8918d759fb64e41ce4c908a8f1d96a41c56362d995a6356a1f900467721bae6a

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260908-3b7ldsywht
SHA256 8918d759fb64e41ce4c908a8f1d96a41c56362d995a6356a1f900467721bae6a
MD5 6fe30208748a7ee63a30c0c443594226
SHA1 7757390a25587429401b9403ac765bbb744998d1
SHA512 718685c1c7bd1fbc0d03c3f02befa881e10aeda5faa1d29729e863d52fea6df04cf2876fb396f5ee6e401e3eff260ad5cc50e3e26255494fdc71e8724796c83d
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1072	CP.exe
4244	davtnidavs.exe
3984	CP.exe
3280	CP.exe
5984	i_davtnidavs.exe
1892	icaysqkica.sys
5848	CP.exe
5540	spnifaxsqk.exe
1536	CP.exe
4184	CP.exe
5196	i_spnifaxsqk.exe
4920	mkfcaxspkf.sys
4224	CP.exe
3488	nkfcaxspki.exe
5544	CP.exe
5532	CP.exe
1608	i_nkfcaxspki.exe
5472	rpkhfzxrpk.sys
2616	CP.exe
4132	pmhfzuspkh.exe
1396	CP.exe
5548	CP.exe
5140	i_pmhfzuspkh.exe
5804	urmjecwuom.sys
2500	CP.exe
5884	mjhbzxrpmg.exe
1188	CP.exe
1932	CP.exe
2504	i_mjhbzxrpmg.exe
4892	bztrmkecwu.sys
2848	CP.exe
4336	rljhbztrlj.exe
5260	CP.exe
5724	CP.exe
3244	i_rljhbztrlj.exe
5056	wtomgeywro.sys
4980	CP.exe
4560	ywqojgeztq.exe
2604	CP.exe
2472	CP.exe
4832	i_ywqojgeztq.exe
2460	ytqoljdbvt.sys
1100	CP.exe
1380	bytqljdbvt.exe
1892	CP.exe
6052	CP.exe
3556	i_bytqljdbvt.exe
4232	tqoigbykid.sys
5384	CP.exe
2672	idaysqlidy.exe
5168	CP.exe
796	CP.exe
5664	i_idaysqlidy.exe
1492	fdxvqnlida.sys
2728	CP.exe
2780	xvtndxspni.exe
4948	CP.exe
5468	CP.exe
5804	i_xvtndxspni.exe
632	xspkifaxsp.sys
1432	CP.exe
1952	spkicavsnk.exe
5880	CP.exe
3732	CP.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_2029642063\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1789916552\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1021087010\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1021087010\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_466524059\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_466524059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_466524059\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1789916552\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1854553748\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1854553748\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1021087010\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_1021087010\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2748_466524059\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdxvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzxrpmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojhbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzxrpmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtndxspni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdxvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqlidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtndxspni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqlidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgeztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojhbywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzuspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgeztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlfdyvq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4232	ipconfig.exe
4232	ipconfig.exe
820	ipconfig.exe
5920	ipconfig.exe
1464	ipconfig.exe
936	ipconfig.exe
2720	ipconfig.exe
4812	ipconfig.exe
4112	ipconfig.exe
4896	ipconfig.exe
5312	ipconfig.exe
5828	ipconfig.exe
5468	ipconfig.exe
1052	ipconfig.exe
2952	ipconfig.exe
4460	ipconfig.exe
3744	ipconfig.exe
4652	ipconfig.exe
4516	ipconfig.exe
4216	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333832950600570"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{3153C749-1280-49BF-94D4-43902B1EEE9F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	i_davtnidavs.exe
Token: SeDebugPrivilege	5196	i_spnifaxsqk.exe
Token: SeDebugPrivilege	1608	i_nkfcaxspki.exe
Token: SeDebugPrivilege	5140	i_pmhfzuspkh.exe
Token: SeDebugPrivilege	2504	i_mjhbzxrpmg.exe
Token: SeDebugPrivilege	3244	i_rljhbztrlj.exe
Token: SeDebugPrivilege	4832	i_ywqojgeztq.exe
Token: SeDebugPrivilege	3556	i_bytqljdbvt.exe
Token: SeDebugPrivilege	5664	i_idaysqlidy.exe
Token: SeDebugPrivilege	5804	i_xvtndxspni.exe
Token: SeDebugPrivilege	528	i_spkicavsnk.exe
Token: SeDebugPrivilege	1680	i_hfzxupmkec.exe
Token: SeDebugPrivilege	4884	i_jhbzurmkhb.exe
Token: SeDebugPrivilege	1640	i_uomkecwurm.exe
Token: SeDebugPrivilege	528	i_trojhbywuo.exe
Token: SeDebugPrivilege	248	i_ywqojdbwto.exe
Token: SeDebugPrivilege	5344	i_yvqnlfdyvq.exe
Token: SeDebugPrivilege	6128	i_igdxvtqoig.exe
Token: SeDebugPrivilege	2380	i_nlfdxvqnif.exe
Token: SeDebugPrivilege	5804	i_kfdxupnhfz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 924	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 924 wrote to memory of 2748	924	iexplore.exe	90
PID 2748 wrote to memory of 4588	2748	msedge.exe	91
PID 2748 wrote to memory of 2476	2748	msedge.exe	92
PID 2748 wrote to memory of 1200	2748	msedge.exe	93
PID 2748 wrote to memory of 2476	2748	msedge.exe	92
PID 2748 wrote to memory of 2476	2748	msedge.exe	92
PID 2748 wrote to memory of 2516	2748	msedge.exe	94
PID 2748 wrote to memory of 2516	2748	msedge.exe	94
PID 2748 wrote to memory of 4132	2748	msedge.exe	115
PID 2748 wrote to memory of 2644	2748	msedge.exe	97
PID 2748 wrote to memory of 4132	2748	msedge.exe	115
PID 2748 wrote to memory of 4132	2748	msedge.exe	115
PID 2748 wrote to memory of 2644	2748	msedge.exe	97
PID 2748 wrote to memory of 2644	2748	msedge.exe	97
PID 2748 wrote to memory of 5380	2748	msedge.exe	98
PID 2748 wrote to memory of 4144	2748	msedge.exe	99
PID 2748 wrote to memory of 5380	2748	msedge.exe	98
PID 2748 wrote to memory of 5380	2748	msedge.exe	98
PID 2748 wrote to memory of 4144	2748	msedge.exe	99
PID 2748 wrote to memory of 4144	2748	msedge.exe	99
PID 2748 wrote to memory of 5560	2748	msedge.exe	100
PID 2748 wrote to memory of 5560	2748	msedge.exe	100
PID 3412 wrote to memory of 1072	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 2748 wrote to memory of 2412	2748	msedge.exe	105
PID 2748 wrote to memory of 2412	2748	msedge.exe	105
PID 2748 wrote to memory of 3580	2748	msedge.exe	106
PID 2748 wrote to memory of 3580	2748	msedge.exe	106
PID 4244 wrote to memory of 3984	4244	davtnidavs.exe	107
PID 2748 wrote to memory of 2592	2748	msedge.exe	111
PID 2748 wrote to memory of 4192	2748	msedge.exe	112
PID 2748 wrote to memory of 4192	2748	msedge.exe	112
PID 2748 wrote to memory of 4124	2748	msedge.exe	113
PID 2748 wrote to memory of 4124	2748	msedge.exe	113
PID 3412 wrote to memory of 3280	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3412 wrote to memory of 5848	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5540 wrote to memory of 1536	5540	spnifaxsqk.exe	122
PID 3412 wrote to memory of 4184	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3412 wrote to memory of 4224	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 3488 wrote to memory of 5544	3488	nkfcaxspki.exe	131
PID 3412 wrote to memory of 5532	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 3412 wrote to memory of 2616	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4132 wrote to memory of 1396	4132	pmhfzuspkh.exe	140
PID 3412 wrote to memory of 5548	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2748 wrote to memory of 5860	2748	msedge.exe	146
PID 2748 wrote to memory of 5172	2748	msedge.exe	147
PID 2748 wrote to memory of 3456	2748	msedge.exe	148
PID 3412 wrote to memory of 2500	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5884 wrote to memory of 1188	5884	mjhbzxrpmg.exe	153
PID 3412 wrote to memory of 1932	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 3412 wrote to memory of 2848	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 3412 wrote to memory of 5724	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3412 wrote to memory of 4980	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4560 wrote to memory of 2604	4560	ywqojgeztq.exe	171
PID 3412 wrote to memory of 2472	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 3412 wrote to memory of 1100	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1380 wrote to memory of 1892	1380	bytqljdbvt.exe	180
PID 3412 wrote to memory of 6052	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 2748 wrote to memory of 6032	2748	msedge.exe	185
PID 2748 wrote to memory of 6032	2748	msedge.exe	185
PID 3412 wrote to memory of 5384	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 2672 wrote to memory of 5168	2672	idaysqlidy.exe	193
PID 3412 wrote to memory of 796	3412	2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 2748 wrote to memory of 5056	2748	msedge.exe	200

C:\Users\Admin\AppData\Local\Temp\2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6fe30208748a7ee63a30c0c443594226_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7fff85f3c188,0x7fff85f3c194,0x7fff85f3c1a0
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16355283426064109704,11770160961002742380,262144 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,17282814300794008903,16650456415064891934,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,6965614116638160119,9812265446800153117,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,11385804757934501646,11274092962817979429,2097152 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,6612499979705118613,2948451958126168707,2097152 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4391485029304276340,13392516445590398134,2097152 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,17930510093484965090,15296818737166480678,2097152 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,2680271037089668000,6279204350588224119,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1112967958462947097,5614174578403436135,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,5277768806134433617,6501137014681550071,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,14761204389712404940,10575498491929040458,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,14761204389712404940,10575498491929040458,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:2592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,4995547298936496718,2136944244656302132,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:4192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,15396039638831718251,12417039595394740202,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,4823923990422302485,15586450395956341160,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:14
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11090362559935764218,9916070174775105259,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,5821696892702804170,11734536102388058242,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,16918055436459894009,12293670820126032092,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,3007724782251827630,3489405600904538033,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,2492945457066646333,2381299447097561911,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7780276133266229189,13913358731034864066,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3452,i,2047245349923191182,2106930449196127463,262144 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,16390094391324973883,12048090983763518775,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,190791902397363637,9433468223184335030,524288 --field-trial-handle=2264,i,14382072985919501121,3572312022211474496,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:2508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnidavs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1072
- - C:\Temp\davtnidavs.exe
    C:\Temp\davtnidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnidavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\i_davtnidavs.exe
    C:\Temp\i_davtnidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnifaxsqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\spnifaxsqk.exe
    C:\Temp\spnifaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnifaxsqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\i_spnifaxsqk.exe
    C:\Temp\i_spnifaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcaxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\nkfcaxspki.exe
    C:\Temp\nkfcaxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcaxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5532
- - C:\Temp\i_nkfcaxspki.exe
    C:\Temp\i_nkfcaxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzuspkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2616
- - C:\Temp\pmhfzuspkh.exe
    C:\Temp\pmhfzuspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzuspkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5548
- - C:\Temp\i_pmhfzuspkh.exe
    C:\Temp\i_pmhfzuspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzxrpmg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2500
- - C:\Temp\mjhbzxrpmg.exe
    C:\Temp\mjhbzxrpmg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzxrpmg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Temp\i_mjhbzxrpmg.exe
    C:\Temp\i_mjhbzxrpmg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\rljhbztrlj.exe
    C:\Temp\rljhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5724
- - C:\Temp\i_rljhbztrlj.exe
    C:\Temp\i_rljhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgeztq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4980
- - C:\Temp\ywqojgeztq.exe
    C:\Temp\ywqojgeztq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgeztq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_ywqojgeztq.exe
    C:\Temp\i_ywqojgeztq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaysqlidy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\idaysqlidy.exe
    C:\Temp\idaysqlidy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaysqlidy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:796
- - C:\Temp\i_idaysqlidy.exe
    C:\Temp\i_idaysqlidy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtndxspni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2728
- - C:\Temp\xvtndxspni.exe
    C:\Temp\xvtndxspni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtndxspni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5468
- - C:\Temp\i_xvtndxspni.exe
    C:\Temp\i_xvtndxspni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\spkicavsnk.exe
    C:\Temp\spkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3732
- - C:\Temp\i_spkicavsnk.exe
    C:\Temp\i_spkicavsnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxupmkec.exe ups_run
  2⤵
  PID:1156
- - C:\Temp\hfzxupmkec.exe
    C:\Temp\hfzxupmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxupmkec.exe ups_ins
  2⤵
  PID:3428
- - C:\Temp\i_hfzxupmkec.exe
    C:\Temp\i_hfzxupmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkhb.exe ups_run
  2⤵
  PID:2964
- - C:\Temp\jhbzurmkhb.exe
    C:\Temp\jhbzurmkhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkhb.exe ups_ins
  2⤵
  PID:5952
- - C:\Temp\i_jhbzurmkhb.exe
    C:\Temp\i_jhbzurmkhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomkecwurm.exe ups_run
  2⤵
  PID:5872
- - C:\Temp\uomkecwurm.exe
    C:\Temp\uomkecwurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomkecwurm.exe ups_ins
  2⤵
  PID:3788
- - C:\Temp\i_uomkecwurm.exe
    C:\Temp\i_uomkecwurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojhbywuo.exe ups_run
  2⤵
  PID:5584
- - C:\Temp\trojhbywuo.exe
    C:\Temp\trojhbywuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojhbywuo.exe ups_ins
  2⤵
  PID:5388
- - C:\Temp\i_trojhbywuo.exe
    C:\Temp\i_trojhbywuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojdbwto.exe ups_run
  2⤵
  PID:4360
- - C:\Temp\ywqojdbwto.exe
    C:\Temp\ywqojdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojdbwto.exe ups_ins
  2⤵
  PID:4972
- - C:\Temp\i_ywqojdbwto.exe
    C:\Temp\i_ywqojdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlfdyvq.exe ups_run
  2⤵
  PID:1500
- - C:\Temp\yvqnlfdyvq.exe
    C:\Temp\yvqnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlfdyvq.exe ups_ins
  2⤵
  PID:1820
- - C:\Temp\i_yvqnlfdyvq.exe
    C:\Temp\i_yvqnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdxvtqoig.exe ups_run
  2⤵
  PID:1180
- - C:\Temp\igdxvtqoig.exe
    C:\Temp\igdxvtqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdxvtqoig.exe ups_ins
  2⤵
  PID:4568
- - C:\Temp\i_igdxvtqoig.exe
    C:\Temp\i_igdxvtqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnif.exe ups_run
  2⤵
  PID:3776
- - C:\Temp\nlfdxvqnif.exe
    C:\Temp\nlfdxvqnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnif.exe ups_ins
  2⤵
  PID:1852
- - C:\Temp\i_nlfdxvqnif.exe
    C:\Temp\i_nlfdxvqnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxupnhfz.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\kfdxupnhfz.exe
    C:\Temp\kfdxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxupnhfz.exe ups_ins
  2⤵
  PID:5096
- - C:\Temp\i_kfdxupnhfz.exe
    C:\Temp\i_kfdxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4132

C:\Temp\icaysqkica.sys
C:\Temp\icaysqkica.sys
1⤵
- Executes dropped EXE
PID:1892

C:\Temp\mkfcaxspkf.sys
C:\Temp\mkfcaxspkf.sys
1⤵
- Executes dropped EXE
PID:4920

C:\Temp\rpkhfzxrpk.sys
C:\Temp\rpkhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:5472

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:5804

C:\Temp\bztrmkecwu.sys
C:\Temp\bztrmkecwu.sys
1⤵
- Executes dropped EXE
PID:4892

C:\Temp\wtomgeywro.sys
C:\Temp\wtomgeywro.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\ytqoljdbvt.sys
C:\Temp\ytqoljdbvt.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Temp\tqoigbykid.sys
C:\Temp\tqoigbykid.sys
1⤵
- Executes dropped EXE
PID:4232

C:\Temp\fdxvqnlida.sys
C:\Temp\fdxvqnlida.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\xspkifaxsp.sys
C:\Temp\xspkifaxsp.sys
1⤵
- Executes dropped EXE
PID:632

C:\Temp\khfzxrpkhc.sys
C:\Temp\khfzxrpkhc.sys
1⤵
PID:6068

C:\Temp\rpmkhczxjh.sys
C:\Temp\rpmkhczxjh.sys
1⤵
PID:1912

C:\Temp\zwrpjhbzur.sys
C:\Temp\zwrpjhbzur.sys
1⤵
PID:1184

C:\Temp\rojgbywurl.sys
C:\Temp\rojgbywurl.sys
1⤵
PID:5652

C:\Temp\vtoljdbwto.sys
C:\Temp\vtoljdbwto.sys
1⤵
PID:4988

C:\Temp\lgdywqoigb.sys
C:\Temp\lgdywqoigb.sys
1⤵
PID:5012

C:\Temp\igdyvqnlig.sys
C:\Temp\igdyvqnlig.sys
1⤵
PID:3556

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
PID:4260

C:\Temp\pkicxusmkf.sys
C:\Temp\pkicxusmkf.sys
1⤵
PID:5752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmkecwu.sys

Path C:\Temp\bztrmkecwu.sys
Size 141KB
SHA256 2601b03340cd81fabc480d91b73da95da6f754f1734367026a6264130abb887e
MD5 f18573df695f460d488efd2b9111d644
SHA1 7247105b457ecb2cf3c48e214b7d7d3d338bb94d
SHA512 400eee59da4035a0a6cfc9ae434f775e87740a7d1576ee5291427e27d4ef1375bc983c9cf2a2646f3e79a327fe7508ed7bf36736237fe835c3ac8263cbb90f2b
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnidavs.exe

Path C:\Temp\davtnidavs.exe
Size 226KB
SHA256 e307da25c1fcdf4c748493d3fb36a2ba998a38255728a5878aa60bf2f3a7ae17
MD5 75f234633a93343c4c595c19b010bd21
SHA1 199715d56fd8be4fd73f34b4b4365ed8f22da8b2
SHA512 5fee32baa3b370ab0103e70fdccea1a5c3c55d53549105feae136749ad0f298a9b06d738643f516d5ec8d03f916d802f0d864b2e2706fc1326cf07978ca0d28f
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T14734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnidavs.exe

Path C:\Temp\i_davtnidavs.exe
Size 226KB
SHA256 8edf689ca3fd5f8817915272dc4053cd5fcf811e276592837b98008b5bb61d8f
MD5 de786545614a8c284e2db294a80af7c3
SHA1 9cf386e4444db93f771b9623d31c287d4e0525af
SHA512 12fc2c4e516785c5cd3df764f1196d81da991c431e57583b12218f6708a415f0ef80879923782e4bb792b3292b48594fa5fc18008b4e3c7f903922ee6a6ec17b
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T16334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhbzxrpmg.exe

Path C:\Temp\i_mjhbzxrpmg.exe
Size 226KB
SHA256 e96c7fcd3994c81d5cd46d4e939c07d61b6d1ee683a1127e8ae719ccd140f271
MD5 bbf11a672849a3e37b01675c2db479f3
SHA1 2b1dac1c061fc52a5c96f873086d0fc99035dda6
SHA512 e36432e9ad64763f40ab52bc567834ac4778fd9c25511a6a0dc3d597cff181d013453a288e5fb412b0d7e70b21f246620b8f4e976a825d2aaed5071a7f8dce74
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T19E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcaxspki.exe

Path C:\Temp\i_nkfcaxspki.exe
Size 226KB
SHA256 7c5e022cab7591824d8bf894441d7ce1fb51a3237d7170887ac4ea238deb51b9
MD5 be42747479e7f6a21fe74c4ff0672599
SHA1 ba84d57e9011737fe88939279f47142ce69d4de3
SHA512 ded530e4f4492ea08aa3a061859fce5db96865dc45e84a48a304a13c8f1976ab6674824234376bbcd9a8710b4e1b0612a31d0d63f3d5ff2211827b5469b0bc03
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T10734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzuspkh.exe

Path C:\Temp\i_pmhfzuspkh.exe
Size 226KB
SHA256 b251d36415c41da48c6c00101e3b916b9dc7b34f3775ec4d4eaada321452d2f8
MD5 8452ff5cecbe85fbf12510bdb18c8c10
SHA1 d2577ca3442e9e33fed8058893f0a362a7fabf72
SHA512 754e0e21a9df7fd34483a8355644249bb0e72d43deb77148306ff12560d5aac403f2fc7fd16ffb8248f8b2847b7819eb321a8d442e1b1d1490d961d296e42532
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1A834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljhbztrlj.exe

Path C:\Temp\i_rljhbztrlj.exe
Size 226KB
SHA256 862a5cf251babb5decb593c646e2e5252bcca57988fdebce3057e9173259a2f5
MD5 c2bcc0221c15c046f814822e3751a656
SHA1 c1f15fbfbec33eeff5d49254e18347dc2f150147
SHA512 0c37bf2dd3212a8dc46c56354a6941b37d61e7e47079ed22487213bd844e647523c2f7aeb14069e65922d78fe26bc9778999ffe9eb550503b2de75eea76e2b25
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1BC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnifaxsqk.exe

Path C:\Temp\i_spnifaxsqk.exe
Size 226KB
SHA256 926f87bded6b1a26839cd2b52f856e9100aa0d3a8ba68b0990aa5b8a6876001f
MD5 2732cf8b3a260de72f2eaf1ecd458ca7
SHA1 558def7554af3cfe4ac3e76bb8d63a3925a925d6
SHA512 bcda1b2c20b03f7b5649e9f5b3cefdc40f488346066ae93059bc0c57bf400db5f50fdb311477d65defa5a2f0fc06ccb8c28e2fd94f241702fa0bfa211b1f40f8
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaysqkica.sys

Path C:\Temp\icaysqkica.sys
Size 141KB
SHA256 40543692d4a5db501a674d4e086b5d1990000d97dd7f42e28f5bf9903ff8dcb9
MD5 00d367424a20c94085321d20c0e7d17d
SHA1 615ff490cfa23bc2425e58395c49541f2c94b5b5
SHA512 ba2f86d52646672d44b6a200b2e3eb7a4ffae8d38393d383a750836c88b7d2537cc8a797be0a0586e913e820616b746086c231f3f40e6c4eba3f8cb4cdd65a06
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbzxrpmg.exe

Path C:\Temp\mjhbzxrpmg.exe
Size 226KB
SHA256 25d9a75db13d32c07b586d0d95ebd89c8b861b437d0bff81bdec1b64ace03cdf
MD5 ec2936d81ab6838472ee28cea95d6a91
SHA1 4a608311471ebd6bcb87be3cd45efeea573fe2a0
SHA512 6d3048b6f3b39d7c55f23f9c72ee76be4f03b0fded51dcc483b9aff0d7a205295ee66eb2eccad1da7a24f4b163e7c87d4bf55cfd61567ebd960ad5246ddc32a4
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcaxspkf.sys

Path C:\Temp\mkfcaxspkf.sys
Size 141KB
SHA256 ffa0a50a0213ddb2b2d55d1acd8ce47b2d1d507b646dd899fb9d035547e451b5
MD5 3c54aec55fd3ed2ac2315524128df1a5
SHA1 54d9a2b0528f70eb033d75263dddf110fb9a98c5
SHA512 9b0012ad23011eb11484ef282947260e5dec7fc18e9ae3f59abcf580f6baeb6a39f63c271b837e137a2dc8966738519cd85c698d34096ff39b52e60c71163afc
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcaxspki.exe

Path C:\Temp\nkfcaxspki.exe
Size 226KB
SHA256 2fba3651883c479e180e3b3fd27a5f4d0601ded413505a4adac290bf1cc1a446
MD5 a700ea094d386c23500886f55ff6865b
SHA1 efc041e772b20286ceabd51fb0872e424afd7189
SHA512 ef0d74c4b1ab472273c3bc951d6ca4c4ded02d9381d0da692db1ad9c694e59bbeb4385a9bdcf978da7846aa225a37e35c9c995ba4024534f08f3c1496013eaca
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzuspkh.exe

Path C:\Temp\pmhfzuspkh.exe
Size 226KB
SHA256 01a0b5f46dc470d29ed8624f3f2a125dcf80119e1a9faa79f2e7b0b842560dc0
MD5 d44e750b41285bc85648bb1c9e69286e
SHA1 a03a14857700009f44759880ff18028434ba5a9e
SHA512 f0cbf999928da6f50892adfe40d5a2e727af6f37600476e9619be3b11fc52ef218c0b86714a5fbeca82fed4e3d610f621f00f79c583d30f22c49a5469f2ddc15
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1D834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljhbztrlj.exe

Path C:\Temp\rljhbztrlj.exe
Size 226KB
SHA256 fe48764a799812b9f29ec2eab5e72de3df488d2ad9f5f25c454ffd9503ff2900
MD5 b7a062caf9b242589cd21003ae3e130c
SHA1 1666baddf2e497ad9d8fb8eccec2d6446de6fb2e
SHA512 b91924ec401af04095c3f027cb540af641e86b4388801dedd4786ca93fe123a273e77cbc573c080251c0a60877ad1823663a10c3569ea60657f51be3ce57c0db
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhfzxrpk.sys

Path C:\Temp\rpkhfzxrpk.sys
Size 141KB
SHA256 71e32239c6038fb9fdb3994592d5a4bace552ab1f80991e8a81b339a74c805ec
MD5 0576a0f32d8e3c0df4f3a723fbb469a4
SHA1 0b436fa77765b46b2e71491d84a31b62ab3c2c63
SHA512 5cd5ae584c047d2e012f725f90226bc096938be2b8fc82bd14e8774cd520b383209a3ff550420f39ea159c3844b9f74b4ee24a761be8e8eaf84cf532573fefcf
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnifaxsqk.exe

Path C:\Temp\spnifaxsqk.exe
Size 226KB
SHA256 b291ecc29a5685781789af5941307df2b3226e0822d52f63d8cfb682a90899aa
MD5 29895615e2d32377af84592e4f0fdf8d
SHA1 14bede2fa612230355195dd9ab6894d14c560624
SHA512 4b2982b1c6896cecd98f9ff36aa43f3784272dc166d0f346149e2695809b2e992bbbca29659397b9619eb3cb3ba1e2098b6514c7454d114c6e7acd58966cae06
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T12B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.sys

Path C:\Temp\urmjecwuom.sys
Size 141KB
SHA256 bd4d47f73490325e1deb0a7d3cbf6058607e91f2fced7fa1907100c9c446a42a
MD5 0d7cc3c82a75f221890192a7614b4d33
SHA1 bc4c8879fb5b70a7950cd06f42a9c4dd78825893
SHA512 666a87a90a9d241b10ca0a6ac300647681011fb71506b57616499312276539e31d3ab355989dd256310d0ba6a05cebb410af75214f58398dd22a6d8834f9a5b1
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywro.sys

Path C:\Temp\wtomgeywro.sys
Size 141KB
SHA256 36d6f8ad6c538fe741af651f1c9e1ebd456f51816932706e97a1608d127b723b
MD5 20b002c5e4e50cdbfc70b61e80c315bc
SHA1 efd8f9ded588059c024dab446880441231d7b2a9
SHA512 2ad7233b186d00b7dca027433a6f77eb28188d00ebd6eb61166f739c4963f07bc55a86979c8a500cf829be05bf0aff7ee99daf52a4038ce72e226124d4448037
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a8e9489ce0b8678dbe608245fa492d2ae48e79f6fe40ab553e8a54eb25bf6fba
MD5 31b7f3e6dc9182c86ee6c2746e0d9194
SHA1 015cf1328bf8b10ec8873240ba5f975a1e558007
SHA512 f62dff79495d8ae514725a28f2d7e9f470045686b1aa504cb99399e71d1cfab76d14d3dce055a82f96d07c1941a1b38fc51e555cf39d7e89dbe5b0ffd4db5296
TLSH
T1A451C658837B09CED36100B6ADD9D6693BBBBACC9007BEB95454313CA94332080E0EE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fb10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fb10.TMP
Size 2KB
SHA256 f8487f6414124edd418fc71f07ed120d03c12c30c52efbf68a730ae205f7ce06
MD5 9387c0d8edad927d9ab43e390496e7c9
SHA1 aa6afe72e95ba5c43316a4bc8a6bffa2f3b04a71
SHA512 34cab319cae5756faab66055da7c2fe43c45213d3c58af14ef091b4eef59e3cdfce5c7f355d6f6658f90af193753880447d4fd344795e3fd33a32716b10d1014
TLSH
T17951C758437B08CED36100B6ADD9D6593BBBBACC9007AEB95414353C694332080E0DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5ba04df111df1fec05bb592df526fc705e51c6c2ea7faad84e23e5e29fc517f9
MD5 2ef70eb2357752ab047f1fe57494cae9
SHA1 ad2f258155fd70f75961eef58cd17ecadae933b4
SHA512 d1dc735290055643d653a029bd866bec6274c5076669236afc14b93275f7e8eb10e277fd72f273943ef618d1de3c2800c7afd10745f20fbf420668376fc1cd92
TLSH
T1CE419DF783F4856E8A0196F0AA146E1FCE2D0511432C7D5AC9E4AE2B93E3472E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c3f9b49382f704ded1e640918df439d7d430b6ee96b84726ec63c5ab0b01faf4
MD5 61795c6e590e80376951bf98969c5fb2
SHA1 304e5b8eb00144b74552057985b03013fed27f05
SHA512 3e3cd0fd7edb375eceb26c87425136f952110b5fe9742e058d3dfd000c6e53e828386eab8a6c230650f3a76f75e2b66c70e7ca95114d6cc7d294c295c13ddfbc
SSDEEP 192:sxRQRDCN/fdsSD/ZH35zoA8p9j/g6+WNC1S/YnLUIhXGkIgVGJ:sxRQcN/fdsSDh0B/5r/iz5c
TLSH
T17B42B71A6A68693B8CC7D20DFB55BF53E6F92032A1D55E48A6FCCA1C04E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f28251d1a23433423a04d1429de77af47e91409e775657efec082eb370537ab
MD5 9d89faf62326fa0f26cb948b5424522c
SHA1 4cc398b1fdf8fb9655b6d8abc081327615644836
SHA512 7e8641a6b6f3d7278f9e875d265bbab4db220e09dcdf39cec46ff1cb4747bd92097feea5405642ea27057df2627f43a37df979459513f203dd404a59f67088cc
SSDEEP 192:sxRLRDCN/fds74D/ZH35zoA8p9j/g6+WNC1S/YnLUIhXGkIgDxwGJ:sxRLcN/fds74Dh0B/5r/iz5J
TLSH
T1EE42C81AAA68693B8CC7D20DFB55BF53D6F92032A1D55E48A6FC8A1C04E77CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 78072f5f5726cbbf89cfa9eefb672388097f3c0aa18f668c2f91fc903e652bcc
MD5 97b068acf5b0a7b5ea07e69178e8dd28
SHA1 7d8d4139ef34d7b7ed01cc2e2247a3c6eb03ffca
SHA512 86521910becc6c01bafa0c6c9b74d7c83c16e8ae9ff72d1681953082a1f9d70375e56a1feef5690d920bc8088bc87a93a4074674c8ed6bab928836c343ae8c0b
SSDEEP 192:sxRLRDCN/fds744/ZH35zoA8p9j/g6+WNC1S/YnLfShXGkIgDxCGJ:sxRLcN/fds744h0B/5r/io5D
TLSH
T1F042B719AA686D3B8CC7D20DFB55BF53E2F92022A1D55E48A6FCCA1C04E76CD121780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c523a3a4f98511b64ff447c4cda6c55188a897199315f1c04f3fee8e9d94d8b6
MD5 8a90bcec5a25a09cf4f82709446425bf
SHA1 3b1e8efe7092105f5cf369b10ae300aff2b986d1
SHA512 0b3a8630703caad4cdfcb91089e59fd13f89f3e7bf3176d1a79e4be3dc547130cb00bc58c70788d83e663ff74dee82d084d398292f31966adfdc4c66643f6e15
SSDEEP 768:wb8dSg7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtqmu46xrohNT5J:wb8dSsE7r6Wgouf6Mu1ja+qmV6KzD
TLSH
T11BD2DA7B740DCA7E4F800ADDEC19BE9F6D6802CB9AD8CD4047FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2fbe4abf-1588-471c-b26e-15ca71468fc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2fbe4abf-1588-471c-b26e-15ca71468fc2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 02eceb8db07cf613030157e424bbc6382e57341b5b64bedfa5176924d0c911f8
MD5 a2643c6d3167852426981b001e2a061d
SHA1 acf4d98588a6ff123b426734cebb26dad3a27d90
SHA512 edab5b61b85b2f395843836c14057732472e82227e9d756a8cb5a050aced5d43b7f52f21451225a2190cb707bfd567a229384446e8014ecf0c66432e13f00e34
SSDEEP 384:nzZcI838NL5zh11WJDZNfNoXOVSUUNm/1iZWETRzcoXfK86sfxEZxxsIj4lB2lah:r83WGDZIO0NSIZxNzc4ReyIsP2MgYYs
TLSH
T14CF2BE31AC64DCB3ACFAA386FA0773827DF4616780C86D94D6D89F0D084769E175B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 123056ebd49eb5f653a91659df1d4e3105113cec95de5176aac2e6c99bedf64d
MD5 b79c43f3cb5393feb212059e6b3f4320
SHA1 adc823d44120f45ec31118c14eb604c1d11b6388
SHA512 0105a2d2f29bddd920548dcd1e085b1a6827e1e88dadc4ebf9522f2978d8193be304c717341ffaf76c179bb500c6a12cec1c97c0ec18befb3070209c9eeaab0f
SSDEEP 768:AFQS3Wwg5HZ15O0NSIZtNzc4ReyIsP2MgYYs:zS3Qtc44bs+MgLs
TLSH
T19B1318F198D78976E8AE5783A73D6E42ADFCD153B0889894B7C45E4CCC421BFC34A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0065793fdec590f46bea2b9669476cb463d3995304cc83a119f07cd17ae47806
MD5 27749e0022807040dbdda9b91ae91084
SHA1 8578c6c1a20a325bd72bad63a387a77cae56e211
SHA512 8228f6ca6998fa38572085728ef38d88b2bef35e568981b93f51547ffb44da3f6f9b98b23cf5530096c2049945314291d0e3c4981ec3df95e0db109059669289
SSDEEP 768:6rv+4UNbds3JLDZIO0NQNzc4ReyIsXyeVH1S5D:6bsbS3Ltc44bsiEH1Y
TLSH
T14F03CF32EC288977ACF66786B54776133EF8911782981E90C5DD6F4C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 28ef0136424b88a4e02c736914682a749fc806b68834005465ef15ec3aabb0a0
MD5 a0f6f7c3e0b6628604eebded992551f3
SHA1 257148a08aea3059b1ef3e6aec42d7378ae48c0d
SHA512 11c40b9fe582d3a238faac8e3c99079d4617495eeddab5a1be96ce37e827c8cbf00dfc74624d369839ef5586f1aecbdf177d725132ea2e10eb33f4911ce85fb5
SSDEEP 384:nHZcI838NLizS11WJDZNfNoXOVSUUNm/1iZ/ETRzcoXfK86sfxEZxxsIj4lB2lah:v83IGDZIO0NSIZcNzc4ReyIsP2MgYYs
TLSH
T1B3F2BE31AC64DCB3ACFAA386F60773827DF4616780C86D94D6D89F0D084769E175B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e1786d32e9eb83e303fb815ac9f87947c8c0f9e21ec7f3c430662e957f6ccb77
MD5 e91765f39c7752efbe59d66d575eb959
SHA1 8e07f9980c6192ba57a81d09417b9abcb26e1f6f
SHA512 c6264b766d783581378298070cee009f9450060220fd8fe35efb75480a77917c0ce66c1d2a6ef55d53b6e9052143018b849af51a43443b016971482d0273efb3
SSDEEP 768:7rv+4UNbds39QDZIO0NSIZmNzc4ReyIs22eVH1S5D:7bsbS3stc44bsREH1Y
TLSH
T18A03CF32A828DD33ACEAA786F44776933EF8216B81840ED0D4D99F4C0A471DE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

89f3bc98-5139-431c-b0bb-694526f1a5b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89f3bc98-5139-431c-b0bb-694526f1a5b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2748_2135197333\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1184-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1892-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3556-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3556-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4260-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4920-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4988-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5056-307-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5056-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5472-256-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5652-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5752-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5804-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6068-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download