9bcbfbcf919d084aaaa0596edc2ce1a8650adfaaab45a3b4f8623377542ac300

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-sg5c4seb28
SHA256 9bcbfbcf919d084aaaa0596edc2ce1a8650adfaaab45a3b4f8623377542ac300
MD5 8beb4e140be1b3e593f6efd0ad1e99c8
SHA1 415da7b8a9c1bb4cb6cbe0f12ed3ca011b6e2dc6
SHA512 9e19b9a02788a254ab1adf60ef3a0f20e80b2935d7c28a5c7de8d53104862e172470b320bd30896784a5f3a593df0cb4c5d51f2d862ac261d7650d825e48aa98
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T11834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1980	CP.exe
1364	xupkhczupm.exe
5240	CP.exe
2344	CP.exe
3528	i_xupkhczupm.exe
5372	ecwupmhfzx.sys
2740	CP.exe
3052	urpjhfzxup.exe
5916	CP.exe
5480	CP.exe
5976	i_urpjhfzxup.exe
5192	trpjhecwuo.sys
4064	CP.exe
1084	rljebztrmg.exe
2288	CP.exe
3276	CP.exe
3444	i_rljebztrmg.exe
4440	trmjecwuom.sys
3928	CP.exe
2604	jebwtromgd.exe
4624	CP.exe
6012	CP.exe
4204	i_jebwtromgd.exe
6116	trljdbywto.sys
3816	CP.exe
1140	rligebwtom.exe
3568	CP.exe
5896	CP.exe
4408	i_rligebwtom.exe
5008	qoigaytqli.sys
3216	CP.exe
1672	tnlgdywqli.exe
1760	CP.exe
624	CP.exe
5224	i_tnlgdywqli.exe
2872	qkidavsnki.sys
3300	CP.exe
5292	kifaxvtnlf.exe
5796	CP.exe
576	CP.exe
236	i_kifaxvtnlf.exe
3528	daysqkicav.sys
4724	CP.exe
4532	xvpnhfdxvp.exe
3672	CP.exe
4204	CP.exe
5496	i_xvpnhfdxvp.exe
3284	hfaxsqkica.sys
4420	CP.exe
900	ifaxsqkica.exe
2564	CP.exe
4408	CP.exe
5044	i_ifaxsqkica.exe
480	fzxrpmhfzx.sys
4308	CP.exe
2576	caxrpkhcau.exe
3836	CP.exe
4956	CP.exe
996	i_caxrpkhcau.exe
4544	pjhurmkecw.sys
5004	CP.exe
3116	ebzurmkecw.exe
2052	CP.exe
4288	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_766790036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1247588835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1247588835\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1309178237\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1013450127\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1309178237\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1013450127\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1013450127\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5836_1013450127\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rligebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwtjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebztrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdayvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupkhczupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligbytqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwurmjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwurmjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupkhczupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligbytqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecaxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtromgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rligebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwtjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdayvqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtromgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecaxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebztrmg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4408	ipconfig.exe
5828	ipconfig.exe
3100	ipconfig.exe
4300	ipconfig.exe
1752	ipconfig.exe
2292	ipconfig.exe
5796	ipconfig.exe
3284	ipconfig.exe
3504	ipconfig.exe
52	ipconfig.exe
2728	ipconfig.exe
2228	ipconfig.exe
5116	ipconfig.exe
4292	ipconfig.exe
1708	ipconfig.exe
616	ipconfig.exe
3132	ipconfig.exe
2304	ipconfig.exe
1440	ipconfig.exe
2776	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317120151154764"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{E52A5FED-243A-48D8-9543-73D7D65C04E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe
5836	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3528	i_xupkhczupm.exe
Token: SeDebugPrivilege	5976	i_urpjhfzxup.exe
Token: SeDebugPrivilege	3444	i_rljebztrmg.exe
Token: SeDebugPrivilege	4204	i_jebwtromgd.exe
Token: SeDebugPrivilege	4408	i_rligebwtom.exe
Token: SeDebugPrivilege	5224	i_tnlgdywqli.exe
Token: SeDebugPrivilege	236	i_kifaxvtnlf.exe
Token: SeDebugPrivilege	5496	i_xvpnhfdxvp.exe
Token: SeDebugPrivilege	5044	i_ifaxsqkica.exe
Token: SeDebugPrivilege	996	i_caxrpkhcau.exe
Token: SeDebugPrivilege	2748	i_ebzurmkecw.exe
Token: SeDebugPrivilege	1256	i_ezwtjhbztr.exe
Token: SeDebugPrivilege	996	i_geywqojgby.exe
Token: SeDebugPrivilege	2920	i_ligbytqljg.exe
Token: SeDebugPrivilege	3248	i_lfdayvqnli.exe
Token: SeDebugPrivilege	2892	i_sqkidxvpni.exe
Token: SeDebugPrivilege	4292	i_ifaxvpnkfc.exe
Token: SeDebugPrivilege	5452	i_kecaxspkhc.exe
Token: SeDebugPrivilege	5496	i_hfzurpjhcz.exe
Token: SeDebugPrivilege	2948	i_jecwurmjhe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 2256	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2256 wrote to memory of 5836	2256	iexplore.exe	90
PID 5836 wrote to memory of 4364	5836	msedge.exe	91
PID 5836 wrote to memory of 1360	5836	msedge.exe	92
PID 5836 wrote to memory of 2680	5836	msedge.exe	93
PID 5836 wrote to memory of 1360	5836	msedge.exe	92
PID 5836 wrote to memory of 1360	5836	msedge.exe	92
PID 5836 wrote to memory of 4928	5836	msedge.exe	94
PID 5836 wrote to memory of 4928	5836	msedge.exe	94
PID 5836 wrote to memory of 3348	5836	msedge.exe	96
PID 5836 wrote to memory of 3348	5836	msedge.exe	96
PID 5836 wrote to memory of 3348	5836	msedge.exe	96
PID 5836 wrote to memory of 5524	5836	msedge.exe	97
PID 5836 wrote to memory of 5524	5836	msedge.exe	97
PID 5836 wrote to memory of 5524	5836	msedge.exe	97
PID 5836 wrote to memory of 4088	5836	msedge.exe	98
PID 5836 wrote to memory of 1088	5836	msedge.exe	99
PID 5836 wrote to memory of 4088	5836	msedge.exe	98
PID 5836 wrote to memory of 4088	5836	msedge.exe	98
PID 5836 wrote to memory of 1088	5836	msedge.exe	99
PID 5836 wrote to memory of 1088	5836	msedge.exe	99
PID 5836 wrote to memory of 4964	5836	msedge.exe	100
PID 5836 wrote to memory of 4964	5836	msedge.exe	100
PID 3644 wrote to memory of 1980	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 1364 wrote to memory of 5240	1364	xupkhczupm.exe	105
PID 5836 wrote to memory of 2728	5836	msedge.exe	109
PID 5836 wrote to memory of 2728	5836	msedge.exe	109
PID 5836 wrote to memory of 5928	5836	msedge.exe	108
PID 5836 wrote to memory of 5928	5836	msedge.exe	108
PID 5836 wrote to memory of 1664	5836	msedge.exe	111
PID 5836 wrote to memory of 4956	5836	msedge.exe	112
PID 5836 wrote to memory of 4956	5836	msedge.exe	112
PID 5836 wrote to memory of 4708	5836	msedge.exe	113
PID 5836 wrote to memory of 4708	5836	msedge.exe	113
PID 3644 wrote to memory of 2344	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3644 wrote to memory of 2740	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3052 wrote to memory of 5916	3052	urpjhfzxup.exe	122
PID 3644 wrote to memory of 5480	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3644 wrote to memory of 4064	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1084 wrote to memory of 2288	1084	rljebztrmg.exe	131
PID 3644 wrote to memory of 3276	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 3644 wrote to memory of 3928	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2604 wrote to memory of 4624	2604	jebwtromgd.exe	140
PID 3644 wrote to memory of 6012	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5836 wrote to memory of 3100	5836	msedge.exe	146
PID 5836 wrote to memory of 5484	5836	msedge.exe	147
PID 5836 wrote to memory of 2316	5836	msedge.exe	148
PID 3644 wrote to memory of 3816	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 1140 wrote to memory of 3568	1140	rligebwtom.exe	153
PID 3644 wrote to memory of 5896	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 3644 wrote to memory of 3216	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 1672 wrote to memory of 1760	1672	tnlgdywqli.exe	162
PID 3644 wrote to memory of 624	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3644 wrote to memory of 3300	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 5292 wrote to memory of 5796	5292	kifaxvtnlf.exe	171
PID 3644 wrote to memory of 576	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 3644 wrote to memory of 4724	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4532 wrote to memory of 3672	4532	xvpnhfdxvp.exe	180
PID 3644 wrote to memory of 4204	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 5836 wrote to memory of 980	5836	msedge.exe	185
PID 5836 wrote to memory of 980	5836	msedge.exe	185
PID 3644 wrote to memory of 4420	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 900 wrote to memory of 2564	900	ifaxsqkica.exe	191
PID 3644 wrote to memory of 4408	3644	2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8beb4e140be1b3e593f6efd0ad1e99c8_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffdf071c188,0x7ffdf071c194,0x7ffdf071c1a0
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,106574619011335595,15666782594176221536,262144 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:2
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,17205637867633687315,7813254584945501584,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
      4⤵
      System Time Discovery
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,9982484798840533190,10174195835794065850,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,1485444702807792427,15878099420377381523,2097152 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,10132619767963474116,15705804857846820571,2097152 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,1733298391577336225,10167239267162503475,2097152 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,8471609366798423939,16246114489554048834,2097152 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:9
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,3491120784946309031,4568246675699107613,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,12537172938964617076,5944799811286296139,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,15590957532868197137,18168110098142406936,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,15080377752228554056,5631770359741721307,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,15080377752228554056,5631770359741721307,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,14317511772721965196,3152230185833138422,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,7873834694700368933,17990595881153466611,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,10396753609652861797,5309725300207665393,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,5363301261303076203,13510656434621592731,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,4180696463544431546,17810042985785582889,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,4041364276045604358,11526166978133003477,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,9957629032164807358,1639007513593959343,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,12353542942995577264,14787389726920894590,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,10931780218769563537,16372495891491324051,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7004,i,6138330225836032333,3585820838782781092,262144 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,6300951508114947724,4499692563976060620,524288 --field-trial-handle=2468,i,2850315745842985273,13151140946001222813,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:5748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupkhczupm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1980
- - C:\Temp\xupkhczupm.exe
    C:\Temp\xupkhczupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupkhczupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\i_xupkhczupm.exe
    C:\Temp\i_xupkhczupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhfzxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2740
- - C:\Temp\urpjhfzxup.exe
    C:\Temp\urpjhfzxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhfzxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Temp\i_urpjhfzxup.exe
    C:\Temp\i_urpjhfzxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebztrmg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4064
- - C:\Temp\rljebztrmg.exe
    C:\Temp\rljebztrmg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebztrmg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3276
- - C:\Temp\i_rljebztrmg.exe
    C:\Temp\i_rljebztrmg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtromgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3928
- - C:\Temp\jebwtromgd.exe
    C:\Temp\jebwtromgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtromgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\i_jebwtromgd.exe
    C:\Temp\i_jebwtromgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rligebwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\rligebwtom.exe
    C:\Temp\rligebwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rligebwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Temp\i_rligebwtom.exe
    C:\Temp\i_rligebwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdywqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3216
- - C:\Temp\tnlgdywqli.exe
    C:\Temp\tnlgdywqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdywqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:624
- - C:\Temp\i_tnlgdywqli.exe
    C:\Temp\i_tnlgdywqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaxvtnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3300
- - C:\Temp\kifaxvtnlf.exe
    C:\Temp\kifaxvtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaxvtnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:576
- - C:\Temp\i_kifaxvtnlf.exe
    C:\Temp\i_kifaxvtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\xvpnhfdxvp.exe
    C:\Temp\xvpnhfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:52
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4204
- - C:\Temp\i_xvpnhfdxvp.exe
    C:\Temp\i_xvpnhfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\caxrpkhcau.exe
    C:\Temp\caxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_caxrpkhcau.exe
    C:\Temp\i_caxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebzurmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5004
- - C:\Temp\ebzurmkecw.exe
    C:\Temp\ebzurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebzurmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4288
- - C:\Temp\i_ebzurmkecw.exe
    C:\Temp\i_ebzurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwtjhbztr.exe ups_run
  2⤵
  PID:3220
- - C:\Temp\ezwtjhbztr.exe
    C:\Temp\ezwtjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwtjhbztr.exe ups_ins
  2⤵
  PID:1204
- - C:\Temp\i_ezwtjhbztr.exe
    C:\Temp\i_ezwtjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqojgby.exe ups_run
  2⤵
  PID:4488
- - C:\Temp\geywqojgby.exe
    C:\Temp\geywqojgby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqojgby.exe ups_ins
  2⤵
  PID:4560
- - C:\Temp\i_geywqojgby.exe
    C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligbytqljg.exe ups_run
  2⤵
  PID:4112
- - C:\Temp\ligbytqljg.exe
    C:\Temp\ligbytqljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligbytqljg.exe ups_ins
  2⤵
  PID:5856
- - C:\Temp\i_ligbytqljg.exe
    C:\Temp\i_ligbytqljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdayvqnli.exe ups_run
  2⤵
  PID:1272
- - C:\Temp\lfdayvqnli.exe
    C:\Temp\lfdayvqnli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdayvqnli.exe ups_ins
  2⤵
  PID:3128
- - C:\Temp\i_lfdayvqnli.exe
    C:\Temp\i_lfdayvqnli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidxvpni.exe ups_run
  2⤵
  PID:1872
- - C:\Temp\sqkidxvpni.exe
    C:\Temp\sqkidxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidxvpni.exe ups_ins
  2⤵
  PID:3192
- - C:\Temp\i_sqkidxvpni.exe
    C:\Temp\i_sqkidxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvpnkfc.exe ups_run
  2⤵
  PID:2364
- - C:\Temp\ifaxvpnkfc.exe
    C:\Temp\ifaxvpnkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvpnkfc.exe ups_ins
  2⤵
  PID:2476
- - C:\Temp\i_ifaxvpnkfc.exe
    C:\Temp\i_ifaxvpnkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecaxspkhc.exe ups_run
  2⤵
  PID:2260
- - C:\Temp\kecaxspkhc.exe
    C:\Temp\kecaxspkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecaxspkhc.exe ups_ins
  2⤵
  PID:4072
- - C:\Temp\i_kecaxspkhc.exe
    C:\Temp\i_kecaxspkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzurpjhcz.exe ups_run
  2⤵
  PID:4828
- - C:\Temp\hfzurpjhcz.exe
    C:\Temp\hfzurpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzurpjhcz.exe ups_ins
  2⤵
  PID:1840
- - C:\Temp\i_hfzurpjhcz.exe
    C:\Temp\i_hfzurpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwurmjhe.exe ups_run
  2⤵
  PID:3868
- - C:\Temp\jecwurmjhe.exe
    C:\Temp\jecwurmjhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwurmjhe.exe ups_ins
  2⤵
  PID:1892
- - C:\Temp\i_jecwurmjhe.exe
    C:\Temp\i_jecwurmjhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5084

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\trpjhecwuo.sys
C:\Temp\trpjhecwuo.sys
1⤵
- Executes dropped EXE
PID:5192

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Temp\trljdbywto.sys
C:\Temp\trljdbywto.sys
1⤵
- Executes dropped EXE
PID:6116

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\qkidavsnki.sys
C:\Temp\qkidavsnki.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\daysqkicav.sys
C:\Temp\daysqkicav.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
- Executes dropped EXE
PID:3284

C:\Temp\fzxrpmhfzx.sys
C:\Temp\fzxrpmhfzx.sys
1⤵
- Executes dropped EXE
PID:480

C:\Temp\pjhurmkecw.sys
C:\Temp\pjhurmkecw.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\gezwuomgec.sys
C:\Temp\gezwuomgec.sys
1⤵
PID:1052

C:\Temp\jheywrojgb.sys
C:\Temp\jheywrojgb.sys
1⤵
PID:3880

C:\Temp\nlgdywqoig.sys
C:\Temp\nlgdywqoig.sys
1⤵
PID:5496

C:\Temp\qolgdyvtql.sys
C:\Temp\qolgdyvtql.sys
1⤵
PID:2364

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
PID:1696

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:4584

C:\Temp\kfcxusmkic.sys
C:\Temp\kfcxusmkic.sys
1⤵
PID:952

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
PID:1696

C:\Temp\mjecwuomke.sys
C:\Temp\mjecwuomke.sys
1⤵
PID:5888

C:\Temp\urljebwuom.sys
C:\Temp\urljebwuom.sys
1⤵
PID:6028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupmhfzx.sys

Path C:\Temp\ecwupmhfzx.sys
Size 141KB
SHA256 0677a6c1537315f343e37388f66cfe3dc4eb82ae408d3328d0a8631a53aaca38
MD5 8e90ddbad342c9a400f370aa4c165f4e
SHA1 d80efc1032fc911ab9d300b3f2d69dcc782b2955
SHA512 1231a9d8ecd4f73ccef13bfc731a910a46c2b942fd6cb9cdf31b68824161fd9b1279c7b206ff38efa48ef4ce1d7b9ef88930b453b33ca486475cfe70ec83cafc
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltW:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebwtromgd.exe

Path C:\Temp\i_jebwtromgd.exe
Size 226KB
SHA256 9c8eeb9df5f1243d9b6b8db4c5909c844c521f27999dc7f9d221f03bc95d9efc
MD5 9d861919a6a50ea6ddf54fe5b9ec54b4
SHA1 aefb1ae2a7c833ef1a6789e5fe0acc985998ddb5
SHA512 d9857177405b1ec5b326d78d672a6069efc3a0772b2934bcf733545edba2471edbe0c51fc041bae26270f689c192ccfbc5490a5495ccd73838eb5048669e68ab
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T1BC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rligebwtom.exe

Path C:\Temp\i_rligebwtom.exe
Size 226KB
SHA256 db862e0818a059e817ddb87f9a91cf619b1c24d27b10ea02ee2e0576dae0cf23
MD5 d7978efaa5e0ac9b362963658b32129f
SHA1 b1800ec66c4546a93bd82355f3f549e8bcacca42
SHA512 9f01d8eeaf8ac827197f175c9e7f22ad79072ee19fec0cd1070f3cfc4d8bdb2dd2c783e41f56a8225ca5753d22b48e7e972d55610c59ac90789c35d9c303bde2
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebztrmg.exe

Path C:\Temp\i_rljebztrmg.exe
Size 226KB
SHA256 ea5b7a6ba0bcde8d1ef6d3b46b04b422d69929ebb04b0121357f10233251706c
MD5 a55ccad47a0b95bca01e19906c0cf892
SHA1 378e0578bbf0820024bb86c0ba1a5c96d0c1b3d6
SHA512 365820b47feef70da8dd5287d959f5e0abe9ffb40c48f1fe1d0ecbf696b4885d0f260a74f6e036807952cd8d3116f691add6a0cb4de83c051887e071c2c66e70
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T16134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdywqli.exe

Path C:\Temp\i_tnlgdywqli.exe
Size 226KB
SHA256 b90285a6e0c2fa489fa168fff414a5ba216be3359e1b47eb51d218b82d7c5789
MD5 9fad061ce527b90833bcbe0f56a9ef70
SHA1 065288a77bdf6d42a38b0dfbadbaed25456b2d7e
SHA512 8a42a77e7d353e88713cfe18afa66dd6b61be4c31fafdf93dc40dd45adae9e8e3bd7ff44c0312e8b22b4623eeb4f717d74f4abcfd974eac2f699e9d9069de92d
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhfzxup.exe

Path C:\Temp\i_urpjhfzxup.exe
Size 226KB
SHA256 bf009059f837fabc9d4f08b559197c8cdf6d8e80314369e3e97d46fcdb9dc14d
MD5 f4bf236b7f82e776789dc3bf40794c2f
SHA1 433fea78305ab33fc6b29349c4e33b61170c2aa9
SHA512 3b85190e6099f8a13f52f6cebbffb23a64a7ce92812fdae35408ba7415eab27362ebcb594370c34c7048f7737d927b4dd3ff8e4dd3c7bb4bc1c31331b34b9ac3
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupkhczupm.exe

Path C:\Temp\i_xupkhczupm.exe
Size 226KB
SHA256 4d5b6b6847743a84545eed8be0570144bfa931ec41d876f8c3b88a0c5167d525
MD5 a90680bab18500aa07898ba307f3cf94
SHA1 571dc7bd106c214c2142f0efa0e74c2e86d19802
SHA512 e72630988c53889fabea86b843fb3ae38b44d91d2a16c6d404c8a1e2952c54d7b42f1b18384ba84523d874ccd36c982b4432da672af3f213d11c3d89da59b3e0
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T12034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwtromgd.exe

Path C:\Temp\jebwtromgd.exe
Size 226KB
SHA256 96ab2a5deadfe80824370b35a623736f51903ed4cf8bc48d66b435dd757a1dea
MD5 41d414c43761e561aa25d450ea547b3f
SHA1 5226471b994b508534f470dad2038c3c76214b67
SHA512 3e198d002057771ccb3d6dd3a1e5a850958d821b275c6ea6346f44231a9dc9167afd9555d3c510c0e9d84a43d4070b0c5cfcc5ca304cf6eed6c65b0d33fae2fe
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T12F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavsnki.sys

Path C:\Temp\qkidavsnki.sys
Size 141KB
SHA256 c959634da615ccf395e7b1f154ce2ce314afcb39228b6f840425f3f94b7eb8d3
MD5 ac6a7a07c5bd22f1902791c8b64c5542
SHA1 43194b400af73ce1190ff272715016b5878576ff
SHA512 4e1308e85fd66379a1bc7f2ec96607ea4c6a129a07712da0ae46db5e70f31395030e6079ff4a4cf059ed651f31cd77e867c2320a02d59af026c459eb67900573
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqli.sys

Path C:\Temp\qoigaytqli.sys
Size 141KB
SHA256 24013d49c8311e52dfa474f281a4753b8b8956a97128087501c5b3d69d910382
MD5 96b9f2c5b8e1c2b4a0c56a9a432f5c1c
SHA1 c41089674f64a11942dcc39bc53d9ef6ce063755
SHA512 a6dd120b1371efa3c61cc0e842de7eb75f390dab65b94116110583fe8a4425561cd31b54bb0c4dbe816f47d859e2b7c7dc701d1328ab7ccecffa14424864a582
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rligebwtom.exe

Path C:\Temp\rligebwtom.exe
Size 226KB
SHA256 2bfb1f4f7c658906964dfb03727882c10ad7c3318597e955f32ea9a2601ca190
MD5 874c134265aa6d546bfc67b3c955b8d6
SHA1 16c73742e5a3c840eb6bd2cedfa0d34d9d4d2e08
SHA512 068ecfeb29241c163a57b080fb9eb8bbc98966c13652c2d01e93998bd68f883706270f5f7be2d70235b4383f0e1e44f317e8fa94863a9911fea32ea7af83ca0a
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T18034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebztrmg.exe

Path C:\Temp\rljebztrmg.exe
Size 226KB
SHA256 862de6fdd38e5c6892660431f973924887e3644c423217d27a7c45da5e230c4a
MD5 ae55e4664a45b6772f033c5271c2a6da
SHA1 b76c76134129c4313298761b4df2e0920f300a2c
SHA512 df74aeb1e8c66812d7bc6580c5685d124106bd165bae2890cc447087ac871e1ca2718e32de9d00e4d79236ad905d0b071aa33948d55c47bbfbab60e2cd702d88
SSDEEP 3072:O1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:nXY4LK+a3lLNngoqRttA7
TLSH
T16334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqli.exe

Path C:\Temp\tnlgdywqli.exe
Size 226KB
SHA256 ba9575a7aeb4b4a21eab09173f3ba8369f4c9fa9558296356a7102603e31f2df
MD5 34aff13e690e0ad4c51ab17aad205b33
SHA1 f3a7fd985518bea626daebfb5d98e3f8a977f36f
SHA512 8c58aec9299f37cbf6d15f8f271ef2498c6e0ff1d64378eb9703b902096428310c410042ff8ace8f02af75611daac38956be5f02480c0e0c88a233712aadb416
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbywto.sys

Path C:\Temp\trljdbywto.sys
Size 141KB
SHA256 a36da725b001609bd0cf6dec9c7b9723424cff672d4e6e8ab218df0fd32e6fcd
MD5 a526f66aa577d88c8125ab371217be85
SHA1 3eef98d8abaa718611fccdff02aa93f5a446dcf8
SHA512 102232165e5383ec04020915fb2335b46cc04b16d1bfd0e3e65e0134dcbb2dbf490d332648e9e5933d92310a146cd1694b59a72cdc8c595349b5e6818f62343a
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T166E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.sys

Path C:\Temp\trmjecwuom.sys
Size 141KB
SHA256 df3e0a86bcf65f9d68e34ff5649a649b7d41fd30cf071a7f40f0bf2beb1c84ed
MD5 9ddf252eb412663122af068de3c9ffc5
SHA1 4099a781018e2535b1d8d44587dc8b5cc406e729
SHA512 67ea596fc641a53937b097b412b4b99d4efd4e8c1c0654a6b618f5a645f87bf86276a53f017165ae1283c0a6778159dd1eb72c1606a524a289716d8456d4a559
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhecwuo.sys

Path C:\Temp\trpjhecwuo.sys
Size 141KB
SHA256 27069ad5f25699ba72a6c9971a248491fb0e2798eeec64e3715fbf8813391d6c
MD5 2b82702bf3550e2c9740623b85ff721d
SHA1 6093e710760cf5e2e3df43d59bd537a135e9e7bb
SHA512 e8b9d03edcc68e795f9dde395a71153bc00c7157e21e92da5a383df813d8930b97023a76efcbdaf42e702bc870a09b5adab3d5db60dedfe4e6d40b45b4380000
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T189E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhfzxup.exe

Path C:\Temp\urpjhfzxup.exe
Size 226KB
SHA256 4b6758fcdf103dc3759da96633637ea0cbfbcccdab041ed5b257c24d1762f24b
MD5 0b3f814f3bd09554f8ed2261b9c44ed5
SHA1 9367e01d9d418ed146f513d1f6968821fd332c22
SHA512 521e1c2bb19fc8fd913ec1bcba285c8b30b835b960874a915e31f5514883d95fbbcde6ebb23e2d68e78d2e13ba26862e54f9756ce404ba410baaa6bf136f46c1
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1D534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupkhczupm.exe

Path C:\Temp\xupkhczupm.exe
Size 226KB
SHA256 f8906b80d5dcd261369864002d79ab3e2c795b6e7658c28ff6d15d0391f8d33c
MD5 f70c48a9d5d525a968ee06b7e43fe500
SHA1 7a1661c4b0a8820fc12d40b0341d28f037eaf8d0
SHA512 0e4344c6f996e0c015822fb138538afb1b5293ff5f0a1b19ed2341018ebdb99ba1b505f79096ccede1c3a8b9ec304fff6b9bd7881cbbd08537c26b26812a6e1f
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T17534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

1cd07e6d-cd41-46be-a5c3-f05fbe9c5e93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cd07e6d-cd41-46be-a5c3-f05fbe9c5e93.tmp
Size 12KB
SHA256 915fdfbe38ec6e9ecee155371e95c7ed9a8d3382e7b34fbe884be93e8a707a40
MD5 fcc856270c32ab1aa5bb2e37d164e9c7
SHA1 bc4c52e8ee8485ec9d881e451dda1834ea6c864a
SHA512 4c9f94b308fc68e384f5f192001bc0d7233fc4ba02968a386dd333ac62de1c390ec5b1f2f0d33cbb4357f23d5e741d5ec1f144b088b252ab038c066f23d4a6af
SSDEEP 192:sxR+RIC+f/fAsrHQUlZi7zoA8p9i/g6+WNC1q/YEZD3xGfNIgDFUJ:sxR+p+f/fAsrwULias/5Z/tWC
TLSH
T19742C8166D28AD3B4CC7E21DBB55BF53D3F95072A0915E58ABFC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 332d2aa676d8d57e65d32b768009b3a645563a2aa18ad6ff697619ed4f94faff
MD5 636b4ef3d40cccf2f3d11414ae07d74b
SHA1 3c4ca22c21c72ae94ac18ab398dd2d8919ac1a1d
SHA512 6e0ed525ec20f8d915431e92a0f1a945fbb2e60a87d1a81e6a686a8bfd575d0c027706d9fda0c81e535d2708c200d92121cb2a172c4ffce287005a587ee706d4
TLSH
T17D6184B1532219E1F329A9BF20E2D04B32F5B646593F6E241688AF742F06F3590DC47B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594c03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594c03.TMP
Size 3KB
SHA256 e7ec61289cde6d852b7f9b129a61e005b8aa963f5bc8d42b5eb4dd30ea640965
MD5 cafe5668b9cf42385d7ab20d6bb37002
SHA1 36d343021d9b331be60322094943f6b65844c113
SHA512 1b72398f885aeeb3de79df79716544f4168646bf43f63380223cffe347ac61c6227392dd8a4c8a264416cf3f43fadd9810668b160be99974e513605f46c0fe9d
TLSH
T14E61B671532209D0F329A9BF20E2D04B32F1B646553F2E2012889F746F06F3590DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 603d16138d47ec7871a2721083b7fafd2e2ec3010ad83addc35e86f94fa011ad
MD5 06ddb8d5e480da74dded3e84786efd76
SHA1 aeed97189c3733e139d1967c475e9c612ce3e3b2
SHA512 5f7e4cc3f0bd5cf109cb43927500d1f9b39171d3aa54925d6b0db37164294ac6a7f55309f86f2b8c9aca78e705002c2aab1ca126dc2787d484e941c1247d21a3
TLSH
T18E41BCF383F4856E8A0196F0AB146E1FCE2C0911432C7C9AC9E4AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 355e9ded052cd03d7591c9e7f8c2f3eaed7d3238413dd2c73a4fb51604356f7c
MD5 5493d409184fc8b33c5421d89d15428d
SHA1 009cdf94055035e1386cf2bb70fe4bfdc035d455
SHA512 3c15e366ff069e1173a7662c4d82a6ab1a9b19846486f6dd7988eb83a391a095b8cd5e925cf348bdb41ed464d2f835c25df2503b397e9a18dad61b98824eba26
SSDEEP 192:sxRhRIC+f/fAsmxQUlZi7zoA8p9i/g6+WNC1q/YEzz3xGfNIgVUJ:sxRhp+f/fAsmWULias/5Z/DWe
TLSH
T10942C8166E28AD3B4CC7E21DBB55BF63D3F95072A0915E58AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b591a1688d1211d11c1a0af7117428e18936be0743a031008e65bb90241fec6
MD5 fc0029bac51e3f37ccc58ecfd25738f3
SHA1 35ff0089c576375a22b3befa0c65d91abce1b6b3
SHA512 7c035bc4488a7494ee4cb36011caad1918cff73c00d09c3034bcfdcdc6ccf2fa30598495b7788ef3b3d2c2b4de67bbe39b7bf0ce5b84c3818f11aa3611ba9282
SSDEEP 192:sxR+RIC+f/fAsrxQUlZi7zoA8p9i/g6+WNC1q/YEzz3xGfNIgDHUJ:sxR+p+f/fAsrWULias/5Z/DWc
TLSH
T15B42C9166E28AD3B4CCBE21DFB55BF53D3F95072A0915E58AAFC8A1C04E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 720d50dd3672b8d39a8609617bbaa5c222c2d64a24df21e534b599ed93cf85ba
MD5 df540c6f4a18c076ece48332ad134ff1
SHA1 07504381abb1fa34d1bc07d84c160ba5708d877c
SHA512 c9a37391b61de852a59671773c4a4deaa40da835ea5ef17943386f0c81110facd39087843f23f5e23bea06fa1f9fb02f17eb9261308d8b456aaa1b5812458916
SSDEEP 768:40Dk6DJQD8QF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAY:40Dk6DJQD8QTE7N0DbWgQ6DjfIQDFu11
TLSH
T1DBD2DA7B640CCA7F4F804ADDAD197ADE6DA802CB96D8C98047FE991C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 767cc4f49cc0f7f646dc2a80ae59c77567e871d635412eecef86247402fab604
MD5 2aae2f1757a034813400b330629473c7
SHA1 467572df21aef9bbea4e42cc262afb878e575aee
SHA512 3d11fa476d127e0fd81838445d19c36f0ad00608f7e1f41374cd8443d7cbcdcca272f7a1e4c590d0c68e1f74f47a3ee45425b5f6b94f0a28df44f3d817cf8c21
SSDEEP 768:Aq3sey1KDTd+ZbOeX6+qTko0u229a4vsTbfPi:Aq3s9tbNvVTVKa46fPi
TLSH
T1AFF2BF71BC659C7348EAD384B2572647AFB520B3D5CC1E04A9EDAB1D010776D2B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 081c3b7449b09fbe55f85f9cc8419b4471ab36c408bc9a043db6ee7024dc654a
MD5 4ea39fbed55f8cbb7634b4b910778ed7
SHA1 abacbfe12c2780c102834ba562e19c598b09997d
SHA512 4c610c695c3bd9e00e5d48597239a6f0648aa2e5d4daa287834ef1b2a86117bbe7a5005aa4470861bcea3a6fa90031647b05de6f5ee12f6e4c92e9fd23c7964d
SSDEEP 768:Trv+4UNbdG3yPoIDTd+ZbCeX6+qTko0u229a4vsSbeVH1SdW:TbsbU3AkbxvVTVKa41EH1h
TLSH
T1BA03CF32F8698D3349E69784714B36573FB821B38A880B54D8EDAF4D064769D270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f71ef8a4deb01ffac0ad0af42577add1f470f00d24d32e087625ecaf859f487c
MD5 750489e080ef0fcf754e286e26418ecc
SHA1 3c67ef1a655894a21934c4399faaa544e989753b
SHA512 acbaa76205a8413e9edd1b010131f8b5809be0b68f677162f29370d3ea4322f3e3e36088896d510ed2695aea5ea75b88eb9bac603fa5b078fee7eae224e9ac3b
SSDEEP 768:gq37ew1KDTd+Zb0eX6+qTko0u229a4vsTbfPi:gq37PtbzvVTVKa46fPi
TLSH
T193F2BE71BC659C7348EAD384B2172647AFB520B3D6CC5E04A9EDAB1D014776D2B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 44ac3633432df54b50292e52ce122c9008238c8c0887529cd7b61726627ca2a8
MD5 a7bd1c1563e357eeece5a0b7ad5ca8c5
SHA1 555a1a7677f5471e40446107a194056fbc77287b
SHA512 9edb497d34f29f1402f1bd94e945e2915ced3c8475fb26364c7ecbd744850896576f4b1e37e93d6115ce4eb030f92aeed5bb0e15041d5bd7fc470509d9a1d3c2
SSDEEP 768:prv+4UNbdG3b4oDTd+ZjeX6+qTko0u229a4vsDPeVH1SdW:pbsbU3civVTVKa4OEH1h
TLSH
T1A303CF33E8658A778CE79784724B75073EB96163C6D80B80D9ED6F0D069B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8c2e059a9f7a4efe0e6fd351d4b7a1738b548e1d562c156acb519a1868debf98
MD5 76c1c13f398afaf11fcd052c04e69fac
SHA1 cdf4f2a14bbafb24fa84b2f4b1cd5064675fb62f
SHA512 8a0f01f0edf952cfd15d53de282526ef21834de069130b168992e8eadac292bbf29ae741c1f1bebb6d42fa5e2108d6457ad8f9ba897d80ee97b8bd756122833e
SSDEEP 768:Cr37ewfaDiApEVZbceX6+qTko0u229a4vsTbfPi:Cr37PMAbrvVTVKa46fPi
TLSH
T132036CF1A8E79833C89DD347633E2D466E7CD063B5881A04B7D99A1CCD0667FD70A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

7d91e575-d0f1-4982-a4dc-a3b11a86185b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d91e575-d0f1-4982-a4dc-a3b11a86185b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5836_392488748\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/480-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/952-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2364-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3284-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3880-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5008-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5192-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5372-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5496-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5888-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6028-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6116-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download