5606663689632ddfed7d338c20c0c3a3df64099cb53668fa1faf1021334c2d94

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-l5mpmsxwft
SHA256 5606663689632ddfed7d338c20c0c3a3df64099cb53668fa1faf1021334c2d94
MD5 4f637c21f6cf88103c217664e0497cd0
SHA1 6a1c511520050fab30cbe96124776b32177faf6b
SHA512 17f46010a754187ae16812a34f49a2cd7f9b137634fbf07fb4f24f4612033025acad5f94b8dee19be79929d519807ac1eb039f6c786abc5dd9d05ae929014001
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6024	CP.exe
5084	faxspkcaus.exe
3184	CP.exe
5840	CP.exe
5104	i_faxspkcaus.exe
4176	khcamkecwu.sys
1176	CP.exe
5556	zxupmkecwu.exe
5976	CP.exe
1088	CP.exe
1960	i_zxupmkecwu.exe
4180	zwrpmhbzxr.sys
3828	CP.exe
2992	usecwuomge.exe
4932	CP.exe
1360	CP.exe
712	i_usecwuomge.exe
6016	romgecwuom.sys
2164	CP.exe
4532	ojgecwurlj.exe
4264	CP.exe
4960	CP.exe
4788	i_ojgecwurlj.exe
3936	toljdbwtol.sys
2980	CP.exe
3504	ljdbytrljg.exe
1592	CP.exe
3264	CP.exe
4944	i_ljdbytrljg.exe
2780	ljdbwtjgby.sys
1908	CP.exe
4320	gaytqljdbv.exe
1492	CP.exe
4516	CP.exe
2644	i_gaytqljdbv.exe
3472	idaysqliga.sys
4724	CP.exe
980	dyvtnlxvqn.exe
5244	CP.exe
6136	CP.exe
5644	i_dyvtnlxvqn.exe
1076	aysqkidays.sys
3020	CP.exe
5028	xvtnlfdxvp.exe
2408	CP.exe
2304	CP.exe
4744	i_xvtnlfdxvp.exe
2340	auspnkfcax.sys
1980	CP.exe
6052	axvpnhfdxv.exe
3780	CP.exe
5864	CP.exe
5136	i_axvpnhfdxv.exe
3472	ausnkfdxvp.sys
1428	CP.exe
4452	pmkeczxrpk.exe
1884	CP.exe
3152	CP.exe
4564	i_pmkeczxrpk.exe
4148	xrpjhfzxrp.sys
5808	CP.exe
3584	upmhfzxrpm.exe
3956	CP.exe
2928	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3084_1952503671\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3084_105244894\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3084_105244894\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgecwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgecwurlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnlxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnlxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxjhc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5544	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5048	ipconfig.exe
3592	ipconfig.exe
1708	ipconfig.exe
6068	ipconfig.exe
5144	ipconfig.exe
3240	ipconfig.exe
1108	ipconfig.exe
4884	ipconfig.exe
5988	ipconfig.exe
5368	ipconfig.exe
6028	ipconfig.exe
2992	ipconfig.exe
2908	ipconfig.exe
2852	ipconfig.exe
5864	ipconfig.exe
3776	ipconfig.exe
3836	ipconfig.exe
3960	ipconfig.exe
2980	ipconfig.exe
2636	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316940319879710"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1BC092A5-B203-478D-826F-894DBD5023EB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5896	msedge.exe
5896	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	i_faxspkcaus.exe
Token: SeDebugPrivilege	1960	i_zxupmkecwu.exe
Token: SeDebugPrivilege	712	i_usecwuomge.exe
Token: SeDebugPrivilege	4788	i_ojgecwurlj.exe
Token: SeDebugPrivilege	4944	i_ljdbytrljg.exe
Token: SeDebugPrivilege	2644	i_gaytqljdbv.exe
Token: SeDebugPrivilege	5644	i_dyvtnlxvqn.exe
Token: SeDebugPrivilege	4744	i_xvtnlfdxvp.exe
Token: SeDebugPrivilege	5136	i_axvpnhfdxv.exe
Token: SeDebugPrivilege	4564	i_pmkeczxrpk.exe
Token: SeDebugPrivilege	5900	i_upmhfzxrpm.exe
Token: SeDebugPrivilege	3948	i_bztrmjebzt.exe
Token: SeDebugPrivilege	3876	i_trljdbywuo.exe
Token: SeDebugPrivilege	2340	i_ljgbytrljg.exe
Token: SeDebugPrivilege	3736	i_lgdyoigays.exe
Token: SeDebugPrivilege	4580	i_dxvqnidavs.exe
Token: SeDebugPrivilege	6032	i_sqkicausnk.exe
Token: SeDebugPrivilege	4164	i_smkfcauspk.exe
Token: SeDebugPrivilege	4576	i_rpmhfzxjhc.exe
Token: SeDebugPrivilege	3824	i_uomhezxrom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 6132	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 6132 wrote to memory of 3084	6132	iexplore.exe	90
PID 3084 wrote to memory of 4692	3084	msedge.exe	91
PID 3084 wrote to memory of 1740	3084	msedge.exe	93
PID 3084 wrote to memory of 5544	3084	msedge.exe	94
PID 3084 wrote to memory of 1740	3084	msedge.exe	93
PID 3084 wrote to memory of 1740	3084	msedge.exe	93
PID 3084 wrote to memory of 4972	3084	msedge.exe	95
PID 3084 wrote to memory of 4972	3084	msedge.exe	95
PID 3084 wrote to memory of 6000	3084	msedge.exe	97
PID 3084 wrote to memory of 4332	3084	msedge.exe	96
PID 3084 wrote to memory of 6000	3084	msedge.exe	97
PID 3084 wrote to memory of 6000	3084	msedge.exe	97
PID 3084 wrote to memory of 4332	3084	msedge.exe	96
PID 3084 wrote to memory of 4332	3084	msedge.exe	96
PID 3084 wrote to memory of 5060	3084	msedge.exe	98
PID 3084 wrote to memory of 1308	3084	msedge.exe	99
PID 3084 wrote to memory of 5060	3084	msedge.exe	98
PID 3084 wrote to memory of 5060	3084	msedge.exe	98
PID 3084 wrote to memory of 1308	3084	msedge.exe	99
PID 3084 wrote to memory of 1308	3084	msedge.exe	99
PID 3084 wrote to memory of 5276	3084	msedge.exe	101
PID 3084 wrote to memory of 5276	3084	msedge.exe	101
PID 3084 wrote to memory of 2496	3084	msedge.exe	102
PID 3084 wrote to memory of 2496	3084	msedge.exe	102
PID 3084 wrote to memory of 2348	3084	msedge.exe	103
PID 3084 wrote to memory of 2348	3084	msedge.exe	103
PID 4364 wrote to memory of 6024	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 3084 wrote to memory of 5832	3084	msedge.exe	107
PID 5084 wrote to memory of 3184	5084	faxspkcaus.exe	109
PID 3084 wrote to memory of 3760	3084	msedge.exe	112
PID 3084 wrote to memory of 3760	3084	msedge.exe	112
PID 3084 wrote to memory of 4896	3084	msedge.exe	113
PID 3084 wrote to memory of 4896	3084	msedge.exe	113
PID 4364 wrote to memory of 5840	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4364 wrote to memory of 1176	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5556 wrote to memory of 5976	5556	zxupmkecwu.exe	122
PID 4364 wrote to memory of 1088	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4364 wrote to memory of 3828	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2992 wrote to memory of 4932	2992	usecwuomge.exe	131
PID 4364 wrote to memory of 1360	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4364 wrote to memory of 2164	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4532 wrote to memory of 4264	4532	ojgecwurlj.exe	140
PID 4364 wrote to memory of 4960	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3084 wrote to memory of 2408	3084	msedge.exe	146
PID 3084 wrote to memory of 3136	3084	msedge.exe	147
PID 3084 wrote to memory of 5104	3084	msedge.exe	148
PID 4364 wrote to memory of 2980	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 3504 wrote to memory of 1592	3504	ljdbytrljg.exe	153
PID 4364 wrote to memory of 3264	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4364 wrote to memory of 1908	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4320 wrote to memory of 1492	4320	gaytqljdbv.exe	162
PID 4364 wrote to memory of 4516	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4364 wrote to memory of 4724	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 980 wrote to memory of 5244	980	dyvtnlxvqn.exe	171
PID 4364 wrote to memory of 6136	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4364 wrote to memory of 3020	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5028 wrote to memory of 2408	5028	xvtnlfdxvp.exe	180
PID 4364 wrote to memory of 2304	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 3084 wrote to memory of 2632	3084	msedge.exe	185
PID 3084 wrote to memory of 2632	3084	msedge.exe	185
PID 4364 wrote to memory of 1980	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 6052 wrote to memory of 3780	6052	axvpnhfdxv.exe	193
PID 4364 wrote to memory of 5864	4364	2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4f637c21f6cf88103c217664e0497cd0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffeb824c188,0x7ffeb824c194,0x7ffeb824c1a0
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,1963352519385036688,578827552426454457,262144 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,12927372698571758982,14527112366821314436,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:11
      4⤵
      System Time Discovery
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,9213976290099998433,13688756107708855164,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,17921936403113771510,5452978774762164704,2097152 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,14341013713369625677,13905803236102130125,2097152 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,1396093850570955815,8661534392453626888,2097152 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,429088609015253960,15079803261354238447,2097152 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,457722943071004970,17657675869117181967,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,2549421139579818230,7841598338708654227,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4057600623472034411,10025781583708421889,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13177383718528152554,3214560140893838396,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,13177383718528152554,3214560140893838396,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,473190029699154330,3220420841432647453,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,9622212265367678721,5325170425151668444,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,12358428606238862261,15820166668352293305,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,5852540062567783359,2649283648324912831,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,13113124002374708457,17441364450368838546,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,14223043483723237555,5130347055104113436,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2744,i,5509936257034633131,841958590674495251,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,15359695672785664363,9147418829261440259,262144 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,8524076787338100665,13981440924157970588,524288 --field-trial-handle=2236,i,15744567101727847181,17661932159348860930,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6024
- - C:\Temp\faxspkcaus.exe
    C:\Temp\faxspkcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5840
- - C:\Temp\i_faxspkcaus.exe
    C:\Temp\i_faxspkcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1176
- - C:\Temp\zxupmkecwu.exe
    C:\Temp\zxupmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1088
- - C:\Temp\i_zxupmkecwu.exe
    C:\Temp\i_zxupmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usecwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\usecwuomge.exe
    C:\Temp\usecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usecwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1360
- - C:\Temp\i_usecwuomge.exe
    C:\Temp\i_usecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgecwurlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2164
- - C:\Temp\ojgecwurlj.exe
    C:\Temp\ojgecwurlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgecwurlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_ojgecwurlj.exe
    C:\Temp\i_ojgecwurlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbytrljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\ljdbytrljg.exe
    C:\Temp\ljdbytrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbytrljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3264
- - C:\Temp\i_ljdbytrljg.exe
    C:\Temp\i_ljdbytrljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1908
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvtnlxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\dyvtnlxvqn.exe
    C:\Temp\dyvtnlxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvtnlxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6136
- - C:\Temp\i_dyvtnlxvqn.exe
    C:\Temp\i_dyvtnlxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtnlfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3020
- - C:\Temp\xvtnlfdxvp.exe
    C:\Temp\xvtnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtnlfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\i_xvtnlfdxvp.exe
    C:\Temp\i_xvtnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpnhfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1980
- - C:\Temp\axvpnhfdxv.exe
    C:\Temp\axvpnhfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpnhfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Temp\i_axvpnhfdxv.exe
    C:\Temp\i_axvpnhfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkeczxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1428
- - C:\Temp\pmkeczxrpk.exe
    C:\Temp\pmkeczxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkeczxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\i_pmkeczxrpk.exe
    C:\Temp\i_pmkeczxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Temp\upmhfzxrpm.exe
    C:\Temp\upmhfzxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\i_upmhfzxrpm.exe
    C:\Temp\i_upmhfzxrpm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjebzt.exe ups_run
  2⤵
  PID:2636
- - C:\Temp\bztrmjebzt.exe
    C:\Temp\bztrmjebzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjebzt.exe ups_ins
  2⤵
  PID:4832
- - C:\Temp\i_bztrmjebzt.exe
    C:\Temp\i_bztrmjebzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbywuo.exe ups_run
  2⤵
  PID:3540
- - C:\Temp\trljdbywuo.exe
    C:\Temp\trljdbywuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbywuo.exe ups_ins
  2⤵
  PID:4564
- - C:\Temp\i_trljdbywuo.exe
    C:\Temp\i_trljdbywuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgbytrljg.exe ups_run
  2⤵
  PID:5416
- - C:\Temp\ljgbytrljg.exe
    C:\Temp\ljgbytrljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgbytrljg.exe ups_ins
  2⤵
  PID:5048
- - C:\Temp\i_ljgbytrljg.exe
    C:\Temp\i_ljgbytrljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyoigays.exe ups_run
  2⤵
  PID:3008
- - C:\Temp\lgdyoigays.exe
    C:\Temp\lgdyoigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyoigays.exe ups_ins
  2⤵
  PID:2312
- - C:\Temp\i_lgdyoigays.exe
    C:\Temp\i_lgdyoigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnidavs.exe ups_run
  2⤵
  PID:3592
- - C:\Temp\dxvqnidavs.exe
    C:\Temp\dxvqnidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnidavs.exe ups_ins
  2⤵
  PID:3064
- - C:\Temp\i_dxvqnidavs.exe
    C:\Temp\i_dxvqnidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  PID:3420
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  PID:2576
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcauspk.exe ups_run
  2⤵
  PID:3948
- - C:\Temp\smkfcauspk.exe
    C:\Temp\smkfcauspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcauspk.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_smkfcauspk.exe
    C:\Temp\i_smkfcauspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhfzxjhc.exe ups_run
  2⤵
  PID:3868
- - C:\Temp\rpmhfzxjhc.exe
    C:\Temp\rpmhfzxjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhfzxjhc.exe ups_ins
  2⤵
  PID:1664
- - C:\Temp\i_rpmhfzxjhc.exe
    C:\Temp\i_rpmhfzxjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrom.exe ups_run
  2⤵
  PID:5656
- - C:\Temp\uomhezxrom.exe
    C:\Temp\uomhezxrom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrom.exe ups_ins
  2⤵
  PID:5276
- - C:\Temp\i_uomhezxrom.exe
    C:\Temp\i_uomhezxrom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3428

C:\Temp\khcamkecwu.sys
C:\Temp\khcamkecwu.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\zwrpmhbzxr.sys
C:\Temp\zwrpmhbzxr.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\romgecwuom.sys
C:\Temp\romgecwuom.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\toljdbwtol.sys
C:\Temp\toljdbwtol.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\ljdbwtjgby.sys
C:\Temp\ljdbwtjgby.sys
1⤵
- Executes dropped EXE
PID:2780

C:\Temp\idaysqliga.sys
C:\Temp\idaysqliga.sys
1⤵
- Executes dropped EXE
PID:3472

C:\Temp\aysqkidays.sys
C:\Temp\aysqkidays.sys
1⤵
- Executes dropped EXE
PID:1076

C:\Temp\auspnkfcax.sys
C:\Temp\auspnkfcax.sys
1⤵
- Executes dropped EXE
PID:2340

C:\Temp\ausnkfdxvp.sys
C:\Temp\ausnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:3472

C:\Temp\xrpjhfzxrp.sys
C:\Temp\xrpjhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:956

C:\Temp\rljdbywuom.sys
C:\Temp\rljdbywuom.sys
1⤵
PID:2312

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
PID:5980

C:\Temp\tqoigbytrl.sys
C:\Temp\tqoigbytrl.sys
1⤵
PID:2920

C:\Temp\fdavtnlfdy.sys
C:\Temp\fdavtnlfdy.sys
1⤵
PID:3836

C:\Temp\avsnlfcavs.sys
C:\Temp\avsnlfcavs.sys
1⤵
PID:2868

C:\Temp\axspnhfspk.sys
C:\Temp\axspnhfspk.sys
1⤵
PID:4324

C:\Temp\usmkhczxrp.sys
C:\Temp\usmkhczxrp.sys
1⤵
PID:4568

C:\Temp\uomkeczusm.sys
C:\Temp\uomkeczusm.sys
1⤵
PID:5988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkcaus.exe

Path C:\Temp\faxspkcaus.exe
Size 226KB
SHA256 baddb225a3e0078580ebfef2fdaf6e157901537ef568fdab38719d483b706c66
MD5 52ca8b0598d34c70a763424695168c28
SHA1 d18103992dc7c20d3300a5c798b158a157144fc7
SHA512 d5a7e631470879d481c26f1b0bf78a262b219f0136989eaf74db419d27734a6f4dbc479d52a5d45e3d429c404c8b0b44be6d476a1b63def70dd221d392c09cfd
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T14834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.exe

Path C:\Temp\gaytqljdbv.exe
Size 226KB
SHA256 ece03c0bc207b49cca8f278533468c407348a0ef8e9222c52440d01c212b18a8
MD5 4d11d7dcfef22d85af5a6f30891390f5
SHA1 a7780e05631b5e2f3837da8f86b2ec9208b025f6
SHA512 f781ad3507271f1465a69dc6c332406603c9210745f6a850073ceb189b28652909f6a0c820114db3ea6249a610fc4ae756480e1fe152b6fe187a9f7bf11b926d
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1BD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxspkcaus.exe

Path C:\Temp\i_faxspkcaus.exe
Size 226KB
SHA256 60dd58628a68f6762981168da6aec31530fa20a088c21c8ee6a8b47776ab131a
MD5 f3dc1ff2a0edf1d10e8f42d00e9cd130
SHA1 f305e9c22520a05fc8518e601806e1b8ddae0e6f
SHA512 ad4a387a2952265f20c3f5fb874d65ce9b0b55d3601e99204a20da71f9cd5c19ff0416077c32fa83f46d7dc2d981baa70160c9f3dbf47976c6334e96142420d7
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqljdbv.exe

Path C:\Temp\i_gaytqljdbv.exe
Size 226KB
SHA256 0a60420f1dfb0b39b63bc2423a1bb8fe2d3a13c44b7b3481ce1996d68fdd2197
MD5 419ca42aebffb2d41d57303242f72234
SHA1 22be9108764b9a2e7c814b510d690a6bbe9a401f
SHA512 97b0772f2029d5cae43aca9960839c5606d3bb9ff2bb00bc3e8aa5fe9e07cae863234acda658182184e9a6e4ab91c448c2b8a2be521aa2b32b497a6749616ee6
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T15F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbytrljg.exe

Path C:\Temp\i_ljdbytrljg.exe
Size 226KB
SHA256 a52a573e6501638f77fc1bec2abb2638e015b3f0bc57860454035f9b8d0b537d
MD5 5467c1ddb5147c1ae47d3f26cf6dd357
SHA1 7497e135fca782bb0e85315bd9dbf97bc84b5850
SHA512 363b15a9b97548279d264c08bee817fe1d42511d94e5240537a481e49135cce2106d1b886c888c76448dd909c874cce769539c809d08067cb6a74c5bd241bffa
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgecwurlj.exe

Path C:\Temp\i_ojgecwurlj.exe
Size 226KB
SHA256 2390231a15bd2b6006654b33d6f008ec68982cba6f6bf6a90b1fc34857984081
MD5 b9893d120a96be4bc2180657793d641e
SHA1 ca51a0a91c2a3d7705ec0fc70a5432be664f0842
SHA512 6abf17f676f2738cf55e64348161db6cbcf18ff52f6cb6f74296b8f2fcde6dccec082afe4545a79f92b99939a19aee423d0e186874fd40125fc5508229864120
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T11334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usecwuomge.exe

Path C:\Temp\i_usecwuomge.exe
Size 226KB
SHA256 6e03b574ebdaf353a33c4415440525ba1137a7801f96940d852831b90899e790
MD5 324f9aa683ba09f6be1ed684d39f996a
SHA1 6580368c7477ac69199cfb3a56c5179b157b9bee
SHA512 bb230572fd9d7ed10cdf154197ce93a641b40d62a9809b7449e7a5d1850692facd2d8380eb6be0d939963dcd1b05a072c69c36a2ece26d04d112922677d2a795
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T13F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxupmkecwu.exe

Path C:\Temp\i_zxupmkecwu.exe
Size 226KB
SHA256 93b2c11d34b163fb34cda215bef4d487b5319f156ef17b856248ff7d2a96424f
MD5 2a5af11f45dd4cb1dcd6d674a34cc479
SHA1 af1da0f5763db1fa3014a594ccdda8b69fc14e84
SHA512 3e664796fe97625566460639b24dd590f6e4ccdf4e9b0f19552f87beb9d708373fbc00591e827897bccefc8c551191009d2f250a3314b57ec556ec2d878228f2
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idaysqliga.sys

Path C:\Temp\idaysqliga.sys
Size 141KB
SHA256 37bf62dcd79826f3a109c3fc44d3d424b47e78e31dc235222dd42cad9e1ce18d
MD5 9be148b5a1bca24575dfeeaef7d8360f
SHA1 04fd8013ab72f81f17e924c62695f9ab1b9bdac5
SHA512 11a388c98f6a7097ea2f747a0d7cbb61204c5f7b76cfb823ca36db5dfa36fb7c72441d11d8011cd7438247a57e436a5b9233cd207494ab7e211207279ca69b6b
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcamkecwu.sys

Path C:\Temp\khcamkecwu.sys
Size 141KB
SHA256 06d2c250febf48db4ae5aa37c390c33fee7cbae96068a39f55303c0d506213c2
MD5 88ebb778c7e5fbe189f1871bd0b519f1
SHA1 0aa1e847fe347f8815d0feb6dea9b313e62e26f5
SHA512 1213c36b5a8610b2a32576051354374826a05a681459e426035ec9e62143e295697ac2b072d87e393781f91ef83f1f8bd9cf491629488b7e1e4876b867b1dc13
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T165E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtjgby.sys

Path C:\Temp\ljdbwtjgby.sys
Size 141KB
SHA256 bd9739dd811e8bb9b9813b9bb660f7768467fd998c7b753252b0d2345a95fb8a
MD5 cb319172b06e14670be4c21ed7a11cb9
SHA1 712c38ba7fa14e4a7d83ed63a6ababe15948a9c0
SHA512 dfb36677da1009ec37d8cb0dc3b2e7dccf1bde5661166a32313355195cab9debf917adf0ab1a0b256af015522ed396b40368ae3393d3c3413db50301045cf13a
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T192E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbytrljg.exe

Path C:\Temp\ljdbytrljg.exe
Size 226KB
SHA256 ece10bc64e380a72425eaa38ce90638a5d8942229b23cb8797840d78707b504f
MD5 40477dcb1745b548cd4d4196efb677b8
SHA1 c8611962ab96341840dfcb88e36826744f92805a
SHA512 9dd6a82d1967a73628acd4f8762896200d52adac7a2ec660aa34cb063fde8f987809e37cd5c0b0075c2824ae1f2f461fed06c52c461c447293f8af5ec8823dc2
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T19534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgecwurlj.exe

Path C:\Temp\ojgecwurlj.exe
Size 226KB
SHA256 10bae83cee51634484fcee41b18a26b22d39565493b4b960d6fa20a4946a68d1
MD5 3b00e5689ec42faeed02596a6f65fa1a
SHA1 29625685f74fcceb2e41adc4d189f0fb4286547a
SHA512 5e65c1b020f8a647caf3ff3db3b78909adc9361b04535b7da5503a95323c58d42d292f575b70e53a788a83069dda1aacc65e7be8c0c4e69913d211f1a3feaadc
SSDEEP 3072:BPGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:MXY4LK+a3lLNngoqRttA7
TLSH
T12134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgecwuom.sys

Path C:\Temp\romgecwuom.sys
Size 141KB
SHA256 fa31da45121723de4962b349e2882067120cd353ac51f34a49021c68ce53f859
MD5 197215c278b5738774a1680531ed1f6c
SHA1 b1ad04edc6202789eb0d3504fa7f83a0adabe67f
SHA512 4f864789566653da4a40e49e1dccb853220e1bf61f0f43ca037085ebae683ddd3ea5cf41ce6099637843f597783beb1cb8c7c7e601da438b6d97537ecbb0e91e
SSDEEP 3072:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb7C:9a3lLNngoqRt
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbwtol.sys

Path C:\Temp\toljdbwtol.sys
Size 141KB
SHA256 32c4e1945183826c2ab787d12bb119c0f1da377378fc83916b3612dbc764ef2a
MD5 8813ed1d2843f5fa7f4ec87b90ff8f9f
SHA1 095749d357a77aee760ce8556089ef3a5d9edfca
SHA512 3db153be1dc281c66d793fb1f9c0bf5da1a618a4461207890ff64a2f6824ee6538fd83667f59bd5c3c0b826e1767d6e1be4ce52a6ecd0d4f2bf5d72a65ed0c0f
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usecwuomge.exe

Path C:\Temp\usecwuomge.exe
Size 226KB
SHA256 3e501cb9f3f9be8f6e894ecbca78813b02c7da4442d10f3b2267344f26487f79
MD5 6d7628d7553645190918477941a04058
SHA1 7e8a9d82ee2133468be4b5893c1a733ba536ee26
SHA512 a9f94c9de34b66e4177ad84c8a6b335e206ad20c2729cfe17fd037a91c63134fc5e5d9108cea54f9cad91cb4627752b8d0118854788b94d14a210c68dc8020ac
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T12334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpmhbzxr.sys

Path C:\Temp\zwrpmhbzxr.sys
Size 141KB
SHA256 0d40797fafe868c54b9d3c6b03df017279b756d174aa5278dff6697c9eab8510
MD5 a8c7e62c0ef88c5999878b4c86f6ea6e
SHA1 e0b2d684dc1624ba1cb73e6556e9f3639cb79624
SHA512 195571364d9747e8afbbbe59bc7cb5162deae8a5e146aaca81c950a3afa29f243596f01ae13edbdfcd589a94068f93269621c025e575fb8911b77165d956b11a
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T182E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkecwu.exe

Path C:\Temp\zxupmkecwu.exe
Size 226KB
SHA256 0b558b44820742b4ff281ed53cbd93d0f710c4699fd30095fa96838129745d60
MD5 2ca572e1088c14cbdd4ce2d32257e56b
SHA1 301926c9d75f649e4031e5190a174d47c43ac680
SHA512 0c5ecb10353d22c9a161359c684752cd4df6b21fe07a5f599957401fe9558edc2f4997d9d2b72ebb3721a87a1ea93897a742e6fc2d0308bad28b9eb4ea1da077
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ae712abbfe3d469fe53434fc4917154e1c451eaa74d77806dd56c833bd2ce3b6
MD5 db7070412cf9632421562117aa61d27c
SHA1 563b9298fb64f0025c82721de6d59157aa886b50
SHA512 075dd9e15d5deb034f082a6f8e1a4b235ab68274af4bf3ef36aa5b5325e0c98538d172417455fc40ccddba6f198deddf9d6e3ced41f0c4e9e9f55024fb8b9de2
TLSH
T19E6183B7A32906DAEB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0542F281F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593d1f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593d1f.TMP
Size 3KB
SHA256 380d46f268926bc3667b03bf4b58e610a70e158ff762a99c5107bb8c2b22b722
MD5 cfc775222bbe183d71bde7701619d694
SHA1 3f452d537d450dce4906164f29843a3af8921a03
SHA512 6956efa857f98ab2da28058df6679b3893628bc4b86e1e491442e46861205c92f845aca7cd4036daccefce60dd316369bda717dcc4116bac2ffd6b4d37552191
TLSH
T1B26183B7A32906D9EB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a5bbbacbca79ffc950bc5008e9a4f335bd5a05d5216c3acffafa15f104df5089
MD5 8a01481662b63521e33ee3342368c616
SHA1 c8edf6ca9b495d40bca5b8810e1d1d977fec1628
SHA512 86e84eeecd47ad1020563f3c3772988cf1a06db9e63e1d4beda337ccba1f6ebc8bf3d012fe4f2a77f6b3d45b3e856171308f7244d5f0ddf29d652ab44a4e111c
TLSH
T12A41BDF383F4856E8A0156F0AA14AF1FCE2D0911832C7C5AC9E0AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eacbf21e8ccfb707c61d7b4fccb28828738c3f256c50aa6181e88257c567fa6d
MD5 40943050adc77c5afad29faa4c2d1947
SHA1 44efc48426f5bade4aebd8408d8d4279e7b2bb1c
SHA512 ab6683784f085d13f4747649a14d5789ea065768f0274f9ea4a0099efe3b1b75b1d071e527242f16d7b8e031c24133f0e6a5ec618674fce9edc128a8346b381e
SSDEEP 192:sxRiR5Cd/fvsh8wGbzoA8p9//g6+WNCOa/Yo5sCY8GpIgDYhJ:sxRied/fvsh8p6p/5C/9um
TLSH
T14542B7166D28A93B4CC6E31DBB65BF93D3F95032A1D41E48AAFC861C04EB6DD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6f64deea8436beedf834fdb56b006c68efa9252ff68f65a3cba36617cab338c0
MD5 f093bef138cd6fae8c64f50468560181
SHA1 f67cdf33b193aa82f882a97488198167927d1945
SHA512 f537e2ad98ba9500cfd46faee5e1a9b05713b1ecfa8e2c743be23886b51c8d059f257196cb76f0f855836d9ce2d9215c5c1035474c86a3a85d5136b1137db535
SSDEEP 192:sxR1R5Cd/fvsa8wGbzoA8p9//g6+WNCOa/Yo5sCY8GpIgVhJ:sxR1ed/fvsa8p6p/5C/9ud
TLSH
T12242B7166D28A93B4CC7E31DBB65BF93D2F95032A1D41E48AAFC861C04EB6DD221741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48adbd1e9ef67ed5b2df8b90d303f744abc66a2731bf2a2db3d9b30a8c752f17
MD5 4c89f74b9efcf32fcf3727f861a8becd
SHA1 03b19a6b5e5ae169ea9e391e45084ec9fb165e17
SHA512 e1be452f20479f917e04f9dbe7a463de8bacdbda7a37f0cb78813f15d62c7715f03fe46dbb648409eff690a93e9a2b0ec60c5260fe4fba6ce2765a0eaff07618
SSDEEP 192:sxRiR5Cd/fvshPwGbzoA8p9//g6+WNCOa/YoiuCCY8GpIgD6hJ:sxRied/fvshPp6p/5C/du0
TLSH
T1B742A7166D286D3B4CC6E31DBB65BF53D3F95032A1D41E48AAFC861C14EB6CD221B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e4eb7936513f3ce176640022b0f83f3ffe61e419734a0c930431e739a223b1f
MD5 f5d02734f8c4b21556b4f405906bb2b9
SHA1 64ea4075e63a00c72b92181ae449ae3cda8ae63b
SHA512 b483e1f2ab364af621212c593576a7284722266df996ff7ecddbd115806dea8bdd931fd479f990b8da2f079294e46da064216297573add85fb8463fb7e2e23a0
SSDEEP 192:sxRiR5Cd/fvshPdZHOHOq8hzoA8p9//g6+WNCOa/YoiuCCY8GpIgD6hJ:sxRied/fvshPTHOugp/5C/du0
TLSH
T1CB42C8166D28693B8CC7E21DBB55BF53D3F95032A0D51E48AAFC8A1C14EB6CD221B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a980f35956a80557d110376ed886a34506d0b3958adb706e9be21fbcd5ecaf5b
MD5 8f21458f4f178b01a347545780b5dd57
SHA1 a486d4253579b769dc1be54c5f29d10ebab1da94
SHA512 c06c8d297bb491bf445542f58cc42bbe0290d0cf7281f9d870ee4fff7b5607eea98ab400f4042eab456fbae33ab761963c6d2cf076b466081a02796b4a19e1a1
SSDEEP 768:j26HNo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVGjBVuwwro9ye06:j26HNUE7MRWgs2f02u1japjB4wbN9
TLSH
T17ED2DB7B640DCABF4F804ADDEC197E9F6D6802CB9698CD8047FA851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59d7e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59d7e8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 53ae93971e72899d35dd5f8b5f45fda77fcb313febfa74df019830b406824b01
MD5 9c90a9cc5c2c9a10318fc288ffbfa239
SHA1 2fe80ba53efb4531e4776e7ba1f9325b0f278122
SHA512 555621b34b81469a4a7d8dc288c6ca60e4f1463d0d99cdfe8a345c3cea3ced280219122ca8b8213a30f1e3d70c54d29c01da4789f1b4743cbe1e150613453018
SSDEEP 768:sK3gCqMS/TBOWBbatKONXyer1IRCzni9zfG9:sK3HcdSIqn4fG9
TLSH
T1EFF2BF75A8A59E230CE5F3C6B2466393BFF81063D5C84B50EDE99B1E0583A5E270F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d83397c1e227ee5d7b5fb63d69ffc960bf8e14a4ea2dc5f5d1b9aac388d7fccc
MD5 55639968c258910ce5fa05d614e34928
SHA1 378a79268b786bac02f46b241f57de19b55afaeb
SHA512 ade735d5df109e412c66e60516a6f08871add78c006fac73775156d2939acd61e39e1d7cec7e8416499ff7a2607eef688fb549d4f0211120a82d9a527313167b
SSDEEP 768:5rv+4UNbdz3u7s/TBOWBbatzONXyer1IRCzniwzeVH1SK7:5bsbV3DYSIqnfEH1l
TLSH
T10403BF32A1A9DE334DE2B396B14773537FB8206789840B90EDEA1F4E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 242d253eae41d02db51248a45c7c173937bc79b4adba092d03f59a74bc24f396
MD5 b71739c9a43ffefa4f83208df8bb2c54
SHA1 755524cef8c1907f2394424e2701cfcc88d59a5f
SHA512 5bb6ef5506dc9f4cbf2a06123de9a42cc6c9069ee0ff4e228916b49fa90779eefa3f314f2fc587e6c4583577950cf11bc922be8efbb88e58d698b7449ed35284
SSDEEP 768:hrv+4UNbdz3O76/TBOWBoONXyer1IRCzniBUeVH1SK7:hbsbV3VESIqnnEH1l
TLSH
T1FD03BF32A4A89E334DE2A3C5B14776137FF86057D6800B90EDDE1F4E069B59E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 97e355af7e687c6a4e0143d81cf9748919f216ea4f8e547a934a367d6360d6ad
MD5 d1c63d0f2a19bb929f0209afb2d0f45f
SHA1 7151dd1d0dccb18a0f87533558be19ba5ce0dbb8
SHA512 c2f016189fd78f5ac0252228dcc2221656c7534479469a9c1013d52ea76795a0edec7b036c1f98a3b97d10f5f78f6dffc49d27093f138191252e800359c89923
SSDEEP 768:qK3aCxMS/TBOWBbatBONXyer1IRCzni9zfG9:qK3pDISIqn4fG9
TLSH
T1C2F2BF7198A59E230CE5F3C6B2467353BFF81063D5C84A50EDE99B1E0583A5E270F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 36f70fe6a722b67bc9bcbea6af05eaef0cf36d761286948bdbd997a52aa9fce4
MD5 597a51b68e29e455978bd675135394f6
SHA1 5f26f6f8049b54591e87461e07ee6d4e62a34059
SHA512 f08a873ab9079b48b5909c68c905433fad5ee3a890cf1ea8d60297a2a8b2fb4ad9ea714ffa827221b4e1905b577cdde33d0d219ae47a255dbf0287f68c7ce1d2
SSDEEP 768:pFQf3twgICMMxpsOWBbat3ONXyer1IRCzni9zfG9:of3zdxSIqn4fG9
TLSH
T1D71339F594D38937D8AD9383A33D6E469EBCC063B5888990BBD54E4DCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3084_215404943\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1076-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1076-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2312-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2312-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2340-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2780-293-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2920-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2920-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-346-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3836-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-307-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4176-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4324-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4568-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-405-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5988-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6016-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download