dbcce073514b99c7073b72e83be2d7f7f13bd5690318c412445c6f6b95ff7149

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260910-vjammasfqh
SHA256 dbcce073514b99c7073b72e83be2d7f7f13bd5690318c412445c6f6b95ff7149
MD5 4faa294ac9031d1d453a99a96a2ac080
SHA1 934d4533e9373bafba289d0ed78abfbf3ac1b8fa
SHA512 9bc558af2fdf2658429634038e81401f14da9b68563466e6c9057d9830ede1f384a6cf0b3d4a1bfbd4a653aae4a3b75a8f64ef033b380d7f6376d9b48587a9aa
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1F934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6480	CP.exe
6864	gezwqljdbw.exe
1612	CP.exe
5972	CP.exe
2812	i_gezwqljdbw.exe
4108	bywqojgbyt.sys
6940	CP.exe
6296	ywidbvtqlj.exe
1152	CP.exe
916	CP.exe
5232	i_ywidbvtqlj.exe
672	tnlgdyvqol.sys
5064	CP.exe
1964	igaywqlidb.exe
1120	CP.exe
2472	CP.exe
1316	i_igaywqlidb.exe
1492	fdxvpnifay.sys
6200	CP.exe
5476	gaysqkidav.exe
6208	CP.exe
4668	CP.exe
2388	i_gaysqkidav.exe
4320	qkicaqnifa.sys
3964	CP.exe
5740	xvpnhfzxsp.exe
2232	CP.exe
5812	CP.exe
6760	i_xvpnhfzxsp.exe
7140	xvpnhfzxsp.sys
6524	CP.exe
6184	xvpfzxspkh.exe
1500	CP.exe
1260	CP.exe
7116	i_xvpfzxspkh.exe
3960	pnhfzxrpkh.sys
4100	CP.exe
7136	mheczxrpjh.exe
5556	CP.exe
5464	CP.exe
4108	i_mheczxrpjh.exe
7024	omjezwuomh.sys
2976	CP.exe
4916	rpjhbzxrpj.exe
4832	CP.exe
1684	CP.exe
6884	i_rpjhbzxrpj.exe
596	ezwromhecw.sys
5300	CP.exe
6708	rljhbztomg.exe
6332	CP.exe
2896	CP.exe
1148	i_rljhbztomg.exe
2540	trljdbztrl.sys
3008	CP.exe
5860	rljdbwtomy.exe
6528	CP.exe
5380	CP.exe
3080	i_rljdbwtomy.exe
5940	oigeywqljd.sys
3668	CP.exe
5700	geyvtqljdb.exe
5992	CP.exe
1696	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
5516	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_887439862\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_988983015\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_988983015\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_988983015\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_307563409\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_887439862\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_988983015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_307563409\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_307563409\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_307563409\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_515850167\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5516_515850167\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywromgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywidbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheczxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtomy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtomy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geyvtqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkecxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywidbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljhbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geyvtqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxusnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxusnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljhbztomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkecxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmkeczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywromgbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1876	ipconfig.exe
6148	ipconfig.exe
6740	ipconfig.exe
5652	ipconfig.exe
4920	ipconfig.exe
2740	ipconfig.exe
3856	ipconfig.exe
6828	ipconfig.exe
2560	ipconfig.exe
1976	ipconfig.exe
6492	ipconfig.exe
2764	ipconfig.exe
3424	ipconfig.exe
4164	ipconfig.exe
5004	ipconfig.exe
1944	ipconfig.exe
1564	ipconfig.exe
6192	ipconfig.exe
4640	ipconfig.exe
4300	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335332482939358"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{ABBD3ED7-31E8-405C-8ADC-BE9F266305F2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	i_gezwqljdbw.exe
Token: SeDebugPrivilege	5232	i_ywidbvtqlj.exe
Token: SeDebugPrivilege	1316	i_igaywqlidb.exe
Token: SeDebugPrivilege	2388	i_gaysqkidav.exe
Token: SeDebugPrivilege	6760	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	7116	i_xvpfzxspkh.exe
Token: SeDebugPrivilege	4108	i_mheczxrpjh.exe
Token: SeDebugPrivilege	6884	i_rpjhbzxrpj.exe
Token: SeDebugPrivilege	1148	i_rljhbztomg.exe
Token: SeDebugPrivilege	3080	i_rljdbwtomy.exe
Token: SeDebugPrivilege	6820	i_geyvtqljdb.exe
Token: SeDebugPrivilege	3332	i_lfayvqoiga.exe
Token: SeDebugPrivilege	5264	i_kfdxvpnifa.exe
Token: SeDebugPrivilege	1200	i_kfcxusnhfz.exe
Token: SeDebugPrivilege	1752	i_pkecxupmkf.exe
Token: SeDebugPrivilege	5388	i_wupmkeczxr.exe
Token: SeDebugPrivilege	6416	i_wtrljhbztr.exe
Token: SeDebugPrivilege	4372	i_geywromgbz.exe
Token: SeDebugPrivilege	5212	i_igeywqoljd.exe
Token: SeDebugPrivilege	828	i_qoigaysqli.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 5660	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5660 wrote to memory of 5516	5660	iexplore.exe	91
PID 5516 wrote to memory of 4132	5516	msedge.exe	92
PID 5516 wrote to memory of 4656	5516	msedge.exe	93
PID 5516 wrote to memory of 1264	5516	msedge.exe	94
PID 5516 wrote to memory of 4656	5516	msedge.exe	93
PID 5516 wrote to memory of 4656	5516	msedge.exe	93
PID 5516 wrote to memory of 6704	5516	msedge.exe	96
PID 5516 wrote to memory of 6704	5516	msedge.exe	96
PID 5516 wrote to memory of 6704	5516	msedge.exe	96
PID 5516 wrote to memory of 2860	5516	msedge.exe	97
PID 5516 wrote to memory of 2860	5516	msedge.exe	97
PID 5516 wrote to memory of 4076	5516	msedge.exe	98
PID 5516 wrote to memory of 4076	5516	msedge.exe	98
PID 5516 wrote to memory of 4076	5516	msedge.exe	98
PID 4820 wrote to memory of 6480	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 5516 wrote to memory of 2744	5516	msedge.exe	102
PID 5516 wrote to memory of 2744	5516	msedge.exe	102
PID 5516 wrote to memory of 5284	5516	msedge.exe	103
PID 5516 wrote to memory of 5284	5516	msedge.exe	103
PID 6864 wrote to memory of 1612	6864	gezwqljdbw.exe	104
PID 5516 wrote to memory of 5636	5516	msedge.exe	108
PID 4820 wrote to memory of 5972	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4820 wrote to memory of 6940	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 6296 wrote to memory of 1152	6296	ywidbvtqlj.exe	117
PID 4820 wrote to memory of 916	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4820 wrote to memory of 5064	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 1964 wrote to memory of 1120	1964	igaywqlidb.exe	126
PID 4820 wrote to memory of 2472	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4820 wrote to memory of 6200	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 5476 wrote to memory of 6208	5476	gaysqkidav.exe	135
PID 4820 wrote to memory of 4668	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 5516 wrote to memory of 1480	5516	msedge.exe	141
PID 5516 wrote to memory of 1688	5516	msedge.exe	142
PID 5516 wrote to memory of 5896	5516	msedge.exe	143
PID 4820 wrote to memory of 3964	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5740 wrote to memory of 2232	5740	xvpnhfzxsp.exe	148
PID 4820 wrote to memory of 5812	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4820 wrote to memory of 6524	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 6184 wrote to memory of 1500	6184	xvpfzxspkh.exe	157
PID 4820 wrote to memory of 1260	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4820 wrote to memory of 4100	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 7136 wrote to memory of 5556	7136	mheczxrpjh.exe	166
PID 4820 wrote to memory of 5464	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4820 wrote to memory of 2976	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 4916 wrote to memory of 4832	4916	rpjhbzxrpj.exe	175
PID 4820 wrote to memory of 1684	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 5516 wrote to memory of 5624	5516	msedge.exe	180
PID 5516 wrote to memory of 5624	5516	msedge.exe	180
PID 4820 wrote to memory of 5300	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 6708 wrote to memory of 6332	6708	rljhbztomg.exe	187
PID 4820 wrote to memory of 2896	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 4820 wrote to memory of 3008	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 5860 wrote to memory of 6528	5860	rljdbwtomy.exe	196
PID 4820 wrote to memory of 5380	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 5516 wrote to memory of 5712	5516	msedge.exe	201
PID 5516 wrote to memory of 5712	5516	msedge.exe	201
PID 4820 wrote to memory of 3668	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 5700 wrote to memory of 5992	5700	geyvtqljdb.exe	206
PID 4820 wrote to memory of 1696	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	209
PID 4820 wrote to memory of 7140	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 2900 wrote to memory of 1672	2900	lfayvqoiga.exe	215
PID 4820 wrote to memory of 4296	4820	2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 5516 wrote to memory of 6176	5516	msedge.exe	220

C:\Users\Admin\AppData\Local\Temp\2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_4faa294ac9031d1d453a99a96a2ac080_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x320,0x7ffbb43cc188,0x7ffbb43cc194,0x7ffbb43cc1a0
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7040565556997468811,7145038313922282802,262144 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,5311546941641026914,8702345386055122414,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      System Time Discovery
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,10010461535147667038,9207000724589872926,2097152 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:6704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,16383826703069080785,5429302866302516291,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,1018725073225407513,17342667851900839269,2097152 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,1031723660991258708,6387347046135690225,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,509381859759786746,4414352169679782967,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6825491608390129498,12776651377569018645,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,6825491608390129498,12776651377569018645,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,954781575142130064,3119187749780638054,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17271573654436127809,13549143166557732050,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4423253261288599333,5088367118037925193,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,4950476832528862382,12705111074218480125,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,7179036326253501788,17521871830778327578,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=860,i,15093137912604662996,17426162673731151041,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:6176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,12235151264867643042,1027852586743603242,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6696,i,3278038435516294660,18417766669595648657,262144 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,16074200999308111910,9796547550293859428,524288 --field-trial-handle=2068,i,395970267613121803,649382915317894556,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:14
      4⤵
      PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwqljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6480
- - C:\Temp\gezwqljdbw.exe
    C:\Temp\gezwqljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwqljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5972
- - C:\Temp\i_gezwqljdbw.exe
    C:\Temp\i_gezwqljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywidbvtqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6940
- - C:\Temp\ywidbvtqlj.exe
    C:\Temp\ywidbvtqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywidbvtqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:916
- - C:\Temp\i_ywidbvtqlj.exe
    C:\Temp\i_ywidbvtqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\igaywqlidb.exe
    C:\Temp\igaywqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_igaywqlidb.exe
    C:\Temp\i_igaywqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6200
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\i_gaysqkidav.exe
    C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3964
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpfzxspkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6524
- - C:\Temp\xvpfzxspkh.exe
    C:\Temp\xvpfzxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpfzxspkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\i_xvpfzxspkh.exe
    C:\Temp\i_xvpfzxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mheczxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\mheczxrpjh.exe
    C:\Temp\mheczxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mheczxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5464
- - C:\Temp\i_mheczxrpjh.exe
    C:\Temp\i_mheczxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2976
- - C:\Temp\rpjhbzxrpj.exe
    C:\Temp\rpjhbzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1684
- - C:\Temp\i_rpjhbzxrpj.exe
    C:\Temp\i_rpjhbzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljhbztomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5300
- - C:\Temp\rljhbztomg.exe
    C:\Temp\rljhbztomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljhbztomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\i_rljhbztomg.exe
    C:\Temp\i_rljhbztomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtomy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\rljdbwtomy.exe
    C:\Temp\rljdbwtomy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtomy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5380
- - C:\Temp\i_rljdbwtomy.exe
    C:\Temp\i_rljdbwtomy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geyvtqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3668
- - C:\Temp\geyvtqljdb.exe
    C:\Temp\geyvtqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geyvtqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_geyvtqljdb.exe
    C:\Temp\i_geyvtqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfayvqoiga.exe ups_run
  2⤵
  PID:7140
- - C:\Temp\lfayvqoiga.exe
    C:\Temp\lfayvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfayvqoiga.exe ups_ins
  2⤵
  PID:4296
- - C:\Temp\i_lfayvqoiga.exe
    C:\Temp\i_lfayvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnifa.exe ups_run
  2⤵
  PID:2820
- - C:\Temp\kfdxvpnifa.exe
    C:\Temp\kfdxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnifa.exe ups_ins
  2⤵
  PID:6588
- - C:\Temp\i_kfdxvpnifa.exe
    C:\Temp\i_kfdxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxusnhfz.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\kfcxusnhfz.exe
    C:\Temp\kfcxusnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxusnhfz.exe ups_ins
  2⤵
  PID:2532
- - C:\Temp\i_kfcxusnhfz.exe
    C:\Temp\i_kfcxusnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkecxupmkf.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\pkecxupmkf.exe
    C:\Temp\pkecxupmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkecxupmkf.exe ups_ins
  2⤵
  PID:4432
- - C:\Temp\i_pkecxupmkf.exe
    C:\Temp\i_pkecxupmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmkeczxr.exe ups_run
  2⤵
  PID:5328
- - C:\Temp\wupmkeczxr.exe
    C:\Temp\wupmkeczxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmkeczxr.exe ups_ins
  2⤵
  PID:2980
- - C:\Temp\i_wupmkeczxr.exe
    C:\Temp\i_wupmkeczxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljhbztr.exe ups_run
  2⤵
  PID:6072
- - C:\Temp\wtrljhbztr.exe
    C:\Temp\wtrljhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljhbztr.exe ups_ins
  2⤵
  PID:2428
- - C:\Temp\i_wtrljhbztr.exe
    C:\Temp\i_wtrljhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywromgbz.exe ups_run
  2⤵
  PID:2572
- - C:\Temp\geywromgbz.exe
    C:\Temp\geywromgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywromgbz.exe ups_ins
  2⤵
  PID:4640
- - C:\Temp\i_geywromgbz.exe
    C:\Temp\i_geywromgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igeywqoljd.exe ups_run
  2⤵
  PID:5288
- - C:\Temp\igeywqoljd.exe
    C:\Temp\igeywqoljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igeywqoljd.exe ups_ins
  2⤵
  PID:5756
- - C:\Temp\i_igeywqoljd.exe
    C:\Temp\i_igeywqoljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:2868
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:3224
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6576

C:\Temp\bywqojgbyt.sys
C:\Temp\bywqojgbyt.sys
1⤵
- Executes dropped EXE
PID:4108

C:\Temp\tnlgdyvqol.sys
C:\Temp\tnlgdyvqol.sys
1⤵
- Executes dropped EXE
PID:672

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
- Executes dropped EXE
PID:1492

C:\Temp\qkicaqnifa.sys
C:\Temp\qkicaqnifa.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:7140

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:3960

C:\Temp\omjezwuomh.sys
C:\Temp\omjezwuomh.sys
1⤵
- Executes dropped EXE
PID:7024

C:\Temp\ezwromhecw.sys
C:\Temp\ezwromhecw.sys
1⤵
- Executes dropped EXE
PID:596

C:\Temp\trljdbztrl.sys
C:\Temp\trljdbztrl.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\oigeywqljd.sys
C:\Temp\oigeywqljd.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\fdavsqnifd.sys
C:\Temp\fdavsqnifd.sys
1⤵
PID:1768

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
PID:6784

C:\Temp\nifaxvpnhf.sys
C:\Temp\nifaxvpnhf.sys
1⤵
PID:5512

C:\Temp\mkhcxupnke.sys
C:\Temp\mkhcxupnke.sys
1⤵
PID:4124

C:\Temp\zxrpjhczxr.sys
C:\Temp\zxrpjhczxr.sys
1⤵
PID:3388

C:\Temp\mkezwromke.sys
C:\Temp\mkezwromke.sys
1⤵
PID:5604

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
PID:6260

C:\Temp\lgebwtrljd.sys
C:\Temp\lgebwtrljd.sys
1⤵
PID:5980

C:\Temp\nlgdbvtqli.sys
C:\Temp\nlgdbvtqli.sys
1⤵
PID:2716

C:\Temp\ayvqoigayt.sys
C:\Temp\ayvqoigayt.sys
1⤵
PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojgbyt.sys

Path C:\Temp\bywqojgbyt.sys
Size 141KB
SHA256 cf965446471cc2f55f3a61bd1547b457a38aaf42ce7eaa5903bff3533fbe065b
MD5 c4ef8ca0c29951b7903ee868414704df
SHA1 172209c84791a6ab6ba1a93bbb9b3d87be1602b0
SHA512 1b7ed6afff2ff71ec432a3ac73a7dbbd9aef7f40e1cdf100805ee05be5b1c49ecfe1e1b86a17c7ea5bf1c554a3529c4298d3390a35a714e30471ecd315eda486
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.sys

Path C:\Temp\fdxvpnifay.sys
Size 141KB
SHA256 687bb33bfa5d82de396b936a0752230c125a54fc4ce3cfc1554429b3d582af03
MD5 ecbdc0a333db2bd5109320610d227ccf
SHA1 78fa1c6973bf72e06f7e1b41719eb4e76c98ff78
SHA512 9ba02e27dd2f6bd1855cb6555177cd40cf347e0cd9d1616a45cda81976de032a9086e335eb7ec32d8447bbe2f1411445aad8c7695bd2fc64deacdfa296fd8934
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.exe

Path C:\Temp\gaysqkidav.exe
Size 226KB
SHA256 a50b066dceb4eef3fd2632d121eed3bb3ac5696843eac28df08e85327e074499
MD5 aeb552d80ba8098072658ea9d96e7632
SHA1 7cdd33906a3ad4f0b7ddcc39132b745d37cd45b3
SHA512 17e977f592b15a13564654b999dd649ee8145bd9bd063fdacee5ca8e4a9c9ff0c581a467da081982359138cb09c5da2db1aa69d2fdd135ae366383983d1a30e1
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T13C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwqljdbw.exe

Path C:\Temp\gezwqljdbw.exe
Size 226KB
SHA256 8605593cae99daad6dd84d54e5c12b7286179dd0dcd02c0ad7c250cd5e4893a9
MD5 35e535a07617474791be7664eb22d750
SHA1 4035c882a1a9ab316a139539e424ebfb8dd7fc65
SHA512 af0866a4a018b1ee77acbc3aab14811690dee8d1cf89c6f35bd19142448099c46487329bc3e1ed40695bc5ba54517125a1f506957a84d45e98fd2ea596de2882
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T17934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaysqkidav.exe

Path C:\Temp\i_gaysqkidav.exe
Size 226KB
SHA256 1e6bb432ccbbb8e5dfe5d1262b2d1e2ad340ed7f9c00bf52147bceb962f1394a
MD5 69ea8e594b1582971882324868ac1ab9
SHA1 cf01cda3eb4e873f9e165116165aafcf6bdb386c
SHA512 03e704afcebd7a9cc2d3b7a68a90730820c6c0af220dc2fabc36ed20b644180af7f912f03b3ffda6a0baed748b602b2cd0bcf32766d04810b7d3355d87fb3fbf
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwqljdbw.exe

Path C:\Temp\i_gezwqljdbw.exe
Size 226KB
SHA256 6df54bbfb17e6cd06f3a5f77d75186c994bf8d351208aa71da3243a19d4bd464
MD5 47a366e55725d01004eb79f7bf9b0c6c
SHA1 b8cf381f1227776516b4277361f40231225b3460
SHA512 141bb2cb1b16fdfc8f26a43c2177e59e307dafc40268d54391b610ce747c2d00871af0ca3441ee873aac4b83caf2c6de4843ed13ec7c4c73ca6fca996485f82c
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T10034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaywqlidb.exe

Path C:\Temp\i_igaywqlidb.exe
Size 226KB
SHA256 e14fdf93407a1f2c6fd71addd5829d8dcbf86f5526fcfb5695b05c9086a702bb
MD5 1af8e9c575985fc34b56a5285d05e68a
SHA1 efe4fd1555223e78aa6c5cad6aeb6c92fd690e0f
SHA512 ac186f7e9399a5c93d856811bf78f2f0d61ec0712b4b047df71baf9b8657e5dbf94f095813e26746d00e750c23648a35fe94ff963945e80df3ffae37d47a1840
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T14434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpfzxspkh.exe

Path C:\Temp\i_xvpfzxspkh.exe
Size 226KB
SHA256 c7ae5de83522dfda5b65e61985c0a414365486fe4a9f6d9aa487bc4ad7943438
MD5 cf92af332c1b9fec927f41195895ee06
SHA1 f49bae2c25f443b94104405e8d1c1f08b9f273f0
SHA512 56c22c9a0c86a4212e0ab7df9b274dfa97836acfd59204ca814a1593d7caf8b7aae6a08cd98dd699d8a24183d586772b47189dda002eb1f581183aab94816938
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfzxsp.exe

Path C:\Temp\i_xvpnhfzxsp.exe
Size 226KB
SHA256 fd763db9f6d9a609e3df36910b40a1bbdb86c6a5831e9f2045fe80c3c300de62
MD5 9c11d909091da292f154c4aacf0b8793
SHA1 68fad1878c8af3f1689bd504248a9876f6544fe6
SHA512 e821859c2efc85cabe398655dc7a3d54a5faaaaffb251ba708b2cc79aee9c42af06c8e2ef524764b350a99bc005a8749179095d08ccd8954fdf3013b9b93a6e1
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T15134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywidbvtqlj.exe

Path C:\Temp\i_ywidbvtqlj.exe
Size 226KB
SHA256 d43d6c152a62fdf8c71c28ba38eb346ee319a87c793a4d5629f7588c592e224b
MD5 2a3291e41a40326caa4ce88a90d00e6e
SHA1 b1ee5bdba8e211d9985a396f48709238800699cf
SHA512 2c43f260751c79d0f4369764ca794282287d574c09811c29e8f628c6fbea19c636534e50fb75c6ba3b05064ab6d3ca6b7b4bb0e4d37cf9f220c7a03330e00c29
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywqlidb.exe

Path C:\Temp\igaywqlidb.exe
Size 226KB
SHA256 60b407e928d4c0b58f852a4965035bc8d40599ae582e5a8a9e7e4a74b6fc7e17
MD5 c8895fe078eb5c58b7be13a2fcc25cc6
SHA1 e4e2da4de195ebfe8ac6044774993b012d670492
SHA512 3d2491024cc1f6db1916073d0ae44e9feabbf91c7c197d81dc714ce4cf152733d616a137eba86272b37c74dc85b883ac497b2a3cd68c41d4915d43014800ebd4
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mheczxrpjh.exe

Path C:\Temp\mheczxrpjh.exe
Size 226KB
SHA256 18dd70285bfbcc162858d60d7e6aa4561f4bef7a1e3616dee74fcfe0cdb2519f
MD5 32a3d596cb1910c00418df1af0058072
SHA1 361e96a52e2c283d01ca9ad9382f4eef86306cfc
SHA512 490b60556c21255c71cf2332815e2bc7c92d88b3a501fa1de363ad1ae8d469747bdf88c9fbab7297ba8cf33d9b6f676b2974f772cc49b24e659f1f8fa2bee6a3
SSDEEP 3072:GFGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GkXY4LK+a3lLNngoqRttA7
TLSH
T19834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxrpkh.sys

Path C:\Temp\pnhfzxrpkh.sys
Size 141KB
SHA256 5c616db6aa04dcb40a7fdc6159a8fae75d7abe50e0a4b2c0f5ac42b9135214d1
MD5 54679557713756da829413febdb7bf01
SHA1 34aa4f7d92d28d8e33cfd442a80dc6c518256945
SHA512 1e05f1848e94d56c47e5d7489a968053bd3a7807d8554f30599c3b80f66270d9619082031c1552807c73f95ead41d31312f5ab0687ba574af9307f8dcd5b7a6f
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaqnifa.sys

Path C:\Temp\qkicaqnifa.sys
Size 141KB
SHA256 57f4e5fba469273adb299517f921efed89b201fa6f82fdc9893b665a95ab8847
MD5 c596e20199349291ddb92d4f1bf72d2b
SHA1 c6f161220fddf346c3a5f940395430223f51dea8
SHA512 6b78329c630197515324d6c1d0b3d4ef3a123a07235bd03352fb456c604ba951e3de3dded135b250d933efc69114e030d0c907f2ab76ebc4ee037614fd5fdae7
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqol.sys

Path C:\Temp\tnlgdyvqol.sys
Size 141KB
SHA256 9308db74f9b746de627e3fb2e67d8f676de44aea1f9c6badca6df4969e509725
MD5 37843f990c10f1a5c75573ab68cebfbc
SHA1 cb2d4f1c019a7f65a7552d0efd76a0ce66e983f6
SHA512 2bccc58eea903e355342ba0cc2823e84420b5e755f55ee90c10b53d8f8d12f2221ee682457dec4d5ab2cd21105685537d17a7dd306aff7ee24700c06c284631c
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpfzxspkh.exe

Path C:\Temp\xvpfzxspkh.exe
Size 226KB
SHA256 be95ca6c285f01dcf8328b46c00c5069c336f9244eca89e61538d0a321cc50d5
MD5 9a09a41578c5e141c7ebfd7aa5e1d346
SHA1 3450137e23b59836033dacee85757ae07e924b00
SHA512 2429f064c3506517577a0119a4f13e3ca2f206e28a2e940e33bc3bd6f0cc8dc358fb278762ae06d24b42c0e69c4e315ed394493ac806efcd86be9050df5a7ead
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxsp.exe

Path C:\Temp\xvpnhfzxsp.exe
Size 226KB
SHA256 69f0d184c0704a77a95b46b4bad274f3e9199232a3e8abbed451558f8aa974c4
MD5 00afd54f5e0a25539cb8111f0e1ecb94
SHA1 569c58a3a0904abf6409bed3ab900057d70c79e7
SHA512 d88e2a1168275f26d4b2d6b60de3c8e21d7e23fcca637dec9a737e4ccb47dbf3e464fb5bd2161072ee2c54d9d806b558a03dc438431dd933a7b594eee7663e6f
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T19134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxsp.sys

Path C:\Temp\xvpnhfzxsp.sys
Size 141KB
SHA256 8fd3b07875eaa33a214cfabba6b8db623a69bdf086b90cba484c4e72ca443e47
MD5 ff759db364018ce9e0332f59d8a20f7d
SHA1 11e28df2c5049b3cdb40a11ffb1092b0fa536a0c
SHA512 b371fed9b62cf137069a9bb1b36d140845900a54e9fd1d730a200cc0968bf8610ca6db81f142825b5b4c0616e5e25eecda1301410ce497df161d81a6f7840a0d
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywidbvtqlj.exe

Path C:\Temp\ywidbvtqlj.exe
Size 226KB
SHA256 8064d09c6b29493d4379034e1772972deca749e5062470ba61b9d3182de6801d
MD5 b26eb68fbe668ae7dc376e9d1ce14138
SHA1 2b31ba147bdd6a10589fda03c93ff868cfeca175
SHA512 1e789895c76b2a5b77e8e18f22e20002182294cfb04e67f265ee8c61f919a38260d431c4d129eec13789a0bfcf56f07d256d915d35ee6671f3fa7c6ab8395c7d
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b4230a2-5020-4b0c-a98e-59405ff01c89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b4230a2-5020-4b0c-a98e-59405ff01c89.tmp
Size 31KB
SHA256 f6987e702fe9b7493e4a1fe2a3ce9893c612c35640d5b6ce695cb559b07a9217
MD5 0d404c4cab774d4d0a1602b4bf8edc01
SHA1 c49abe76018c714884b81c2ab2d1407cd120811d
SHA512 d75c31bb919024ca9dc473754a5f50ad19bc648cc4f112877ac3134ef293a56a31f8d2f3921350e4c5688ab0a455fa8f07c2c9981ec9c76d185a646f75547173
SSDEEP 384:nwiF1tNn/s3n9Sf58NL68TUNTUlIR/PvuTf0XEqfbYGGpe+DLkY3sa+VY68LEEIQ:LF1j+9wQ6wgluwOGGN/3hgnC
TLSH
T1E8E290F198D78AB7D89E4B97633E6E4699FCD163B4884988B7C44D0CCC861BFC606816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1bc50a2f8610cbcb2fa0bf2aef344731e322f472027bcc3ad8366495f2175dfd
MD5 90f8ef21f0bbbc73859f4bd6658ca9a0
SHA1 b9d4165cf838f1b85f79c56eaa54989494a223b5
SHA512 6f0242fa17ddfe66bf8e85eda5cf5550549b62801657de07eea14a6708cabfdc400b7b4f9f1e24a2fbcce4678227815c66ed181e5b308c63a09ba48f40e6e8ed
TLSH
T1B4E0E5D9C824AC2759FD1B1860580686EB60131B3A42890F3B3D826D4FB06374686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 780e4f6944386f8a5509ab01888eb4b8ef3c01df5cad52666591a44b759b0044
MD5 d0f871eb15ebb00a2057156d11c2e181
SHA1 299a01670648dd79cb26c2837500e13572d007b6
SHA512 6cddee077afa89a12cd0c83c06e4d7cc598af40de6349cae06bd8163cb27a5a813eb954d1da239a7b9fa4e36f07477d44782944b503ee60dcf227773c10c956f
TLSH
T17F41AFF783F4856EDA1195F0EA186E1FCE1D0511432C7D9A89E0AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 06898dcbc597b7eed33dc9e8400048060818946a6f1e498bbf8645c53712e8ae
MD5 72a2c0c5c34902d380b89651410b915d
SHA1 1926521b38c22a82ec828ddf896ea9b2f169cc4f
SHA512 674a71aa272eab47cb05a297ab37c4f5bdcedf477e686bcf5bb274ea228022c1a86660630357c7eb3e69480768d8f829e84b78181baf5c26c9dfe17d08fa37a4
SSDEEP 384:sxRtxq9U/f6sa7VN/RI3eiK/5I/WMZsGQVYVRU:spY9U/f6nW/K/5aWMZsGQV5
TLSH
T1D772E9159A649D3BCCDBD209FA957F93D2F85173A1945E44AAFCCA0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 677a5b7ea46ba7180015036d1ed34d9688673496e9d0ccc4e954cf35bfdb7cb4
MD5 b7678a769b8b7947b9c31d5c1889d092
SHA1 39f43277e6067881c5fd3aa2bdb110382ee269e5
SHA512 c743926a020d2407585e8e2686f625f4242a3f99ae678175110ec72cf15e7e82daa16eeb4c457c172ec23a3609c59c6f759a33a8534a728ff14693344fe071e1
SSDEEP 384:sxRtx8U/f6s9LN/RI3eiK/5I/WMHsGQVYjv:spOU/f/hW/K/5aWMHsGQVi
TLSH
T1F372EB159A749D3B8CDBD209FA557F93D2F85173A1545E44ABFCCA0C00E66DD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d88ad81a5d8e793f00c102fad75ff4aa68a5b047ef3aee72df8099279cdd203
MD5 4061d0fb983db26ff08db8d3c4101ec8
SHA1 58fbe1e27096d5d155c9f443670858a3e3aff385
SHA512 3ca83018397bf029c5d15a95ddbb1d24a16771784ff2a08311754fb25d78b85054fb99714d968c5ea2821cb01b21d6e0fe19da1a98bca59c97243c298aba0a96
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDobbDwzroD4H:Ob4YZnE7yTWg1NfwBu1ja0obHwAEH
TLSH
T126E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9be3dbad1931a0a0eb612ab173a75fa64a742ddf7eb2a311a2a548039915b4a7
MD5 88bd0c8e33b6e055bfd6c85ddaa2b2ff
SHA1 ec9857adbb473e2f5cf0d684653dba93ca0d7f78
SHA512 fdc0151d6973a1f9f084c22372c1f733231fad4bdce6965b530f37829c60e6e075a2299d36c03d23a2b2b0a5ee523d50a83330f92752e5daa0ad51fb1cf6a3ea
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9sfy:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRk
TLSH
T13BB26D11713F4280387EB90C8178986F82C2B4637519E53F7BA846A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 88c16540014f238de24c7b70e40d1f52b740c20c3efe58216ee5d40557abede3
MD5 777219c40dba0709a1ef127578838b7d
SHA1 f93096185559abf82dcafb8632ae5511399ad723
SHA512 d0cfc1f8cf3d659e22691599ebcb15f81cc802cb3b2c75ec9ddbad9f70f2ef8737cea0a84f3374b778e4af326d538efc42dd0b56762b9da8d7c3523c806f1146
SSDEEP 384:nFiF1tNn/s3n9Sd58NL68TUNTUlIR/PvuTfXXEqfbYGGpe+DLhQ3sa+VY68LEEIQ:MF1j+9SQ6wgluLOGGNK3hgnC
TLSH
T1A9C23B32A858CEB7ECEB4FD9B74A7646DEE012A3848D59D8D6D45D4C00CB2AD074BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3a0cd72f0e179c39edcc5b0ef7543b2f1ca2a23d57a90d917d583e3189fb4952
MD5 4191911bb52d584f4fd14dc70765a3e1
SHA1 70e0722752a526cb8124df5208226516c89ce3ab
SHA512 3a0657734209393d3cd78819ef323184bf47f43cc72c65b1325251d627b1e42e59c011e9465f52a8750c5ba1b5d231d18c9717a5fba5a2f00f7c69fb1c66da6a
SSDEEP 384:nIiF1tNn/s3n9Sn8Ngm8TUNTUlIRiPvuTuPREqfbYGGpeKL8OObjI9G6w738LEEy:TF1j+9SXmwgUuqUGGr829MJ
TLSH
T16BC24C32EC59CAB7EDEB4F99B74A7A46EEE01167849C59C8DAD85D0C00C71ED4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 68d15d0d11ff15c3e0809a05139aca8ce4ade71ae4559df3627b6bfeb192147d
MD5 085f76b635b55092bdf4f1fcd976e318
SHA1 06d619a37f073af0886d99f15a001fab64892235
SHA512 f42fdf52d78dd7546ad0c7e006d5c83c8f238ceed6567f69233576d01fd62b4e35f327cb6f8ea9b87d6f4e934f02e4c269adc2a107da1426fbd6c22ec0625d7a
SSDEEP 384:nkiF1tNn/s3n9Sx8NL68TUNTUlIR/PvuTCXXEqfbYGGpe+DLhk3sa+VY68LEEIzc:/F1j+90Q6wglu2OGGNm3hgnC
TLSH
T104C23B32A858CEB7ECEB4FD9B74A7646DEE012A3848D59D8D6D45D4C00CB2ED074BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97fe27a997be2698e4d413ffda216380c1e104c56d7b9a30bb0d52ee29db9cda
MD5 ccbe4b60d3b3bdc71b32f3d7220bfe06
SHA1 d2d30f7236ae851b2296170120e8b09c118cf1fc
SHA512 138dfced10ec98e9d4ba58fc47e4b7a1e17080460e7ec0d34f0ebd629d8532bada32f9528fa5eb355c4b7539b9fa71db72002a447a77da5fa7c4697d41435161
SSDEEP 384:nhiF1tNn/s3n9Sn8Ng68TUNTUlIRiPvuT1hXEqfbYGGpe+DLhk3OObjI9G6w7382:IF1j+9SX6wgUuzOGGNm329MJ
TLSH
T151D23B32E859CEB7EDEA8FD9B24A7646DEE052A7C48C5AD8D6D45D0C00871AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 08a293f1583d129c9e975f00f9f365bb366b9023bcc15b3612fa8cb7a3ef3e15
MD5 6a812c11f55f0456e0e0b26731680073
SHA1 843157812ee131255015c3bfa9b8c1411934d3f9
SHA512 00f516a51d1a92f8d24d8bde435a82a3ad9996b99efbbc760c7c172fcd6bd4708c0c59832474b40d0c3b04625d3fa60050b627fe415365d339382115061f24d1
TLSH
T11C515FE04C381AD1D4FD0E7EB48B78FC81EC9726F890343C6858EA985A7A21D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c2c5d7eb09875229c9af0a1efdd00d04f58185c6a19ad0ffc4b589f68022e321
MD5 757c1b047c4ea2b2ed016a9ef7601a13
SHA1 94d19b5051b6687ed71d0fe951762ab93ecf25f1
SHA512 3fcbf77cd3bb9dee28ba4225082d6459d425350ab19fcb917f450b7682fa6c9fcc24238a823aec8bbc339c4107f19c0844b0efa2fed40db5f45a73b19f642eb9
TLSH
T1B0515FE04C3C26D5D5FD0E3EB09739FC84EC8726F8A034386858EA589A7A21D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 25afb2f2bbaa4983e1dd9fbc7dbd3db3c6f90ba68a4da5cfa259e6125d7af563
MD5 df226db3e0bb4123ee114425d619b135
SHA1 8982e45bd0925562b0eae483d5f2134f34d13e37
SHA512 4ed768186ed4a8d0c2e88df140b8060a245ffc7383420454a9370e53e35b18248d0ebe303f8e0b57396fccb6bee2cd4e2aaaa633a45e7d4cd783999bf62c713c
TLSH
T1E7513DE04C381AC1D4BD0E6FB45B79FC85ECC726F4A0347D6858EA985A7A65D318483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c99f8d6ff1a2609cc103622e9f2bfce1719c83d6cc0017bb8cfb7b9382ca3d4b
MD5 9e07f6362b422cd3d137d75864164047
SHA1 c15979cde86a78d482eb8a47ce32907fe7f14744
SHA512 ea41c7a1d7ddf7e26c25d7aea46cc1d676e39e630d46a6264d3d9fb32482fe8b857517f98ec8297d816804058db0ae177b42654b041257cbb280f9c56d80043c
TLSH
T12C513FE04C381AD5D5FD0E7FB05779FC85EC9726F8A434386858EA985A7A21E309083F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/596-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/672-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1768-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2716-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3388-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3960-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3960-274-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-250-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-212-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5940-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6260-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6784-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7024-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7024-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7140-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7140-225-0x0000000000010000-0x0000000000083000-memory.dmp

Download