c4cc97107635c0ed5427ff24310c40b1691c1bb72b16c583051cda8d2abb3fb5

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-l2dbssaj3w
SHA256 c4cc97107635c0ed5427ff24310c40b1691c1bb72b16c583051cda8d2abb3fb5
MD5 67e05119699096cdbb66e77cb8bc6570
SHA1 207dcdbb225bc0ca236798b99c6524baef38c7bd
SHA512 f329c16fbea9137b7480346de7cac119a76f776cea7dad0c26f1b08c81a69962245a6f4bb529644936f4a345e96db142aecb74dcc9de1985a510fcab0b6db961
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4984	CP.exe
544	wuojgeztrl.exe
5608	CP.exe
4960	CP.exe
5072	i_wuojgeztrl.exe
4920	rljebwtomg.sys
2132	CP.exe
3008	bywtomgdbz.exe
2924	CP.exe
3408	CP.exe
4136	i_bywtomgdbz.exe
5372	bytjdbvtql.sys
5948	CP.exe
5248	nlgdywqoig.exe
3356	CP.exe
3532	CP.exe
6004	i_nlgdywqoig.exe
3780	idbvtqlida.sys
3228	CP.exe
240	vtqkigaysq.exe
4112	CP.exe
672	CP.exe
4728	i_vtqkigaysq.exe
2364	lfdxvpnlfa.sys
5320	CP.exe
4520	avsnlfdysq.exe
5164	CP.exe
1456	CP.exe
4152	i_avsnlfdysq.exe
4688	vpnhfcausn.sys
3168	CP.exe
5816	sqnhfcaxsp.exe
5280	CP.exe
5540	CP.exe
2716	i_sqnhfcaxsp.exe
4116	spcauspkec.sys
1636	CP.exe
1368	hfzxrpjhcz.exe
4964	CP.exe
3176	CP.exe
124	i_hfzxrpjhcz.exe
1132	keczurpjhf.sys
4212	CP.exe
3076	herpjhecwu.exe
5304	CP.exe
2840	CP.exe
1700	i_herpjhecwu.exe
2996	zwrpjhbzwr.sys
5836	CP.exe
4312	rmjhcwurmk.exe
1744	CP.exe
4124	CP.exe
4116	i_rmjhcwurmk.exe
3456	gbztrljgeb.sys
5932	CP.exe
4692	hbztrljgey.exe
4344	CP.exe
3872	CP.exe
2940	i_hbztrljgey.exe
6084	vtrljebwqo.sys
4224	CP.exe
3320	tolgeywqoi.exe
6068	CP.exe
2352	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_780473236\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_780473236\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_754259171\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_754259171\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_1240513015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_625507889\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_625507889\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_754259171\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4928_754259171\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuojgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtomgdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhcwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdaysqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_herpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdaysqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhczukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzxrpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	herpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhczukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtomgdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzxrpmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdbvtoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhcwurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebztrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebztrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuojgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdbvtoigb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2776	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2608	ipconfig.exe
4908	ipconfig.exe
4932	ipconfig.exe
4340	ipconfig.exe
3444	ipconfig.exe
1904	ipconfig.exe
944	ipconfig.exe
6132	ipconfig.exe
1096	ipconfig.exe
4948	ipconfig.exe
4476	ipconfig.exe
6084	ipconfig.exe
5156	ipconfig.exe
2116	ipconfig.exe
4936	ipconfig.exe
4696	ipconfig.exe
4448	ipconfig.exe
1552	ipconfig.exe
1512	ipconfig.exe
2568	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316936911806117"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DF057340-7265-4210-857C-33606FFB1ACB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5072	i_wuojgeztrl.exe
Token: SeDebugPrivilege	4136	i_bywtomgdbz.exe
Token: SeDebugPrivilege	6004	i_nlgdywqoig.exe
Token: SeDebugPrivilege	4728	i_vtqkigaysq.exe
Token: SeDebugPrivilege	4152	i_avsnlfdysq.exe
Token: SeDebugPrivilege	2716	i_sqnhfcaxsp.exe
Token: SeDebugPrivilege	124	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	1700	i_herpjhecwu.exe
Token: SeDebugPrivilege	4116	i_rmjhcwurmk.exe
Token: SeDebugPrivilege	2940	i_hbztrljgey.exe
Token: SeDebugPrivilege	1644	i_tolgeywqoi.exe
Token: SeDebugPrivilege	1944	i_lfdaysqnlf.exe
Token: SeDebugPrivilege	4448	i_qkidavsqki.exe
Token: SeDebugPrivilege	4476	i_sqkicausqk.exe
Token: SeDebugPrivilege	4252	i_nkfcausmke.exe
Token: SeDebugPrivilege	1580	i_upmhczukec.exe
Token: SeDebugPrivilege	692	i_pjhbzxrpmk.exe
Token: SeDebugPrivilege	3776	i_rmjebztrmg.exe
Token: SeDebugPrivilege	4740	i_igbytrljdb.exe
Token: SeDebugPrivilege	5832	i_igdbvtoigb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 6000	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 6000 wrote to memory of 4928	6000	iexplore.exe	90
PID 4928 wrote to memory of 1696	4928	msedge.exe	91
PID 4928 wrote to memory of 4452	4928	msedge.exe	92
PID 4928 wrote to memory of 2776	4928	msedge.exe	93
PID 4928 wrote to memory of 4452	4928	msedge.exe	92
PID 4928 wrote to memory of 4452	4928	msedge.exe	92
PID 4928 wrote to memory of 5784	4928	msedge.exe	94
PID 4928 wrote to memory of 5784	4928	msedge.exe	94
PID 4928 wrote to memory of 4424	4928	msedge.exe	96
PID 4928 wrote to memory of 4424	4928	msedge.exe	96
PID 4928 wrote to memory of 4424	4928	msedge.exe	96
PID 4928 wrote to memory of 2116	4928	msedge.exe	97
PID 4928 wrote to memory of 2116	4928	msedge.exe	97
PID 4928 wrote to memory of 2116	4928	msedge.exe	97
PID 4928 wrote to memory of 4992	4928	msedge.exe	98
PID 4928 wrote to memory of 4992	4928	msedge.exe	98
PID 4928 wrote to memory of 4992	4928	msedge.exe	98
PID 4928 wrote to memory of 5228	4928	msedge.exe	99
PID 4928 wrote to memory of 5228	4928	msedge.exe	99
PID 4928 wrote to memory of 5228	4928	msedge.exe	99
PID 4928 wrote to memory of 1700	4928	msedge.exe	100
PID 4928 wrote to memory of 1700	4928	msedge.exe	100
PID 4928 wrote to memory of 860	4928	msedge.exe	102
PID 4928 wrote to memory of 3208	4928	msedge.exe	103
PID 4928 wrote to memory of 860	4928	msedge.exe	102
PID 4928 wrote to memory of 3208	4928	msedge.exe	103
PID 1804 wrote to memory of 4984	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 4928 wrote to memory of 1512	4928	msedge.exe	107
PID 544 wrote to memory of 5608	544	wuojgeztrl.exe	109
PID 4928 wrote to memory of 4536	4928	msedge.exe	112
PID 4928 wrote to memory of 4536	4928	msedge.exe	112
PID 4928 wrote to memory of 2968	4928	msedge.exe	113
PID 4928 wrote to memory of 2968	4928	msedge.exe	113
PID 1804 wrote to memory of 4960	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 1804 wrote to memory of 2132	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3008 wrote to memory of 2924	3008	bywtomgdbz.exe	122
PID 1804 wrote to memory of 3408	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1804 wrote to memory of 5948	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5248 wrote to memory of 3356	5248	nlgdywqoig.exe	131
PID 1804 wrote to memory of 3532	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 1804 wrote to memory of 3228	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 240 wrote to memory of 4112	240	vtqkigaysq.exe	140
PID 1804 wrote to memory of 672	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4928 wrote to memory of 3076	4928	msedge.exe	146
PID 4928 wrote to memory of 4948	4928	msedge.exe	147
PID 4928 wrote to memory of 4696	4928	msedge.exe	148
PID 1804 wrote to memory of 5320	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4520 wrote to memory of 5164	4520	avsnlfdysq.exe	153
PID 1804 wrote to memory of 1456	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1804 wrote to memory of 3168	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5816 wrote to memory of 5280	5816	sqnhfcaxsp.exe	162
PID 1804 wrote to memory of 5540	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 1804 wrote to memory of 1636	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 1368 wrote to memory of 4964	1368	hfzxrpjhcz.exe	171
PID 1804 wrote to memory of 3176	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1804 wrote to memory of 4212	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 3076 wrote to memory of 5304	3076	herpjhecwu.exe	180
PID 1804 wrote to memory of 2840	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4928 wrote to memory of 1888	4928	msedge.exe	185
PID 4928 wrote to memory of 1888	4928	msedge.exe	185
PID 1804 wrote to memory of 5836	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4312 wrote to memory of 1744	4312	rmjhcwurmk.exe	193
PID 1804 wrote to memory of 4124	1804	2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_67e05119699096cdbb66e77cb8bc6570_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x318,0x7ffcb089c188,0x7ffcb089c194,0x7ffcb089c1a0
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,12267360295093255358,11831560185282124588,262144 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,15282484539329233325,18140580556202299808,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:11
      4⤵
      System Time Discovery
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2524,i,12717367633171860,3727811362928496525,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,12723452970867259324,14735966197297215407,2097152 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,467957877769934047,9694962244694232998,2097152 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,2186487557594785645,3629577402089002530,2097152 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,1557111185076628445,3735869473138146948,2097152 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,927226871570987150,11114584103537417600,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8173978488183907291,8595958712138338592,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,11425887917720320706,9176256179321755021,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3038248876307540776,6609427584416688406,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,3038248876307540776,6609427584416688406,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,11074830017452880466,1290178563074894601,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,1776155127665653012,5518936834564189179,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13442649411988470455,17506813807181720916,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,3795905054597570873,2234714698446366040,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,12148105687688450780,3648540329334596222,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,18206206307568462386,8681490318770567405,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3402533835916703088,4332542939359664324,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,4298768592518012806,6120255327150922083,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11603156749801193189,8681914363156836772,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,10954141615552208167,9531796453374881248,262144 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9332626393644093623,9817704148088936958,524288 --field-trial-handle=1952,i,6890449352499964154,1487488723961830254,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuojgeztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4984
- - C:\Temp\wuojgeztrl.exe
    C:\Temp\wuojgeztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuojgeztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_wuojgeztrl.exe
    C:\Temp\i_wuojgeztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywtomgdbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\bywtomgdbz.exe
    C:\Temp\bywtomgdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywtomgdbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_bywtomgdbz.exe
    C:\Temp\i_bywtomgdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3532
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqkigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3228
- - C:\Temp\vtqkigaysq.exe
    C:\Temp\vtqkigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqkigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:672
- - C:\Temp\i_vtqkigaysq.exe
    C:\Temp\i_vtqkigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5320
- - C:\Temp\avsnlfdysq.exe
    C:\Temp\avsnlfdysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1456
- - C:\Temp\i_avsnlfdysq.exe
    C:\Temp\i_avsnlfdysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnhfcaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\sqnhfcaxsp.exe
    C:\Temp\sqnhfcaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnhfcaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5540
- - C:\Temp\i_sqnhfcaxsp.exe
    C:\Temp\i_sqnhfcaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3176
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\herpjhecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4212
- - C:\Temp\herpjhecwu.exe
    C:\Temp\herpjhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_herpjhecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\i_herpjhecwu.exe
    C:\Temp\i_herpjhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhcwurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5836
- - C:\Temp\rmjhcwurmk.exe
    C:\Temp\rmjhcwurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhcwurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4124
- - C:\Temp\i_rmjhcwurmk.exe
    C:\Temp\i_rmjhcwurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\hbztrljgey.exe
    C:\Temp\hbztrljgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Temp\i_hbztrljgey.exe
    C:\Temp\i_hbztrljgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\tolgeywqoi.exe
    C:\Temp\tolgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\i_tolgeywqoi.exe
    C:\Temp\i_tolgeywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdaysqnlf.exe ups_run
  2⤵
  PID:5900
- - C:\Temp\lfdaysqnlf.exe
    C:\Temp\lfdaysqnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdaysqnlf.exe ups_ins
  2⤵
  PID:1160
- - C:\Temp\i_lfdaysqnlf.exe
    C:\Temp\i_lfdaysqnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsqki.exe ups_run
  2⤵
  PID:3848
- - C:\Temp\qkidavsqki.exe
    C:\Temp\qkidavsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsqki.exe ups_ins
  2⤵
  PID:992
- - C:\Temp\i_qkidavsqki.exe
    C:\Temp\i_qkidavsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausqk.exe ups_run
  2⤵
  PID:6132
- - C:\Temp\sqkicausqk.exe
    C:\Temp\sqkicausqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausqk.exe ups_ins
  2⤵
  PID:4712
- - C:\Temp\i_sqkicausqk.exe
    C:\Temp\i_sqkicausqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcausmke.exe ups_run
  2⤵
  PID:5532
- - C:\Temp\nkfcausmke.exe
    C:\Temp\nkfcausmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcausmke.exe ups_ins
  2⤵
  PID:2684
- - C:\Temp\i_nkfcausmke.exe
    C:\Temp\i_nkfcausmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhczukec.exe ups_run
  2⤵
  PID:1944
- - C:\Temp\upmhczukec.exe
    C:\Temp\upmhczukec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhczukec.exe ups_ins
  2⤵
  PID:424
- - C:\Temp\i_upmhczukec.exe
    C:\Temp\i_upmhczukec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzxrpmk.exe ups_run
  2⤵
  PID:792
- - C:\Temp\pjhbzxrpmk.exe
    C:\Temp\pjhbzxrpmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzxrpmk.exe ups_ins
  2⤵
  PID:5228
- - C:\Temp\i_pjhbzxrpmk.exe
    C:\Temp\i_pjhbzxrpmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebztrmg.exe ups_run
  2⤵
  PID:4404
- - C:\Temp\rmjebztrmg.exe
    C:\Temp\rmjebztrmg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebztrmg.exe ups_ins
  2⤵
  PID:3696
- - C:\Temp\i_rmjebztrmg.exe
    C:\Temp\i_rmjebztrmg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run
  2⤵
  PID:2000
- - C:\Temp\igbytrljdb.exe
    C:\Temp\igbytrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins
  2⤵
  PID:124
- - C:\Temp\i_igbytrljdb.exe
    C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdbvtoigb.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\igdbvtoigb.exe
    C:\Temp\igdbvtoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdbvtoigb.exe ups_ins
  2⤵
  PID:6088
- - C:\Temp\i_igdbvtoigb.exe
    C:\Temp\i_igdbvtoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1412

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
- Executes dropped EXE
PID:4920

C:\Temp\bytjdbvtql.sys
C:\Temp\bytjdbvtql.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\idbvtqlida.sys
C:\Temp\idbvtqlida.sys
1⤵
- Executes dropped EXE
PID:3780

C:\Temp\lfdxvpnlfa.sys
C:\Temp\lfdxvpnlfa.sys
1⤵
- Executes dropped EXE
PID:2364

C:\Temp\vpnhfcausn.sys
C:\Temp\vpnhfcausn.sys
1⤵
- Executes dropped EXE
PID:4688

C:\Temp\spcauspkec.sys
C:\Temp\spcauspkec.sys
1⤵
- Executes dropped EXE
PID:4116

C:\Temp\keczurpjhf.sys
C:\Temp\keczurpjhf.sys
1⤵
- Executes dropped EXE
PID:1132

C:\Temp\zwrpjhbzwr.sys
C:\Temp\zwrpjhbzwr.sys
1⤵
- Executes dropped EXE
PID:2996

C:\Temp\gbztrljgeb.sys
C:\Temp\gbztrljgeb.sys
1⤵
- Executes dropped EXE
PID:3456

C:\Temp\vtrljebwqo.sys
C:\Temp\vtrljebwqo.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\wqolgdbvtn.sys
C:\Temp\wqolgdbvtn.sys
1⤵
PID:2716

C:\Temp\sqnigaysqk.sys
C:\Temp\sqnigaysqk.sys
1⤵
PID:4804

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
PID:2332

C:\Temp\pnkfuspkhf.sys
C:\Temp\pnkfuspkhf.sys
1⤵
PID:3352

C:\Temp\auspkhczus.sys
C:\Temp\auspkhczus.sys
1⤵
PID:300

C:\Temp\rpjhczurmj.sys
C:\Temp\rpjhczurmj.sys
1⤵
PID:4436

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
PID:1644

C:\Temp\wrojgbztrl.sys
C:\Temp\wrojgbztrl.sys
1⤵
PID:5260

C:\Temp\ljgbytqljd.sys
C:\Temp\ljgbytqljd.sys
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsnlfdysq.exe

Path C:\Temp\avsnlfdysq.exe
Size 226KB
SHA256 e113ac6ee9a369ae03352d27a8d75cd6e7e2b7900efa915f617679d99bae59ba
MD5 6eaf61664101bd2d5a90614e82527f6a
SHA1 bb6b5352c7bb637f893bd335eebe2417a9c3d784
SHA512 7ad4357479aa7a3b5b7871909385eea63954f13fc468fda4e8dcaec99612e7f462f38cee81af2d9dfedf14fea65ef83088da8670bf688609937ca148d7a49c6d
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytjdbvtql.sys

Path C:\Temp\bytjdbvtql.sys
Size 141KB
SHA256 42e5976267e8ebd190903c08ce79f145fcffef0ee291125f06acae21733b7550
MD5 beb0ff9e010f3885f27200488fc7c83e
SHA1 ecbc571ac4b8f98d77eab9dc82d9cea6d41ddafe
SHA512 818da0a7be6973c1b42f26d5469cb51e8afb9140661c1774528071d4a39a5ae942ae16f804bdd44b3681732df91dd009bf30159554dffbe7593181a90ca65532
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywtomgdbz.exe

Path C:\Temp\bywtomgdbz.exe
Size 226KB
SHA256 0f4a77267f65c72c9825b0d352ee02b6479e414f6c245213edfbccdded9ea46f
MD5 eb7fb2d814d03e71c08723341d5c3b02
SHA1 ff351363032b5c9f8a2ba8a042f24f3061ee0f3e
SHA512 018e21fb44d0eaa424b1b5ec253abc1c7b8bcc45302e4ffd7098825f87235deca53b2453befdc10d65e25723a5efa51af71dd934ec88cb2ad52e6faa72649194
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1C534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsnlfdysq.exe

Path C:\Temp\i_avsnlfdysq.exe
Size 226KB
SHA256 2adb33121bb5d987f96f75fcd601080da49f06cfadf4a21176632938bdbccfff
MD5 63dcf2c45ff509e0efeb26def490bbe9
SHA1 172b9332de0534fa59ace6c6ad0a4d16602b4b18
SHA512 31f0b145d5df3bb4aec30b2c7962cba14e04197f681a8f1bd1658b5857df157fea5d2a756efb8f7f38101955ecf90601f348c8330ba7a4dba6ae1827188421ca
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywtomgdbz.exe

Path C:\Temp\i_bywtomgdbz.exe
Size 226KB
SHA256 3209b79aa6ed6633508f1926d7712a0779d4bcb03dc7f6befa8df8473de5aa61
MD5 5c80f33e2ef27af4ee7d9bb64bc258b7
SHA1 68cdbf4d1b26d69605612838b8b85103fb0af078
SHA512 303f561be735fb00356cf589501f35659ab4c6939e986c37505c31ac7fe282ad0b052ccef1bba74688395bda4742c6244a68b633cafaf4aefe0c95f924605ace
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T10A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdywqoig.exe

Path C:\Temp\i_nlgdywqoig.exe
Size 226KB
SHA256 b99fafe9ae5ec5fc8c51378ddd2fc49b6c2c7998e00197d54aa164512ce76915
MD5 9c8d943609a61346752331fb3502fcb1
SHA1 ed4f3d41628719b763a1eba5a94fa732040633f0
SHA512 781b0b03aafa16930097ca3a944be6940f9aa95d5632bfb32dd76b8c9ab8ae9e9f57211c727cf3e865795a8b6c4a1f04d4f95e5bd98fd3694bfcd892255a4b89
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnhfcaxsp.exe

Path C:\Temp\i_sqnhfcaxsp.exe
Size 226KB
SHA256 ed986752c362dc59a6e402d891d5495f325fc06773381c1a27c3d6ae7524eaac
MD5 4bc6dfdb7844484e6957c44a897d555b
SHA1 35e842a69d40542db83e4047507bfea668e20841
SHA512 2980bb9ac155e8131f44db1cf5b5875337032ca02c36773279af341c2b4c386212217a79c135496feac7558d912434bba8d85f8c11561e7a9d9f532bfdc06a33
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqkigaysq.exe

Path C:\Temp\i_vtqkigaysq.exe
Size 226KB
SHA256 b4549ee5f43127fc093cc2ffc59c37a3196b3fe09cd6364564c7a2e2831601bd
MD5 b8a8e69b2358d96c6c8c0475203ca99b
SHA1 f2ab5618c2b6d94e852d60f6b266189078d540fe
SHA512 e196971807e4b3f9ad6babc1152251c829cbc8693789d7bbb03ea8b330984fd0239255638a37bccef02bf1a4d3a3f200f40d0eb0714987e52fe7f96d36e42cba
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuojgeztrl.exe

Path C:\Temp\i_wuojgeztrl.exe
Size 226KB
SHA256 7ec677ab0df6f0a23a41d70bb3df07df8516487afc3c20212be390df1e6a1b3b
MD5 7c444e43f4e4794ed1b65c06cc218656
SHA1 1d16e494af42a81b0bb119507373ee9b2fb5e477
SHA512 213f5e883679703b2ef7f16b009bb294051366ee54ba8c17b3d6d763da311a1aa3018bb69a8a06635b64ef05c7674370e9853a3aeb950b2d47060689a26809cb
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T11834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtqlida.sys

Path C:\Temp\idbvtqlida.sys
Size 141KB
SHA256 f90c03c31e94cb88d6a0b898cd370cc735678ae0fd1f0447a9f041d0ab9060c0
MD5 f16655d60ffb604920fbc8ad4de4a0ac
SHA1 10df4a56b3515de9e408cd7733f9996cbbc2e633
SHA512 cf3aec430a51c970c536753f5eca03eef89ac6cb2b625e590e8fa429c0ef7c2c9b29add440d569be43d97f1d052f11aa86d7eab9ec0f5db2211ebc6c843257b7
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnlfa.sys

Path C:\Temp\lfdxvpnlfa.sys
Size 141KB
SHA256 e9786ab304170cc8d18075df269cf8278593f62d190dabac6b953b3790fc5bd1
MD5 91cf0caecc3e4e42af3cd7e75e5dcfda
SHA1 ac6199a93ee8c9e503814fce3414f5fd642d695c
SHA512 6296d3d6edbd7715e5c7c880b853929948ad1c0fbe9f38a8674abd6a45d93b7bd6429de0b262341916557bd9bb5a4a47754a6353e0b3b479a24446a543a04e86
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T192E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqoig.exe

Path C:\Temp\nlgdywqoig.exe
Size 226KB
SHA256 2fc81c869aaf17f1fe466100304cf08fa031fe6dd39f4529af613fd019c404ae
MD5 3c2a7b6094c0a93ba2d26a244330f3a1
SHA1 33cc0f431d8725a49dc25555a1e4d608adcf1758
SHA512 5363a0cdd065739c6349a08b5f0e5a0d7f148ec63e65b648273fd4fa0dbe3d678dcd5c031f6cd1869fbf5dc5bd957719d0dc24e842afbe766cea025b19f8fc09
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T17F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtomg.sys

Path C:\Temp\rljebwtomg.sys
Size 141KB
SHA256 1e62a6617be6f2822cc6131f696f65f45837c11f10234fb9a0aa79f8ae375dc3
MD5 2a03606a2d79b5aba3e3d0ef0b941a44
SHA1 ce3f947bc151e58539b38ee161c30d1d6fd30d57
SHA512 58026b0a2fdce34493b7c5b7f14a20c83d8d3031b7988cee14283abb8d553352344b5057fc9b70df741543da0d50c9970afb1741913cdc61d6ff3cc60a7456be
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spcauspkec.sys

Path C:\Temp\spcauspkec.sys
Size 141KB
SHA256 2a7af23c8bce7f357c6a23c7f09eb26e2449460b97c81ed1677ffdd7e57a7834
MD5 7c00c25bcbd8f3e1aa75857402640dea
SHA1 4957131217ab749e32e74d2b9e334a409d55df3c
SHA512 b654e5400a187910834ea3bf8d0e424077a9c0ad58416b1462ed945c40364519c52b0fd16fd42d91d67977bea4c376030c2c346073cec5a64ac3d8e1d7699017
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnhfcaxsp.exe

Path C:\Temp\sqnhfcaxsp.exe
Size 226KB
SHA256 95183edc6a32c7392cf4a70d1e2ee068ea1338f1f725bb0254458272bd268517
MD5 b0dd6b82b1b4d9ba39893f4ce1628be4
SHA1 58a4a8ac263c2c9b857261b58e2a7b438b8d9b0c
SHA512 5b8727efab03c3d0fb3566e906996af04c7c11d1bf3656c9d348b70fc51f3b99f366c73ca57bda7ec7dc1fcde8a520893e8d79e025e90c6ba4eb9fad8adb910e
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1C634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfcausn.sys

Path C:\Temp\vpnhfcausn.sys
Size 141KB
SHA256 874ac81897e16e41da6a6ba1c1566f55380621ed68e2ae25aa99434ce621501e
MD5 df7650593ef463e4591fab6e76aa55a0
SHA1 97178b60a86675d268af1e6dbb140199ba993881
SHA512 30246004bb1d566cf06576f7518220ed53ad5cc096237f430d62de307324ae972532c0bad7c460b142f585ec21d05efe7a9f6a9e1a3217bd967a453ff21f8628
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T196E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqkigaysq.exe

Path C:\Temp\vtqkigaysq.exe
Size 226KB
SHA256 50801c35ca89095aee1912bce92892628d6d9546db027cb0d48be6e60eaeb23f
MD5 823948931af7f3e58a605ad1a4eec61e
SHA1 5b6bc998fe95071bf70eb3c51748cb54f7a14338
SHA512 e7b4798db3c4ff07aa3c1974c245317f62c68343ce324f355276a4d59a9e938dc5532a77ce90c471235ff36db272bd107c401623f90cf065bf40b8756a731daf
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T1A834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuojgeztrl.exe

Path C:\Temp\wuojgeztrl.exe
Size 226KB
SHA256 188b62fa12369f352204806251661df2be890dee740c8ae32b17c44389606b93
MD5 4a7090dbd6c81acea2aadff4c1efc0df
SHA1 bfcde0f51e574e5bf0cafef9241301e69eed14cc
SHA512 4ba9b2658648c88ab75c6684c99b191137ae05d18ece59eb0ce9714d551d8ba36cae80dc0027c1e69aa1c4a141694b50018ae42b897ed2cc184db0d44945748b
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 5152e00ce3c271ffeb0fd2aa0dabe16d701ac2696ece95a330417d9275a63c5e
MD5 867f7a4ac0e494de85cde49fa04064e1
SHA1 3ae678883ac820ef3c57c92ad1a9b9dff4a6d344
SHA512 1552490393ad53b2d59e426e8131d2a3c639308ac5c15a65ca4da2c3fad451f38b9c9553ecccda9090fce899422d745c9313d86fcfe47dc536788f4d651c0a1b
TLSH
T18641A6114B7B05EBC76303B52EF1A78572B483970F072FC94E5C39F869C1B235091029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 93b83363948bf504dbea893cb401d5d990b0764c8019030320daf8465a5b4c59
MD5 ebfef92718ecb8f5d46dd095806126c0
SHA1 9fea80be6c43f933c22b8677c91af314d61a46b5
SHA512 ead7a233983717b610096e03d340bfd0e35b9cb9bcd7e5ee0d0dfa79da083cc2a3dd7c8695a00d022afec702a410dafbfaf58cd4555ff637bdfd868c01fc7922
TLSH
T16041BEF783F4856E8A1196F0AA146E1FCE2D0511832C7C5AC9E4AF2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 37829ffff830aedf9c90814867e4ba47fea7c7d04419c916edb5b09b1affdca4
MD5 9d653ff38b2e48717060ad53f7d822cb
SHA1 46cf7293393b5a90943703fbea4b4f95fb64581d
SHA512 567dcd795a960b07b05fad8acc44dbb5b45456db113bc78a8f82014ca1b73383ca8d21c1ccc6e167e05b6f9352d03961713793ccd7a0237b9bced4cecb066cf1
SSDEEP 192:sxRlRbCJ/frsSbWdZmy8WG8wzoA8p9m/g6+WNCf8/YoQtCYiGfIgVvJ:sxRl8J/frsEWT+WG8p0/5F/vuL
TLSH
T13D42D8156D28A93B4CC7E21DBA55BF53E3F95432A0D52E48BAFC8A0C04E76DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a093218e8a66ca42b3e1672dfe18ef8d982ab233325409184da8e6c15b9b4ed4
MD5 f05944b02e2baf7a5509ab87ead0b0a4
SHA1 1b8de56b7194acb527402d44cf258bdad25ea7f2
SHA512 ba2dc4313cf7a98c0ff450c112cdf218005c803657ccb846a2c5165fe345fa9a6594c8d463ba3dfade3b700ea5bad931fb5fbb99035782bde1c9f9289836ee8a
SSDEEP 192:sxRORbCJ/frs7bydZmy8WG8wzoA8p9m/g6+WNCf8/YoG5CYiGfIgDdvJ:sxRO8J/frsHyT+WG8p0/5F/run
TLSH
T1A642C7566D28A93B8CC7E21DBA55BF53E3F9543260D51E48BAFC8A0C10EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 edb33f9d81268cb01f7175e62e62f8c27368caf17ff350d1c49d25da3765fe89
MD5 d7fec0de0b0b765d51e312a687822fbc
SHA1 049720ae5678d1d8013006f1da32c43a5dc21991
SHA512 b681c3e4458441b9228bcf46ad7176662bd168a49f8c16e41f36b57b1df10084380b394348b507354496202160ee8b258eba16768926dae5228042537781f65e
SSDEEP 192:sxRORbCJ/frs7bWdZmy8WG8wzoA8p9m/g6+WNCf8/YoQtCYiGfIgDPvJ:sxRO8J/frsHWT+WG8p0/5F/vut
TLSH
T1A842C8166D28A93B4CC7E21DBA55BF53E3F9543260D52E48BAFC8A1C04EB6DD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3c16d9509657f1076e8bb2387d0ffa35051b8e967a944db338e2c5ab9f0cbbb2
MD5 0bb56fdb332683f23280f70948c61c20
SHA1 105e2a939067d1513f39d49ec266ade80f30bcd6
SHA512 1542950174d8d2e631b7218d4a60186358ab68d5271561e8f8c4a4052a87cc9c55adb33719ce94d65b46518ca2dd048f74b5caa9748da2bb93c949807c577c0e
SSDEEP 768:j26HKo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV6ABVuwsro9Ge0s:j26HKUE7MRWgs2f02u1japAB4w3Jr
TLSH
T1C4D2DA7B640DCABF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a301a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a301a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9eeb08bc54e4afb8942c2e518328e43ad12d071da5cb385ec898e17276a6766e
MD5 7aef8e930b11f2ca1aab19016faf1607
SHA1 95ba49e68c48cfeb4524a17b52194bade6661ca5
SHA512 77db06951f56c3dd91d885ae3410e5713673b5e1a62910b651cda9e60e463c76f9e820178a71cdfa8bb38f5168cb93614407bc48a8d5cf1ae64780db4128be4c
SSDEEP 768:hrv+4UNbdz3mg/TBOWvy4ONXyer1IRCzniB5eVH1SK7:hbsbV3hZSIqnGEH1l
TLSH
T1ED03BF32A4A89E374DE2A3C6B14773437FB85057C6800790EDDE2F4E069B59D130B95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bab72f6d694001fadff6544305d751cdb672e392ebc87e8b40b649f837d4f37f
MD5 2ef668a8c7cde6922cbb314feef80a4c
SHA1 7ce588d0325fc2a79b8a20db0250336eac6633bc
SHA512 51011af8348639259e1a0d62479e68d1f39191667893de347a9b7b633367c93e00b956607f73cc949ad2511503d861406bf2db88436f1cfc6c3386b610c239e6
SSDEEP 768:yU3KAn0f/TBOWvynZt9ONXyer1IRCzni9kftlXx:yU3XsUSIqnnfXXx
TLSH
T1FBF2BF31D8A59D234CE5E3C5B2067387BFB820B7C4C85A50ADEA9F1D0597A5E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0510e88c60a537ceb2f3116bdc063e4449b6327f6a96e32ef91c6c3ae5468a54
MD5 630416e503d147616e7ff2d54d46afa7
SHA1 910633ed461a48b006630d86c8f846e976d4f37f
SHA512 10165f1c637221b07955b41d3aed93f07e0696eb3757474282005377a28759fd9ff0d693e3f054a986d647992dda44d48b01b888aef027a05d1c9b70be8ab95e
SSDEEP 768:zrv+4UNbdz3Jt/TBOWvynZtDONXyer1IRCzniwkeVH1SK7:zbsbV3TeSIqn4EH1l
TLSH
T15A03BF31A5A99E334DE2E395B14773837FB82067C5800B90EDEA1F8E059759E230F95B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2b89e39df3e3ecb8461e49427f52640d625d214f252cfba6842219a4b3b5ac60
MD5 8de705a3f058c0e4b5b718129b29a614
SHA1 529a42e41b8fb13f157a166c8a4841aaba4c7937
SHA512 367a749a6808ce8634eb852cf16828b98932b7d8e398ce287b51ba169b635ae4cce0f2ff7e799dca5baa9b483043254eb6f5f782bdac568cbb940092f68b9dfb
SSDEEP 768:fU3LAnof/TBOWvynZtPONXyer1IRCzni9kftlXx:fU3EoySIqnnfXXx
TLSH
T15DF2BF3198A59D234CE5E3C5B2067387BFB820B7C8C85A50EDEA9B1D0497A5E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e2ce1261cdfc3df0bd1bb397dc0cc3ecd02c7feebeccc7e46fbfd81be838878f
MD5 0a4e3fc7660cdd549e064c27095f64f5
SHA1 7e150aa38890dddb7361c8cef4aa97971144b046
SHA512 ac925d778ee57a12763470b3fa0e4d282e106929e8512d18694a3f6ab2ffceb05cb10537922af7c88325f550522e8ad4923a43bec15ae1b7eb8ac64e4377cecb
SSDEEP 768:zFQa3owgJAnkApsOWvynZtyONXyer1IRCzni9kftlXx:Wa3lPKSIqnnfXXx
TLSH
T13F1339F588D38937D8AD9383A33D6E469EBCD063B4889590BBD55E4CCC865BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

e2833898-4e09-4eae-ab9c-709c9ec90485.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e2833898-4e09-4eae-ab9c-709c9ec90485.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4928_1560184199\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/300-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1132-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1644-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2332-403-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2364-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2716-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2996-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3352-423-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3456-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3456-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3780-253-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4116-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4688-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4920-180-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5260-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5372-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6084-358-0x0000000000010000-0x0000000000083000-memory.dmp

Download