbzt.exe

Path C:\Temp\i_ezwrojhbzt.exe
Size 226KB
SHA256 c9325411173c56bc89ec4382361150c165ae8237fbb2d1fced49b04a492ba6b4
MD5 f96733538dcbfda20488f05f912c2662
SHA1 5c8a98142155287e4254831c4ccdfd7f4ecb6378
SHA512 3d53f0e851000750002bbae64182162920572b0f6111dd1c04188573e9c1d6f6ee3ba6e8385b21d7ec42066ab37d9c7f604fa61371cdcd2812d3ff0efccbcad6
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T11834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecxupmhfz.exe

Path C:\Temp\i_hecxupmhfz.exe
Size 226KB
SHA256 c8093dc66aa3f95911dc74f28b04ad81237378676fe3b082064349e1abfbbc51
MD5 0208010e0950a81cd61c0ff406d7c278
SHA1 0a30b50870fe9ba512838656ba653d07061c22d9
SHA512 6ce9f4d1800191d1accc543da8c58b3e3ec200a45b517fe73f8da092e77e402e1925f5328619e0ec32ee6d493f07b93ec9092c8948623f3041da7414f6dd6387
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqniga.exe

Path C:\Temp\i_lfdxvqniga.exe
Size 226KB
SHA256 55e219106c62b8f07787c3dee5a3af00c3a5c4dfe81087a3ba028d004e8f72d0
MD5 657fbd4bbdcdd33ba903aae567ef18f7
SHA1 f2f6c8cbb5404e666361ebefe54c75d83580dc26
SHA512 2ca1b23d8b4692e867ef29bbbb878773906eef8be2787dd1bdca68217c940f368f60d2a1a8d0b364db52fba950f90e0169b9e293de27725939d48260a72ec2d6
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T19534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_naytnlfays.exe

Path C:\Temp\i_naytnlfays.exe
Size 226KB
SHA256 93d383b93d858a0bd223f9a452b27910f4dc4521aad980aee95822040572df83
MD5 0f66bd199c1cd6f8fa428ebc30e2fb6f
SHA1 fb94f214c4aa9a52bdbbfc2d715f804eb3efc1e5
SHA512 15ebe19bbdf9fa5fa8997829e280c13271e5d3f0665f6d5267f50cec66ed9328715ca66163c66bf7b4acb16b9c6e275f9b437453466b6628d9df77e88a15f2ea
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbztrmj.exe

Path C:\Temp\i_rpjhbztrmj.exe
Size 226KB
SHA256 0cc47b5e3aa4f0d1d1c3febf2d7acec865813d668f9f8b4f62168fb00703f772
MD5 13046db4189c625958ccfe93492ea217
SHA1 e305bf30eb412874099ebf1e2d38309ba2799c71
SHA512 42d6300e6128eeeb1c7d5a81971d807ca13102113844c1b33a6564e7efb20f089dd04295c17ed9b407f8c18946adcce48421698bc139bf892caabe472d94e319
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1A234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvspkicaus.exe

Path C:\Temp\i_xvspkicaus.exe
Size 226KB
SHA256 0476f2f73b53d0f8bf83cf81d89bfee1f581fd9c95b396a11366791d385a3f9a
MD5 73715feb1c4667f20f57c9021d19c27d
SHA1 c5d953425069f57159b06747831aedc0fa255226
SHA512 3b18eaa42a784a88e37f3a1497a543e2bbea37adf994800a40225436d1747497006fb4d70d93ef70b5156188c62455114be5f0cd79ac1a3b8e98f7aa7f7b11f9
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqniga.exe

Path C:\Temp\lfdxvqniga.exe
Size 226KB
SHA256 9cb8a0ed7a8f3d9bc9477b7aa5a336e7c9c6337c7ee52c3cffc7c8d18adf7e4d
MD5 9671a7c820ee345d1014803fc77c8596
SHA1 bc332701e825ea105092375a21b56ad3eaa3f9b5
SHA512 ce567aa64521bff7634c39a49ded876ecb4329b1675a04e67603b07cba5a6d19e85ce89d4f389dbf7f0b61af3ed9726753a0a0d3f0ebc69025ee6e77c0a152ee
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

naytnlfays.exe

Path C:\Temp\naytnlfays.exe
Size 226KB
SHA256 296f0fbc65b76109e327a10dc8808c70ed3c5e8f797c85794e4d658143672660
MD5 5dec89a10206719005307b9065b85404
SHA1 c6d467ed98fbf1bff8fafe1fdc1cc6d5db3c020b
SHA512 2157a7d6923f0090ef2013d846c3a5ad0fbe45efe482817cb26acc73372e96b733f4446be171591e088910bd4f57d36af5c49555cacdfaf62dbd17b4ee4d15e4
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1B334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.sys

Path C:\Temp\pmhfzxrpjh.sys
Size 141KB
SHA256 f1daaba0a1ed2992456d090d1f35ef9f195047e7fc3519b4731b549d06b26ec3
MD5 c9249fbc5bf80fc72b7a9536972bf571
SHA1 7e2577af0d657336723d8eecb99f9eae050194c4
SHA512 4ba7ea1e68abdb211bb7144281f398742dc33bf3e8af4b477064f9f7f15545b2b95ca66233507fa2a32abef3911cc20e41f23db91679ca573df648da7581b5da
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D4E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoljhbztrl.sys

Path C:\Temp\qoljhbztrl.sys
Size 141KB
SHA256 af253c741b62cb14283bd182667073400a1b8a96c598993ae011d78a83a60c59
MD5 39756a08a9fd4b39bed90adf75ce30fb
SHA1 414c6a6358d34d586bb63b9f9aa7b66d52e046d8
SHA512 c6ed6923128bf96142a8270f6c0309a61dfaed55763554a230b6df56fa48555b5eaf5e886b64611776d3951800dc67e88c16ed255e8ac37bd50b63e6c08a805f
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrmj.exe

Path C:\Temp\rpjhbztrmj.exe
Size 226KB
SHA256 55d7943a020a88fa2bb0b195654315fbc34fc4576a2560801004485d0462a6ac
MD5 43d9c7f86f82571f66e80300b2c48d18
SHA1 29188fe3285f07d4e6570ce91d026dce690ac667
SHA512 34252ecd3c3d5ebe4bec963ef0594ea9f1b1469c4d855b3ba653611e748bb9d5589ac17ca4e4b15acdbab74292e804747dc662ae5778060f865a7e70942dd530
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvpnl.sys

Path C:\Temp\tnlfdxvpnl.sys
Size 141KB
SHA256 d7ea2a96ef3c496af1347e375f675600cfe745bfa46a8a012c8b3918e7374b55
MD5 007c453a0e679664c78f582c7bd3e2b5
SHA1 a717b40a62eae24298de504c6b15a4fd0c88d822
SHA512 ed3297c02821afee93f35cddd2da75858b3fd10b202e6b2e05e46303a28ed1af9ecd174976676d933bcb8e7e522a1a635f5d30d2876a7ad959fd94cc9df5ddbc
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvspkicaus.exe

Path C:\Temp\xvspkicaus.exe
Size 226KB
SHA256 2d497759c1a562358f3ec6584ea66a6a0625036b487df3618d0f04bb12176d70
MD5 030d0bebea464c3c4b542e2cfe3641bc
SHA1 f9dc52acb0e1eefc4636b81ccbd3135dfba5d9bc
SHA512 586bcf902ca2184b3005a03b58fc24a0f01365702b1da4cbd3cf8830bd04ff60bc2e0653e922d2524c89aee23c6510e7b826d2ad8e3f62bbaa1687adaac9d3e0
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T13F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7e30c7d3d04d8117f950177cd9fc27898a4df3d09f791ecec544498ad21b6803
MD5 48cacb8e432195131d41bbdf324c4aa7
SHA1 71a250d2261d421135bf57887f0c6e5583862e99
SHA512 d6f177eb6cd170a913780923544154adc95f665c620b7e80b6c2d251f3099899974d77e892a6d2b69cf9b22c1eddc51da60c82ea3e2eab6a8a2f054488a0392e
TLSH
T11D41FC5CA33F8FCDE7A80972BCF1C6843E7DB8CE028BAE5150A4127E5AC638405611E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f38e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f38e.TMP
Size 2KB
SHA256 137e1063deceb36a29e8ac8adf4d414b446b5167b1a04c0ea651e8a42c0fc747
MD5 acd80f308526d190b5f04f4f96a7fcea
SHA1 ffeb21ac45963c01dd3f4b88b480761df3ab6f62
SHA512 c8783f3173f8a72d59911afe7fc5575e8233a78dc84067816e18f529daee2a689f49d454e6e4b40c9724139d44000c6cf88bf812dc24a4e469496ba13c8d1136
TLSH
T16741FC5CA33F8ECDE7A80972BCF0C6843E7DB8CE028BAE5150A4127E5AC638405611E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ddaf6e4e9d1b4edf4938995bf8c605023299f20a28793368836bec8e9bed98ed
MD5 819eee3580ad28686da279270964dd95
SHA1 bf4ab2c7a177666dba5c9ab69c5555ec85ad8c98
SHA512 d12a458434c681b6f857947bace48e03f6637a94e9b76870502073c0dbaef34fc8c9b479f052511dceb85a3d1da5f5d907527d61f1e91a13162be16fafe09a90
TLSH
T1AD419EF783F4866E8A1156F0EB18AE2BCE1D0511432C7D5AC9E4AE2793F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fa348b77e4740ce1da7de37a4fd81d1243445e343b39998b7e2e4d299aaa2c39
MD5 4fe789917497baaa7f25c1d7c86f8ffc
SHA1 6f5b0cc2153501aa6fc132e5b5207a6279c32dd1
SHA512 330718098e732768ec5311bf27745e4ce4dd4e65d5e8918f2dfe2f1f55073f12440580cd265e6a863fcdd23d80fa98ab679d1f432454e92e0675df73007fdffa
SSDEEP 192:sxRkRUCJ/f+suOCm1qZxUzoA8p9N/g6+WNCnt/Yn1U0hZGDIgVsJ:sxRkhJ/f+s8m18x1P/5s/03w2
TLSH
T15342A7196D28A93B5CC7E259BB15BF53E3F95132A1D11E48EAFC8A1C04EB6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7d2f725f917be3b327edddc2d16ac3f3bf382034e4852dd4f23b2454bb39def8
MD5 83a8982b74a459c67317879d20293cd2
SHA1 685c3fc91742092c026b2fca86c090de85e491c0
SHA512 8c8acca129aa918f0280bcfd65b35b3e6530302dd8731f0e5700915e881d23bc171c5a564c4603dfb74bc82398dc00e51c70ee8acaec0453940902c3345cb36e
SSDEEP 192:sxRfRUCJ/f+sBOCm1qZxUzoA8p9N/g6+WNCnt/Yn1U0hZGDIgDYsJ:sxRfhJ/f+sLm18x1P/5s/03wB
TLSH
T15E42A7196D28A93B5CC7E259BB55BF53E3F95032A1D11E48AAFC8A1C04EB7DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8a355d9f633c39352b55df911636996858b3b0f3d031f470a316b59c8d3a0cb3
MD5 95d9b9f8938afc21824511f227e1c7ef
SHA1 ab0fb159e1c17537562ea2460b14baa110489219
SHA512 12ac9cdb4adc9f74b63a9a796a1da88aa6b1175c3fec511611a43f3de294dac120444b11336fed477f71e4433764d6bd1657d2a9145bddf997693b96573f888a
SSDEEP 192:sxRfRUCJ/f+sBOCm6qZxUzoA8p9N/g6+WNCnt/Yn1wGhZGDIgD6sJ:sxRfhJ/f+sLm68x1P/5s/0Twz
TLSH
T1EE42B7596D68693B5CCBE24DBB55BF53E3F95032A0D11E48AAFC8A1C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 fbfedf930864280303fc2f162a85e205131c11c92e7308d25d51c516807251cd
MD5 b8fc51e32fd144a6f7faaf2d3d1f1ec5
SHA1 6e899a04d36f7b77acec2463078680de8b334e46
SHA512 098a5b207329b85c53e62d0a753ef901e0c75918902731131eed790390233ef2d41c61d53332123c1712426e47e2317b2d50a5195de8d90d2f7e687732c568ed
SSDEEP 768:wb8dPg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBkmu46NrohAv5k:wb8dPsE7r6Wgouf6Mu1ja2kmV6meC
TLSH
T116D2DA7B740DCB7E4F800ADDEC19BE9F6DA802CB96D8C94447FA851C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef0876b1-4b98-432d-bafa-2c46e6537c66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef0876b1-4b98-432d-bafa-2c46e6537c66.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d60c79e30ceb55f40b3bc59fb2b2e65b129ca5de0d65cdab9f3d4bb458d3cc61
MD5 030b47ee3608c349eab8836616dd1d44
SHA1 0be419b1c75349b36ed829bd62746df1a731bc6b
SHA512 0f183c07eed8c450f8b0fcb63e242202832178e99ed0229b710242cdedffff0356a4de53c274792c10a7a13e51dc15081bee618acf3e912ebba2d9a09e1f23a6
SSDEEP 768:Vrv+4UNbdV3BAsDZIO0khDGNzc4ReyIsPmPi9Pdu:VbsbD3BztGtc44bs+PX
TLSH
T12913CF35F86CDD63ACF6A681F14736537FF8206781C51A98D9D98F4C098B2AE171B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 f1c5aeb0f1518e94d3580c455f8b4820d17b9e30581d46ce25ddfe1af4f1f008
MD5 d069e3417a53fe33960d385a3eef2ab5
SHA1 05b24784441ca9bd676dc3af24722c84be93090e
SHA512 5f594771039d86b76fc7cb07775edfa797957c391f75b34e6ae1c9477a11019d17de675784d8d1018d0ee6ba44dcd918e4bc6da8ddd5de17e40fd6cf3887a74b
SSDEEP 768:OFQU3iwgKTNZQ5O0khDBNzc4ReyIsPmPi9PdT:lU3XptBtc44bs+Pm
TLSH
T1EC1317F598D79976E8AE5783A73D2E429DFCD063B1885994B7C94E0CCC821BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4480d9b429f085d75d1ba556bae8d67e7d0b639fca306c68d23ab8b0f82cb301
MD5 ba0a23752396951f84b73b4251bfa7df
SHA1 fa77a4a400777ff0ceafff7ff5654723ac63f61c
SHA512 4339d2c3471dc0f0d3a0c29d5f042707f6605457411735935ed58d84beddb57cecde561f31d16743f7a5372ab58bdabf572829d0b781f1884fbb843268827f06
SSDEEP 768:6rv+4UNbds3YjDZIO0khnNzc4ReyIsXSeVH1S5D:6bsbS3GNtc44bsCEH1Y
TLSH
T15003CF33E8689977ACF66685B14B76137EF89127C2981E94C9DE1F0C4A4B1ED130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b07f9251846178b8b3f995f8d5ad667a7532e8f221725cc5c447e550fe798311
MD5 99eb7997a8ded486a06b38da7fdb6165
SHA1 8c24d66ab041b4b6738056eff8bc9195a68d224b
SHA512 cd50ac90b08e35c83f377bc5809bde2e71941062ffef6479c70a5d2fc78efbcd05661c552faac304c2e37a4007e87914964ae16e907a4a4db15b59756173f64b
SSDEEP 768:srv+4UNbds3Y2DZIO0khDNNzc4ReyIs2meVH1S5D:sbsbS3ptNtc44bsxEH1Y
TLSH
T18503CE36A868CD33ACFA6685F04776933EF8616781C90E94D9DA4F0C4A472ED170F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1daa80bea582a2ebeb423da1aae52a30ecc8b85130b97af31c61088be15a02c4
MD5 23d4c610d0aaae6eb29229955e629517
SHA1 956a8f181bafa337696d62dfd59285ce20a29a67
SHA512 78b6963a6e635da0fa147322d422860c13bce60efccf3973145a9af1e2d98a61e3cbb61edc9c1e21e48ffd680d883aed973bbae694c3827d7f9823a1504bb8f0
SSDEEP 384:nvZcIe38NLVWlWVrFTCJDZNfNoXOVSUUkuoD9ETRzcoXfK86sfxEZxxsIj4lBmPm:ne3FosDZIO0khDONzc4ReyIsPmPi9PdT
TLSH
T197F2BF75E8689C63ACFAA781F54237537EF45067D1D82E98E5DD8F0C09832AE071B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9774e07c7ca4c827b246fe85898316fb10da91d9656d1a146366c6645a5f4aa1
MD5 8217ceccf4e7dfdd45cadeaade8311e2
SHA1 2b96de7b920284187817dc53deaafcdc5a26803f
SHA512 b734f9dc30f23f2d9032beb5069bdfcf3c7205601a71e912a2ab1f720a20ee900ca96d729b342fbbe74c2e068fe3ffa8f46543880ae7394c86671aa7592bebe1
SSDEEP 384:nTZcIe38NLaWlWVrFTCJDZNfNoXOVSUUkuoD9ETRzcoXfK86sfxEZxxsIj4lBmPm:Le3yosDZIO0khDONzc4ReyIsPmPi9PdT
TLSH
T130F2BF75E8689C63ACFAA782F54237537EF45067D1D42E98E5DD8F0C09832AE071B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a909c5f6-5e65-4029-866f-46e57b74488f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a909c5f6-5e65-4029-866f-46e57b74488f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2028_96277599\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/252-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2092-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3048-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3336-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3376-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3516-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3964-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-361-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4520-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-305-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download