cf992e2647aa17e3d96bbb7fb5447820fcc43b9cde41e5c4a3958809ed775c19

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260913-ebt4astsdz
SHA256 cf992e2647aa17e3d96bbb7fb5447820fcc43b9cde41e5c4a3958809ed775c19
MD5 34922bff9c6e7ab0890678442787e15f
SHA1 c2a6b4b9b8f0a2a47b316beaa334457b40d16384
SHA512 2a628faf4b6e0f1c1256198dfec84f4464529fb18f4907b4c4d9eafba9e28d25f4fd6869c8efb1e18a0b9196424fe42b9e459634bc39ad8d3162e4930bf48dab
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1816	CP.exe
4576	zxrpjhcxrm.exe
3004	CP.exe
5576	CP.exe
4924	i_zxrpjhcxrm.exe
4816	bztrmjecwu.sys
3404	CP.exe
2008	wurmjheywt.exe
4596	CP.exe
5816	CP.exe
2592	i_wurmjheywt.exe
4836	trojgbztrl.sys
5028	CP.exe
6080	rljgbztrlj.exe
1988	CP.exe
1404	CP.exe
5808	i_rljgbztrlj.exe
3260	ywtolgeywq.sys
4684	CP.exe
4072	nlgdbytqli.exe
3068	CP.exe
4360	CP.exe
4252	i_nlgdbytqli.exe
1548	yvqnljgayv.sys
3712	CP.exe
6092	tnlfdyvqoi.exe
1996	CP.exe
5236	CP.exe
5720	i_tnlfdyvqoi.exe
4972	nigaysqkic.sys
2824	CP.exe
5108	nifaysqkid.exe
4452	CP.exe
3112	CP.exe
700	i_nifaysqkid.exe
4876	nifzxvpnhf.sys
1004	CP.exe
1924	icausqkifa.exe
4248	CP.exe
4304	CP.exe
2980	i_icausqkifa.exe
5604	smkicausnk.sys
3152	CP.exe
5368	kecxupnhfz.exe
2708	CP.exe
1360	CP.exe
5412	i_kecxupnhfz.exe
2184	upnhfzxrpm.sys
1984	CP.exe
5112	smkecwupmh.exe
5968	CP.exe
204	CP.exe
5612	i_smkecwupmh.exe
2636	rmgebzxrpj.sys
5064	CP.exe
5872	mjhbzurmje.exe
4572	CP.exe
5896	CP.exe
5772	i_mjhbzurmje.exe
4060	wrojhbztrl.sys
1936	CP.exe
6012	rljebwtrlj.exe
5140	CP.exe
4260	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_1168417801\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_2122858239\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_151361824\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_151361824\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_151361824\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_191900643\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_1168417801\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_2122858239\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5220_151361824\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhcxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhcxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjheywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjheywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4780	ipconfig.exe
1184	ipconfig.exe
6100	ipconfig.exe
2004	ipconfig.exe
1008	ipconfig.exe
4076	ipconfig.exe
4764	ipconfig.exe
2060	ipconfig.exe
4124	ipconfig.exe
3484	ipconfig.exe
4792	ipconfig.exe
4244	ipconfig.exe
2704	ipconfig.exe
1396	ipconfig.exe
5768	ipconfig.exe
2780	ipconfig.exe
6044	ipconfig.exe
4204	ipconfig.exe
5660	ipconfig.exe
3704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337447929905777"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{31550E6C-4C17-4774-BF02-8696D85DB2F6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5128	msedge.exe
5128	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4924	i_zxrpjhcxrm.exe
Token: SeDebugPrivilege	2592	i_wurmjheywt.exe
Token: SeDebugPrivilege	5808	i_rljgbztrlj.exe
Token: SeDebugPrivilege	4252	i_nlgdbytqli.exe
Token: SeDebugPrivilege	5720	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	700	i_nifaysqkid.exe
Token: SeDebugPrivilege	2980	i_icausqkifa.exe
Token: SeDebugPrivilege	5412	i_kecxupnhfz.exe
Token: SeDebugPrivilege	5612	i_smkecwupmh.exe
Token: SeDebugPrivilege	5772	i_mjhbzurmje.exe
Token: SeDebugPrivilege	708	i_rljebwtrlj.exe
Token: SeDebugPrivilege	1372	i_oigeywqojg.exe
Token: SeDebugPrivilege	5960	i_ytqljdbvtn.exe
Token: SeDebugPrivilege	760	i_nigaysqkid.exe
Token: SeDebugPrivilege	1224	i_vsnkicxvsn.exe
Token: SeDebugPrivilege	1396	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	4496	i_rpjhczurpk.exe
Token: SeDebugPrivilege	4288	i_mkhczusmke.exe
Token: SeDebugPrivilege	4424	i_mjhbzwrojh.exe
Token: SeDebugPrivilege	940	i_trljdbwtom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 3292	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 3292 wrote to memory of 5220	3292	iexplore.exe	88
PID 5220 wrote to memory of 4224	5220	msedge.exe	89
PID 5220 wrote to memory of 5756	5220	msedge.exe	90
PID 5220 wrote to memory of 4044	5220	msedge.exe	92
PID 5220 wrote to memory of 5756	5220	msedge.exe	90
PID 5220 wrote to memory of 5756	5220	msedge.exe	90
PID 5220 wrote to memory of 3428	5220	msedge.exe	93
PID 5220 wrote to memory of 3428	5220	msedge.exe	93
PID 5220 wrote to memory of 6016	5220	msedge.exe	94
PID 5220 wrote to memory of 3356	5220	msedge.exe	95
PID 5220 wrote to memory of 6016	5220	msedge.exe	94
PID 5220 wrote to memory of 6016	5220	msedge.exe	94
PID 5220 wrote to memory of 3356	5220	msedge.exe	95
PID 5220 wrote to memory of 3356	5220	msedge.exe	95
PID 5220 wrote to memory of 5052	5220	msedge.exe	96
PID 5220 wrote to memory of 5052	5220	msedge.exe	96
PID 5220 wrote to memory of 5052	5220	msedge.exe	96
PID 5220 wrote to memory of 4572	5220	msedge.exe	97
PID 5220 wrote to memory of 4572	5220	msedge.exe	97
PID 5220 wrote to memory of 4572	5220	msedge.exe	97
PID 5220 wrote to memory of 1196	5220	msedge.exe	99
PID 5220 wrote to memory of 1196	5220	msedge.exe	99
PID 5220 wrote to memory of 6048	5220	msedge.exe	100
PID 5220 wrote to memory of 1224	5220	msedge.exe	101
PID 5220 wrote to memory of 6048	5220	msedge.exe	100
PID 5220 wrote to memory of 1224	5220	msedge.exe	101
PID 2804 wrote to memory of 1816	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5220 wrote to memory of 4088	5220	msedge.exe	105
PID 4576 wrote to memory of 3004	4576	zxrpjhcxrm.exe	107
PID 5220 wrote to memory of 6052	5220	msedge.exe	110
PID 5220 wrote to memory of 6052	5220	msedge.exe	110
PID 5220 wrote to memory of 4360	5220	msedge.exe	111
PID 5220 wrote to memory of 4360	5220	msedge.exe	111
PID 2804 wrote to memory of 5576	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 2804 wrote to memory of 3404	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 2008 wrote to memory of 4596	2008	wurmjheywt.exe	120
PID 2804 wrote to memory of 5816	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2804 wrote to memory of 5028	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 6080 wrote to memory of 1988	6080	rljgbztrlj.exe	129
PID 2804 wrote to memory of 1404	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2804 wrote to memory of 4684	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4072 wrote to memory of 3068	4072	nlgdbytqli.exe	138
PID 2804 wrote to memory of 4360	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 5220 wrote to memory of 3696	5220	msedge.exe	144
PID 5220 wrote to memory of 3300	5220	msedge.exe	145
PID 5220 wrote to memory of 3160	5220	msedge.exe	146
PID 2804 wrote to memory of 3712	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 6092 wrote to memory of 1996	6092	tnlfdyvqoi.exe	151
PID 2804 wrote to memory of 5236	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2804 wrote to memory of 2824	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5108 wrote to memory of 4452	5108	nifaysqkid.exe	160
PID 2804 wrote to memory of 3112	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2804 wrote to memory of 1004	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 1924 wrote to memory of 4248	1924	icausqkifa.exe	169
PID 2804 wrote to memory of 4304	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 2804 wrote to memory of 3152	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5368 wrote to memory of 2708	5368	kecxupnhfz.exe	178
PID 2804 wrote to memory of 1360	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 5220 wrote to memory of 1560	5220	msedge.exe	183
PID 5220 wrote to memory of 1560	5220	msedge.exe	183
PID 2804 wrote to memory of 1984	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 5112 wrote to memory of 5968	5112	smkecwupmh.exe	191
PID 2804 wrote to memory of 204	2804	2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_34922bff9c6e7ab0890678442787e15f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x35c,0x7ff8247bc188,0x7ff8247bc194,0x7ff8247bc1a0
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,6330917056701214203,6488177345700476870,262144 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,8736304243625797718,15441994143089041998,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:11
      4⤵
      System Time Discovery
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,17265338200765163731,4156274964067748920,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,15912009711191569406,13726652820938018961,2097152 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,15990405142134941571,11577141714581053138,2097152 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8670457518826238470,18095743533088881027,2097152 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,9309834510664788434,7151529290392112196,2097152 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,14707676474929904344,17211545285403021679,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14751385619907983370,4692623740453985495,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,11861882815590824410,5416074533258640320,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9136951144805904067,7495070053872403161,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9136951144805904067,7495070053872403161,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,5104233964129248836,3822614501750788331,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,6262826427907865740,5664982817934808679,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,5369098061796745295,5052949342295042149,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,16263655194307179692,11304394868168628796,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1127448071886098478,12440233561525182234,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,5831720088905394125,1575729310269322071,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:14
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,1354857931667852419,5708094933866641086,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,15586423799503225880,1893117522864974530,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,14417736695584628227,17099996591548239902,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,15157075071410558612,11190118898369673269,262144 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14808877772144805292,4147801625250608432,524288 --field-trial-handle=2392,i,2880653122673164364,17390007436377857836,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhcxrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1816
- - C:\Temp\zxrpjhcxrm.exe
    C:\Temp\zxrpjhcxrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhcxrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5576
- - C:\Temp\i_zxrpjhcxrm.exe
    C:\Temp\i_zxrpjhcxrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurmjheywt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\wurmjheywt.exe
    C:\Temp\wurmjheywt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurmjheywt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5816
- - C:\Temp\i_wurmjheywt.exe
    C:\Temp\i_wurmjheywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljgbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\rljgbztrlj.exe
    C:\Temp\rljgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljgbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1404
- - C:\Temp\i_rljgbztrlj.exe
    C:\Temp\i_rljgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdbytqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\nlgdbytqli.exe
    C:\Temp\nlgdbytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdbytqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\i_nlgdbytqli.exe
    C:\Temp\i_nlgdbytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Temp\tnlfdyvqoi.exe
    C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5236
- - C:\Temp\i_tnlfdyvqoi.exe
    C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2824
- - C:\Temp\nifaysqkid.exe
    C:\Temp\nifaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3112
- - C:\Temp\i_nifaysqkid.exe
    C:\Temp\i_nifaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausqkifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1004
- - C:\Temp\icausqkifa.exe
    C:\Temp\icausqkifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausqkifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4304
- - C:\Temp\i_icausqkifa.exe
    C:\Temp\i_icausqkifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\kecxupnhfz.exe
    C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1360
- - C:\Temp\i_kecxupnhfz.exe
    C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1984
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\mjhbzurmje.exe
    C:\Temp\mjhbzurmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Temp\i_mjhbzurmje.exe
    C:\Temp\i_mjhbzurmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\rljebwtrlj.exe
    C:\Temp\rljebwtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\i_rljebwtrlj.exe
    C:\Temp\i_rljebwtrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigeywqojg.exe ups_run
  2⤵
  PID:4560
- - C:\Temp\oigeywqojg.exe
    C:\Temp\oigeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigeywqojg.exe ups_ins
  2⤵
  PID:2220
- - C:\Temp\i_oigeywqojg.exe
    C:\Temp\i_oigeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtn.exe ups_run
  2⤵
  PID:1384
- - C:\Temp\ytqljdbvtn.exe
    C:\Temp\ytqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtn.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_ytqljdbvtn.exe
    C:\Temp\i_ytqljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqkid.exe ups_run
  2⤵
  PID:5288
- - C:\Temp\nigaysqkid.exe
    C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqkid.exe ups_ins
  2⤵
  PID:2180
- - C:\Temp\i_nigaysqkid.exe
    C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkicxvsn.exe ups_run
  2⤵
  PID:1356
- - C:\Temp\vsnkicxvsn.exe
    C:\Temp\vsnkicxvsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkicxvsn.exe ups_ins
  2⤵
  PID:4600
- - C:\Temp\i_vsnkicxvsn.exe
    C:\Temp\i_vsnkicxvsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspkh.exe ups_run
  2⤵
  PID:5472
- - C:\Temp\pnhfzxspkh.exe
    C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
  2⤵
  PID:1376
- - C:\Temp\i_pnhfzxspkh.exe
    C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurpk.exe ups_run
  2⤵
  PID:2756
- - C:\Temp\rpjhczurpk.exe
    C:\Temp\rpjhczurpk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurpk.exe ups_ins
  2⤵
  PID:2184
- - C:\Temp\i_rpjhczurpk.exe
    C:\Temp\i_rpjhczurpk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczusmke.exe ups_run
  2⤵
  PID:2296
- - C:\Temp\mkhczusmke.exe
    C:\Temp\mkhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczusmke.exe ups_ins
  2⤵
  PID:1736
- - C:\Temp\i_mkhczusmke.exe
    C:\Temp\i_mkhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzwrojh.exe ups_run
  2⤵
  PID:1120
- - C:\Temp\mjhbzwrojh.exe
    C:\Temp\mjhbzwrojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzwrojh.exe ups_ins
  2⤵
  PID:6064
- - C:\Temp\i_mjhbzwrojh.exe
    C:\Temp\i_mjhbzwrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  PID:2264
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  PID:5056
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5344

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4816

C:\Temp\trojgbztrl.sys
C:\Temp\trojgbztrl.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Temp\ywtolgeywq.sys
C:\Temp\ywtolgeywq.sys
1⤵
- Executes dropped EXE
PID:3260

C:\Temp\yvqnljgayv.sys
C:\Temp\yvqnljgayv.sys
1⤵
- Executes dropped EXE
PID:1548

C:\Temp\nigaysqkic.sys
C:\Temp\nigaysqkic.sys
1⤵
- Executes dropped EXE
PID:4972

C:\Temp\nifzxvpnhf.sys
C:\Temp\nifzxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Temp\smkicausnk.sys
C:\Temp\smkicausnk.sys
1⤵
- Executes dropped EXE
PID:5604

C:\Temp\upnhfzxrpm.sys
C:\Temp\upnhfzxrpm.sys
1⤵
- Executes dropped EXE
PID:2184

C:\Temp\rmgebzxrpj.sys
C:\Temp\rmgebzxrpj.sys
1⤵
- Executes dropped EXE
PID:2636

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\bwqojgeywt.sys
C:\Temp\bwqojgeywt.sys
1⤵
PID:1548

C:\Temp\yvtolgeywq.sys
C:\Temp\yvtolgeywq.sys
1⤵
PID:6004

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
PID:5772

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
PID:5800

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
PID:1696

C:\Temp\zxrpkhczus.sys
C:\Temp\zxrpkhczus.sys
1⤵
PID:5604

C:\Temp\rpjhbzurmk.sys
C:\Temp\rpjhbzurmk.sys
1⤵
PID:124

C:\Temp\omjebztroj.sys
C:\Temp\omjebztroj.sys
1⤵
PID:2592

C:\Temp\bztomgeywr.sys
C:\Temp\bztomgeywr.sys
1⤵
PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.sys

Path C:\Temp\bztrmjecwu.sys
Size 141KB
SHA256 ea8a978c1e93c1869ac02b4b18a596d096fc61be81a5ed23d7ffe3aa6586b734
MD5 b95ce42c605247a6fe7c4fe8de293bac
SHA1 c6a16d1ebb082a5e2162c41b11c24b2e4c29b1f2
SHA512 683407cfb1b4465fec1fbeb1e9f12a41dd8a47b6aedd01100eb1315fa08c3d0669f411d9e047aad47b9650e0be6e9886013cfd1ed38951e5e17995966b630835
SSDEEP 3072:1a3rV3dZPFvOAngoRUAFa1nxayHdXkbP:1a3lLNngoqRt
TLSH
T1F9E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaysqkid.exe

Path C:\Temp\i_nifaysqkid.exe
Size 226KB
SHA256 8602f2cd15735afe1d78e0f3779f1b7573cb9036c58c41faba7630de7b151506
MD5 0b980156469ffd735cca370fede5091c
SHA1 6103a8cd7059aea083d1f828c0e4e48926e57be8
SHA512 bee639c27d4eff6d7c9487b6d012188a8dd788a3c7dcca4a5378bfe63d16d8dcfe26fdd0f4cd436e1fb3d74107671eb496860bfadaedf7fb187321b60be8bcc5
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1C434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdbytqli.exe

Path C:\Temp\i_nlgdbytqli.exe
Size 226KB
SHA256 629419f210c9b3cfe72d923a2df0ee6e25a905c44efaaf1930a9c1aa18aa98af
MD5 6b196bd9bad2b6077612f168e975d00d
SHA1 a8bf676742a24ac3bbab005ff968ac752d446b86
SHA512 6e5486a82c9c0abe753d495e050415edc8e10bb5ff8cb014e839113211130037690b2d7fa7341c0df3254227ffdc9e5ed98a6d2595ca0f046709e1689b18e17d
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljgbztrlj.exe

Path C:\Temp\i_rljgbztrlj.exe
Size 226KB
SHA256 5d8ffc31da46607de8a5fe25907cc916d7fd988700e86bcb07bea23a871638be
MD5 eb3ce4900a2778e3258ed75fd409cecc
SHA1 12087ed21cb128825797b3a8212a7be61c775f7f
SHA512 b585810c2784edbce48f29917f9af2632105b5250489938a8aedb0280f937fc996e7f525098002e3e2a5ca708213a0a1a3869c51c311143a15361643f7910f35
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T11234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvqoi.exe

Path C:\Temp\i_tnlfdyvqoi.exe
Size 226KB
SHA256 8f3fe07207c743be1c9d200d0ef781ce159df72f0639b889d71617fee1577002
MD5 dda02ed96fcc3c950fee4ec3d3b85895
SHA1 9535a62c8cc97cceecf74aa930216e2f2433efe0
SHA512 f6f8e5b31fad1dae848f00c1f63566abdc1c6c194d24c2213652c555c12114d6fa93e3dba17267b32d28bdc88b01616ff59e13f93b94ef67c4a4a9534bd6f62f
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wurmjheywt.exe

Path C:\Temp\i_wurmjheywt.exe
Size 226KB
SHA256 ef74744538e1e24d47939f2b597f61fe9870ce34b87dd85c04f474557533508e
MD5 14dc00ef4bc53c1187ee891cc1b8dede
SHA1 32ce47c1c743eae6aa8bc6b4875d1a15cbf6f171
SHA512 ee8f6e1ceed7e932d7c262ab8415805931bf723891d96084785aa043aebc22ae404d5b8913674569972206b1eb71747a2b90f26270466819d8034b343e4b7103
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T16B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhcxrm.exe

Path C:\Temp\i_zxrpjhcxrm.exe
Size 226KB
SHA256 f671d0809fc36b487e01d4c0ed7ea30c1b05245b7e764629b2d0dc4ae31aa73d
MD5 849dc76db3608547c986c9ba20344a20
SHA1 c73aaab5f26799280ad52a7649f282de8fb41fbb
SHA512 ae96752fa26381561a3af95a2dda5acba5e4e057589b079f397030dabb3de4d907d47f3eec3ee455f83d77b1a0fa4b6edcebb9e785dfde490f0b043230706747
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1CC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkid.exe

Path C:\Temp\nifaysqkid.exe
Size 226KB
SHA256 7a56c8811c29d560202010d975584024e8e464ebde8bfdbf6381795bc350df6e
MD5 294a56529175ed165762c014d5fc1870
SHA1 c2b4fbe71b9a9ff5a727d540e1fbc86ddb5106d5
SHA512 2a13df274337ae259c051f8758290e8ecbd439dad095dfc466d22604ad59c36aa4ea4e63e10a0a84ef97899c936bf1e3551916c942e88d2e67402bed8a70a8ec
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqkic.sys

Path C:\Temp\nigaysqkic.sys
Size 141KB
SHA256 837c9794f198f33c04c92d67e44baafba9e60746b86d003d9183aff45ebef0aa
MD5 abf5236b9405d8f4bcd95c001a9dcdfc
SHA1 9bc35efca5716b7ec0d9e4fdfab518977dbf66c0
SHA512 a7ba5c3270248335344ee82f68f8613cc02f2e242bc6dd780c71a46fc12e6fdc55d5e5993d491541f162ea7ad6c2abc53999a75e763cc6dcceafbbda7057ea14
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16CE37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E643D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdbytqli.exe

Path C:\Temp\nlgdbytqli.exe
Size 226KB
SHA256 47672addb2316e98e9fce877e0de11f344c2f997869de35b3b87083e4e09a191
MD5 adff1a0d3d14126493d07306c7cd1155
SHA1 dfdd97f2c68f19f30dd9b0d870b5a7fa43d358d3
SHA512 f683249e223701a0da6f254023048d4a36ce129b52b6dd0cb6712458c74f62544ad6aafd86d991f7dbab6525182af01a5bddbe3e209c9fec2b2579c0faeefa0b
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbztrlj.exe

Path C:\Temp\rljgbztrlj.exe
Size 226KB
SHA256 50e224063f863983d7c650fd700c3b92a0195e5ca8578888b7c3e7e6963eb076
MD5 8d7414c347cac800512eb30cedaf695c
SHA1 a2e84e721cbdbbe3e89dcdc9277da841efa2e563
SHA512 9e4a515856a02a3dfa601dc796924a6621338f8a4f08bc6e56bec8ae92b8212a2acedde2e2d5b7a929c618a4939010143abc6a5aa6771f3ab4dacb964c3f992e
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.exe

Path C:\Temp\tnlfdyvqoi.exe
Size 226KB
SHA256 c4407d9ad0ef8f681390965950bf5d97445d10d70222f5181662c22c3ae4559c
MD5 112813634821260d7b0e4e71bb15b6ad
SHA1 ab3707442b0339f235dd473f533f49b0dbc67abd
SHA512 7310e941d1aa84036abeb9a38dd355edabd42b5a7ce9d5b82fa50c7849c8ec340523e7c588eb1138ec174827137cc6368436bf6aec093db786007420c67192d2
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T13D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojgbztrl.sys

Path C:\Temp\trojgbztrl.sys
Size 141KB
SHA256 ab0786a5db3af9530c0c7d5825303b03b46f9a746b75263b39455e60ebd02517
MD5 dc17f9035d017c06d540fdc204d585ad
SHA1 89ccbe00fdc2696aa2f93ed6b80242853206d2be
SHA512 ad78ffb46775d89a14f4666f1fd8bcf11621cb56ee7a20ac88efce398fbb305f2f7cc1a2dfd3632127ee8aee048ef1e8420b594ab616d77a6bd02680bd30b438
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A4E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmjheywt.exe

Path C:\Temp\wurmjheywt.exe
Size 226KB
SHA256 12e66eee3c74a15341430f80b7e5eb3ddd2a2903cbc1475b76f25471ba0b4972
MD5 997574527b002d6beb3db2b62b83a593
SHA1 8e99a6cd79964ce3d8942dc5626c4d72176544ce
SHA512 e6833bd0c92175686ad7f8877d8a0e68dc2792ecd6635f8058419819b2d9e6d6e4ce4a358c62b4745bcdc7285593fc61db51f2093b0f1515fefe5e343ee0712c
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnljgayv.sys

Path C:\Temp\yvqnljgayv.sys
Size 141KB
SHA256 5706dfe442fc84fd0528af31a6c1ce9176342c3ca01e28761ae7ff263af34374
MD5 27acf2a916f5b4e9a17e29143c3e5d8d
SHA1 090207ff78cec056e2f8011cf2092646488b5ce9
SHA512 4c0bcab326f995b8997e37c30dc59d87717c5481945b1c2cbea52efb29f046fd0d561ec81bfedd1ee1784481d009ba5379d0409c8a1395cfe39939fcdfcf2a6a
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T161E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtolgeywq.sys

Path C:\Temp\ywtolgeywq.sys
Size 141KB
SHA256 b93d0c8112cf1d69715696c4e0f5027be215d59f4da4b3f2b20400423d310a96
MD5 a652ecb57503de401cb7ae74b75410e0
SHA1 5c01b245a10e4162f6f697b5a4458535f4117261
SHA512 f1f8b6f3f2be61ee15e721dc9d9c4d8c97c9d0cf6582eeeecf95a63d39256c72b20af6e2b28d9ef29c88587502f8ffef40275a1afb9bcc0f07df0145fdc76e67
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhcxrm.exe

Path C:\Temp\zxrpjhcxrm.exe
Size 226KB
SHA256 617775a35c0f24e17529c4e38cb297f7347464331f5dc1e399c1448c1ab59d7c
MD5 3b1e54117114069ba5c39e9e2e72c354
SHA1 87080a6a9fcd51346aa71d5cfc94d6412e6e246f
SHA512 0ca05902c305cbd65bfea80ea69aa345ee79f43433ec503a7245f5063ab7586b751a1c77fc68b3c8ccfda4abb478d5bc893a4063b0a17aaf654bade969a91648
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1DD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b31eeb48517f20904404a6283f6383e84f8eef4a94c6759121e189e9f167e93f
MD5 306d1317948928d5aca908e27092511e
SHA1 c34511e86170c10636884ab75638e189641d3fe8
SHA512 473951e9e5e9ff3ac29faaaad3f3190390a71bd66f83eeb8968097d95b83be243a6db7ca9922a64eb813323ef3483a9d3530939a50dd1ed8d23ac1db43fa0f59
TLSH
T137615F52859052DDF75D0633B5FC1C9B3B308E9821833ED206DBC4BBAA8632EC14E4E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5975b3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5975b3.TMP
Size 3KB
SHA256 2dc21c78c003adf4d89e2682b4a2874c35ef77452b57961265649fd2910808af
MD5 8d8eb9508f9337102b99ca71ad088ff1
SHA1 bdd1286c169f270e5e413117a754420f8f36ce7c
SHA512 b9af99230380563e09544f7d29876fecb4c84c01e0d6693f0fcbc5063056c97be6cfc7f26ad062737caa5b1e02ab5705ef7b948fc7159f77eeefdef67a5521c1
TLSH
T1DC614052859052DDF75D0632B5FC5C9B3B308E9811833ED206DBC4BBAA8631AD14E4E6
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20b28e6942c54a0315080d69e7deef68779cb27ca5d7e602a1a22d3adaf74cd8
MD5 18bd78702b9e8b006081ccd94e24ceea
SHA1 ffda93b9b7e6a07848b1f0f08974a1d83e52c8c4
SHA512 70abd29cdcca9d203c016e8b18ae28fb1c19b99566b70ec67bd0a89da288201b47853fe5ab969c17b5f2b5a03d0e3e31512e0fb365b805a167b4730332d20f0b
TLSH
T132419DF7C2E8866E890156F0AB14BE2BCE1D0915432C3D5AC9E4EF5B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 981dbf71baa620cdb7c74beb40017791170a23e195c07a45709f49093f33651b
MD5 a14b668f3b7a24ab78b18cac8f96428d
SHA1 a8bec04fe649e5042db82da3e31419f824423e83
SHA512 6224c3d70976511ecc686a92dc8954a9a93f3dc71d9e11121daa4a4469083a106fdb1b6db193bd761b229cc50d2e88f6bb64790b6d396001b61f65cb66cbe4d7
SSDEEP 192:sxRZRnCi/fedsKQqrViLzoA8p9t4/g6+WNC1y/YxzqUGGpMkIgDoJ:sxRZki/f8s9eiqo/5H//ULQ
TLSH
T1B832A615AE28A93B8CC7D21DBB55BF53D6F91032A1951F48E6FC8A1C10E76DE221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7edf73a86ad6d94ce19c60ff1f92a109707663aacc1f360364846b6dccb4d838
MD5 1b82d54f47d9633992a016ca3d26cb57
SHA1 9a9e702a109a09afd2936ff15874ecfcc48a73a5
SHA512 afa500fc9a635dc14c5e60783f01791555d0ce15d52e5ee30e18acd99062dd772aef10a38dee69fc6820510f2cee08c6df7d8b887511813883cfb2644f031739
SSDEEP 192:sxRuRnCi/feds6QqrViLzoA8p9t4/g6+WNC1y/YxzqUGGpMkIgtJ:sxRuki/f8steiqo/5H//UL3
TLSH
T13C32A715AE28A93B8CC7D21DBB55BF53D6F91032A1951F48E6FC8A1C10E76DD221780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3cf11f91c05f01efedc53d6b80c5f474e52a795015ceb581a6bdd0f84334c079
MD5 84337eeca3d988327f7feb259d064247
SHA1 9a0d4f7d8f03c5a307a22edbbf9e003ccfbd9d6b
SHA512 ccf1259a411da948aaac512b7f8e9e71a407525dfe6ac29bb9245016e251f27b5661fe97a770f785ae8fafd6d777c6282b62ef47d8c1d8e826d7879a8fdc25a4
SSDEEP 192:sxRZRnCi/fedsKGlZOEzoA8p9t4/g6+WNC1y/YxBqUGGpMkIgDuJ:sxRZki/f8sTLOlo/5H/PUL+
TLSH
T13742CA15AE28A93B4CC7D21DBB55BF53D2F95072A1915F48E6FC8A1C10E76DE221380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d9865bd7ff5a7dc165404cf9074bb32f92824f2cafad93b5308a3a837b1bfe83
MD5 9d1bfe3f707d02c6214aa89857ce2a36
SHA1 e6d5748d6062f12a1a19e6e6f9993bab881d5818
SHA512 6890a3df434cf840d7e8f7df3e1670d13205f3e31ad1ca62ad269398ea04f999c8fd9c392939c8447537ccd6315de38f733eb20589633e571def38185263038f
SSDEEP 768:zBDnLx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU/ZBK3RroxTw:zBDnLnEbYFWgbjfkWu1ja7/Z03qdw
TLSH
T10DD2D87B780CCB7F4F804A9D9C197E9E6DA802CB9698CD4047FE945C02C6BEE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5f575283c4bfbbe9e4dd27a0673ef45244bd4453c5e1dee3debdecf24ac0f7f8
MD5 ca284e8dab5aa09c33d27b50a92a4065
SHA1 55f999e025d80b850df7f2ee27a466b2a95eb314
SHA512 bda3a7586407d9cc7c69210bc0019140a8c23a294cc67f4a57281c7caeb0b889a151e3f3d3292f88002348f3b54de4e074578024452228aa99f5b6a1d9855ab9
SSDEEP 768:h/UxvxjgC+i3Hh9TOfJfktzKJYe1ELsAvC8/YMunSHrkw:0Zj3+i3WfJf7Ye1EQujYbS4w
TLSH
T17503C036EC648D375DF2A388774A5757FEF4812394C45AA886DD2B0D06C73AC630F89A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 92ee97c503c9f3ff164423c77746cbfe1c649df8d66bb6ff7597b61894f0ec24
MD5 1d8382c3dc016da7a6a7661496dc8cd7
SHA1 261a998d6988a9caf4fedb9987440e3ad506f69b
SHA512 0a9f02221f58088ebb6d86033a8c9539e42dd6c3618dcba9faec64a8422eb895dbd57f8d22737656813fb91b59eb49c7465a491ebd59f1452a72cff183a1f337
SSDEEP 768:my3rs9TOfJfktMfU5PyJYe1ELsAvC8/YEwMgVAj:my3XfJfxfU54Ye1EQujYFMg+j
TLSH
T111F2AE71EC64CD771DF6A399B7866713BEF8812394C85A44D2C96B0D04837AE274F82E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 5dc9ca2824ee87e2673eccdcce4900fe614df536c2d2111d227bf803384634ae
MD5 ed00013d7b098b00e2fa1e49823b4cf9
SHA1 954b6c2b6b78cedbf54c5e9bf890e0a44c844a64
SHA512 53237c5ecdb1426abdd5e4cfa85d38907bf8e42a0306f9087801ce46808dc3bcee4af24553478bff6ffa38dbbdcd117a29a8a4932520fb3b70d3e2c3c5a463a1
SSDEEP 768:Mf3P0JOfJfktMfU5dGJYe1ELsAvC8/YEwMgVAj:Mf3xfJfxfU5aYe1EQujYFMg+j
TLSH
T19F0329F198E38976D8AE5387677D6E02ADBCC11375884984F7C51E0CCC826BFD70A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

5f4f5fbc-ce47-425a-abae-86a26a8022bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5f4f5fbc-ce47-425a-abae-86a26a8022bd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5220_954088533\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1696-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2184-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2636-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3260-254-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-370-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4836-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4836-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4972-287-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5800-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6004-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6004-389-0x0000000000010000-0x0000000000083000-memory.dmp

Download