5874c05bfcfe824826b756da1e60a384e999dc2ffd32d3725a925892ee034782

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261014-eee4jsvx6q
SHA256 5874c05bfcfe824826b756da1e60a384e999dc2ffd32d3725a925892ee034782
MD5 df749ab9b6aac87a0dfb966474abb99a
SHA1 006444d6678b66743470cfeecc41be63fb6d9d44
SHA512 fa2cfffe3d3fa56e25386fd3027dbd6417cdcc8047166cbfe64771e63c79527c3d2b9cb87932a642283f69ecbe096855235d02df21d816f5e016ab2181d89ec9
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
480	CP.exe
4172	xvpnidavtn.exe
2004	CP.exe
3872	CP.exe
2928	i_xvpnidavtn.exe
5928	nhfaxspkic.sys
1524	CP.exe
3176	icauspnkfc.exe
4888	CP.exe
2488	CP.exe
672	i_icauspnkfc.exe
2860	usmkecwupm.sys
2412	CP.exe
5524	smkecwupmh.exe
3912	CP.exe
4956	CP.exe
5260	i_smkecwupmh.exe
4376	xrpmhfzxup.sys
4800	CP.exe
1968	rmjhecwurm.exe
3980	CP.exe
5496	CP.exe
2324	i_rmjhecwurm.exe
5792	cwurmjecwt.sys
1832	CP.exe
5528	tromhezwrp.exe
2508	CP.exe
1636	CP.exe
4716	i_tromhezwrp.exe
976	wrojgbztrl.sys
1896	CP.exe
5772	trljdbwtom.exe
5068	CP.exe
700	CP.exe
5348	i_trljdbwtom.exe
1924	igdywqoigb.sys
6080	CP.exe
4788	igdywqoiga.exe
3316	CP.exe
1716	CP.exe
3956	i_igdywqoiga.exe
1268	oigaytqnlj.sys
5808	CP.exe
2572	fdbvtnlfay.exe
984	CP.exe
2528	CP.exe
5912	i_fdbvtnlfay.exe
2476	nifaysqkid.sys
4620	CP.exe
4528	davtnlfdxv.exe
5964	CP.exe
1292	CP.exe
3304	i_davtnlfdxv.exe
6076	xvsnkfdxvs.sys
3004	CP.exe
3488	vsnkicaxvp.exe
3888	CP.exe
240	CP.exe
4196	i_vsnkicaxvp.exe
5648	smkicauspn.sys
3536	CP.exe
4224	spkicausmk.exe
2200	CP.exe
4352	CP.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_2018541750\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1012341113\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_725653205\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_725653205\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_2018541750\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_2018541750\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1096064641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1012341113\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1493042188\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1493042188\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_725653205\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_725653205\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_2018541750\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdysqoiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspnhxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdysqoiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqnifdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icauspnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomkhczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icauspnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomkhczt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspnhxusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqnifdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1360	ipconfig.exe
5408	ipconfig.exe
3564	ipconfig.exe
5304	ipconfig.exe
5460	ipconfig.exe
200	ipconfig.exe
4420	ipconfig.exe
6076	ipconfig.exe
2324	ipconfig.exe
2696	ipconfig.exe
3768	ipconfig.exe
4708	ipconfig.exe
6024	ipconfig.exe
4696	ipconfig.exe
700	ipconfig.exe
4528	ipconfig.exe
3496	ipconfig.exe
4444	ipconfig.exe
3120	ipconfig.exe
5528	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{8FA90F18-00DD-465F-8E85-D44A475F0819}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe
3444	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2928	i_xvpnidavtn.exe
Token: SeDebugPrivilege	672	i_icauspnkfc.exe
Token: SeDebugPrivilege	5260	i_smkecwupmh.exe
Token: SeDebugPrivilege	2324	i_rmjhecwurm.exe
Token: SeDebugPrivilege	4716	i_tromhezwrp.exe
Token: SeDebugPrivilege	5348	i_trljdbwtom.exe
Token: SeDebugPrivilege	3956	i_igdywqoiga.exe
Token: SeDebugPrivilege	5912	i_fdbvtnlfay.exe
Token: SeDebugPrivilege	3304	i_davtnlfdxv.exe
Token: SeDebugPrivilege	4196	i_vsnkicaxvp.exe
Token: SeDebugPrivilege	1184	i_spkicausmk.exe
Token: SeDebugPrivilege	2176	i_smkecwupmk.exe
Token: SeDebugPrivilege	5764	i_cwuomkhczt.exe
Token: SeDebugPrivilege	3568	i_eywromgeyw.exe
Token: SeDebugPrivilege	4312	i_lgeywqoigb.exe
Token: SeDebugPrivilege	4332	i_dbytqoigay.exe
Token: SeDebugPrivilege	3452	i_gdysqoiday.exe
Token: SeDebugPrivilege	6012	i_vsqnifdays.exe
Token: SeDebugPrivilege	4084	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	4836	i_xuspnhxusp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 2408	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2408 wrote to memory of 3444	2408	iexplore.exe	89
PID 3444 wrote to memory of 4000	3444	msedge.exe	90
PID 3444 wrote to memory of 3408	3444	msedge.exe	91
PID 3444 wrote to memory of 4740	3444	msedge.exe	92
PID 3444 wrote to memory of 4740	3444	msedge.exe	92
PID 3444 wrote to memory of 4740	3444	msedge.exe	92
PID 3444 wrote to memory of 3892	3444	msedge.exe	93
PID 3444 wrote to memory of 3892	3444	msedge.exe	93
PID 3444 wrote to memory of 3716	3444	msedge.exe	95
PID 3444 wrote to memory of 3640	3444	msedge.exe	96
PID 3444 wrote to memory of 3716	3444	msedge.exe	95
PID 3444 wrote to memory of 3716	3444	msedge.exe	95
PID 3444 wrote to memory of 3640	3444	msedge.exe	96
PID 3444 wrote to memory of 3640	3444	msedge.exe	96
PID 3444 wrote to memory of 2780	3444	msedge.exe	97
PID 3444 wrote to memory of 2780	3444	msedge.exe	97
PID 3444 wrote to memory of 2780	3444	msedge.exe	97
PID 3444 wrote to memory of 3220	3444	msedge.exe	98
PID 3444 wrote to memory of 3220	3444	msedge.exe	98
PID 3444 wrote to memory of 3220	3444	msedge.exe	98
PID 3444 wrote to memory of 5464	3444	msedge.exe	99
PID 3444 wrote to memory of 5464	3444	msedge.exe	99
PID 3444 wrote to memory of 4300	3444	msedge.exe	101
PID 3444 wrote to memory of 2788	3444	msedge.exe	102
PID 3444 wrote to memory of 4300	3444	msedge.exe	101
PID 3444 wrote to memory of 2788	3444	msedge.exe	102
PID 3444 wrote to memory of 5100	3444	msedge.exe	104
PID 3444 wrote to memory of 3748	3444	msedge.exe	105
PID 3444 wrote to memory of 3748	3444	msedge.exe	105
PID 6020 wrote to memory of 480	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 4172 wrote to memory of 2004	4172	xvpnidavtn.exe	111
PID 3444 wrote to memory of 5192	3444	msedge.exe	114
PID 3444 wrote to memory of 5192	3444	msedge.exe	114
PID 6020 wrote to memory of 3872	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 6020 wrote to memory of 1524	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3176 wrote to memory of 4888	3176	icauspnkfc.exe	122
PID 6020 wrote to memory of 2488	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 6020 wrote to memory of 2412	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5524 wrote to memory of 3912	5524	smkecwupmh.exe	131
PID 6020 wrote to memory of 4956	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 6020 wrote to memory of 4800	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 1968 wrote to memory of 3980	1968	rmjhecwurm.exe	140
PID 6020 wrote to memory of 5496	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3444 wrote to memory of 5416	3444	msedge.exe	146
PID 3444 wrote to memory of 4240	3444	msedge.exe	147
PID 3444 wrote to memory of 5188	3444	msedge.exe	148
PID 6020 wrote to memory of 1832	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5528 wrote to memory of 2508	5528	tromhezwrp.exe	153
PID 6020 wrote to memory of 1636	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6020 wrote to memory of 1896	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5772 wrote to memory of 5068	5772	trljdbwtom.exe	162
PID 6020 wrote to memory of 700	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 6020 wrote to memory of 6080	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4788 wrote to memory of 3316	4788	igdywqoiga.exe	171
PID 6020 wrote to memory of 1716	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 6020 wrote to memory of 5808	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 2572 wrote to memory of 984	2572	fdbvtnlfay.exe	180
PID 6020 wrote to memory of 2528	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 3444 wrote to memory of 688	3444	msedge.exe	185
PID 3444 wrote to memory of 688	3444	msedge.exe	185
PID 3444 wrote to memory of 2860	3444	msedge.exe	191
PID 3444 wrote to memory of 2860	3444	msedge.exe	191
PID 6020 wrote to memory of 4620	6020	2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe	192

C:\Users\Admin\AppData\Local\Temp\2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_df749ab9b6aac87a0dfb966474abb99a_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x304,0x7ffaa0b5c188,0x7ffaa0b5c194,0x7ffaa0b5c1a0
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2209311618225346182,4143289413651924702,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:11
      4⤵
      System Time Discovery
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2461815786103722718,16721411882013964424,262144 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:2
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,4534974262742069277,9832027158641739701,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:13
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,13457814662984518757,5826100948328092905,2097152 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,15410252173009985991,17296749396453376209,2097152 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,10166574211468435210,1880210238620315658,2097152 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16195759790425808518,13867020869663946793,2097152 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:9
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,1489060810734445383,10003962415462607704,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,17953908213579684832,7339171558119075823,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,11058791845977586838,8770199041493313019,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,11926917309004014609,4332869139235979915,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,11926917309004014609,4332869139235979915,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,12605190583863637431,8124377470964127761,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,13436411783802439798,3535658046212515615,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,13284413974132562919,12802804518822111219,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,9517706689676332415,8258667020827154310,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:4240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,18193393110096498970,10285191829696846343,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,15875552124736029129,13917503813929648334,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,17765592045372302795,12727245309580372457,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,3787037365045709381,653018230177861096,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,1249207360480599173,7629297845542223785,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,16258099337974141188,7163951335832511927,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3728,i,17990747661255762404,4715456986831804840,262144 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,9325520225070268643,11610309858267650459,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8813159292902512403,3379143842546271886,524288 --field-trial-handle=2756,i,10718006134387154674,13616963388327247396,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnidavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:480
- - C:\Temp\xvpnidavtn.exe
    C:\Temp\xvpnidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnidavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Temp\i_xvpnidavtn.exe
    C:\Temp\i_xvpnidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icauspnkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\icauspnkfc.exe
    C:\Temp\icauspnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icauspnkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\i_icauspnkfc.exe
    C:\Temp\i_icauspnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2412
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhecwurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\rmjhecwurm.exe
    C:\Temp\rmjhecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhecwurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5496
- - C:\Temp\i_rmjhecwurm.exe
    C:\Temp\i_rmjhecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tromhezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1832
- - C:\Temp\tromhezwrp.exe
    C:\Temp\tromhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tromhezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1636
- - C:\Temp\i_tromhezwrp.exe
    C:\Temp\i_tromhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1896
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6080
- - C:\Temp\igdywqoiga.exe
    C:\Temp\igdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\i_igdywqoiga.exe
    C:\Temp\i_igdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbvtnlfay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Temp\fdbvtnlfay.exe
    C:\Temp\fdbvtnlfay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbvtnlfay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\i_fdbvtnlfay.exe
    C:\Temp\i_fdbvtnlfay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4620
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkicaxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Temp\vsnkicaxvp.exe
    C:\Temp\vsnkicaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkicaxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:240
- - C:\Temp\i_vsnkicaxvp.exe
    C:\Temp\i_vsnkicaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmk.exe ups_run
  2⤵
  PID:4192
- - C:\Temp\smkecwupmk.exe
    C:\Temp\smkecwupmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmk.exe ups_ins
  2⤵
  PID:5768
- - C:\Temp\i_smkecwupmk.exe
    C:\Temp\i_smkecwupmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomkhczt.exe ups_run
  2⤵
  PID:5972
- - C:\Temp\cwuomkhczt.exe
    C:\Temp\cwuomkhczt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomkhczt.exe ups_ins
  2⤵
  PID:5532
- - C:\Temp\i_cwuomkhczt.exe
    C:\Temp\i_cwuomkhczt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywromgeyw.exe ups_run
  2⤵
  PID:1268
- - C:\Temp\eywromgeyw.exe
    C:\Temp\eywromgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywromgeyw.exe ups_ins
  2⤵
  PID:3276
- - C:\Temp\i_eywromgeyw.exe
    C:\Temp\i_eywromgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  PID:5660
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  PID:3220
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytqoigay.exe ups_run
  2⤵
  PID:4052
- - C:\Temp\dbytqoigay.exe
    C:\Temp\dbytqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytqoigay.exe ups_ins
  2⤵
  PID:4844
- - C:\Temp\i_dbytqoigay.exe
    C:\Temp\i_dbytqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdysqoiday.exe ups_run
  2⤵
  PID:5804
- - C:\Temp\gdysqoiday.exe
    C:\Temp\gdysqoiday.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdysqoiday.exe ups_ins
  2⤵
  PID:2844
- - C:\Temp\i_gdysqoiday.exe
    C:\Temp\i_gdysqoiday.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqnifdays.exe ups_run
  2⤵
  PID:976
- - C:\Temp\vsqnifdays.exe
    C:\Temp\vsqnifdays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqnifdays.exe ups_ins
  2⤵
  PID:5100
- - C:\Temp\i_vsqnifdays.exe
    C:\Temp\i_vsqnifdays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxspk.exe ups_run
  2⤵
  PID:1240
- - C:\Temp\vpnhfzxspk.exe
    C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
  2⤵
  PID:4880
- - C:\Temp\i_vpnhfzxspk.exe
    C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xuspnhxusp.exe ups_run
  2⤵
  PID:3360
- - C:\Temp\xuspnhxusp.exe
    C:\Temp\xuspnhxusp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xuspnhxusp.exe ups_ins
  2⤵
  PID:3264
- - C:\Temp\i_xuspnhxusp.exe
    C:\Temp\i_xuspnhxusp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5720

C:\Temp\nhfaxspkic.sys
C:\Temp\nhfaxspkic.sys
1⤵
- Executes dropped EXE
PID:5928

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\xrpmhfzxup.sys
C:\Temp\xrpmhfzxup.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\cwurmjecwt.sys
C:\Temp\cwurmjecwt.sys
1⤵
- Executes dropped EXE
PID:5792

C:\Temp\wrojgbztrl.sys
C:\Temp\wrojgbztrl.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\igdywqoigb.sys
C:\Temp\igdywqoigb.sys
1⤵
- Executes dropped EXE
PID:1924

C:\Temp\oigaytqnlj.sys
C:\Temp\oigaytqnlj.sys
1⤵
- Executes dropped EXE
PID:1268

C:\Temp\nifaysqkid.sys
C:\Temp\nifaysqkid.sys
1⤵
- Executes dropped EXE
PID:2476

C:\Temp\xvsnkfdxvs.sys
C:\Temp\xvsnkfdxvs.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Temp\smkicauspn.sys
C:\Temp\smkicauspn.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:3744

C:\Temp\wuomkhbzxu.sys
C:\Temp\wuomkhbzxu.sys
1⤵
PID:3548

C:\Temp\eywurmjebw.sys
C:\Temp\eywurmjebw.sys
1⤵
PID:5984

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
PID:4724

C:\Temp\olgdyvtroj.sys
C:\Temp\olgdyvtroj.sys
1⤵
PID:5352

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:4524

C:\Temp\aysqkigays.sys
C:\Temp\aysqkigays.sys
1⤵
PID:6036

C:\Temp\fcavkfcxvs.sys
C:\Temp\fcavkfcxvs.sys
1⤵
PID:5012

C:\Temp\xusmkicaus.sys
C:\Temp\xusmkicaus.sys
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurmjecwt.sys

Path C:\Temp\cwurmjecwt.sys
Size 141KB
SHA256 b9bdba751407093b1e8c98739449fe7f9a7ba558c0187d2e71fbca6f3679eabd
MD5 aad3fcbd886e0b1885d85ce1b75c192a
SHA1 50f24a9aa2baded4996c113005bd088ef9f696a6
SHA512 dd8a85bbe5f23d08acd437219ac764ef97e1aa4680de3fd2dcb07006e7f85590449bed5d6549826797a52bc67ebe0913bb5ed7d513f2108a5a40b01df4ee10cf
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17FE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icauspnkfc.exe

Path C:\Temp\i_icauspnkfc.exe
Size 226KB
SHA256 853598ef19f81ad14aeb32e9d9e4758b32f5a9752d4a2cfc5008bcb844d5ea26
MD5 be5e93cf838e9a071e4e979b2f99fa58
SHA1 b8e2095776abc9165dd4462b66cc652a7ae048d0
SHA512 c5b9df1bd5e7291e23d2a755c6cae17ba29dc5e95ca8dae6bb4e68462fdf3f4c2b09932ad07b9ff114081c0e491286e22b402c8f8d2c871f282c14275ccec223
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjhecwurm.exe

Path C:\Temp\i_rmjhecwurm.exe
Size 226KB
SHA256 58302658808573cadc1017214f582a7189a6d189eef02e1cf1aea3c1ab2c31fc
MD5 b34da30f3c6aab40960c7063fd2856bb
SHA1 fa750ca9c46fea289145b14a71ad6a5d1bbfbb05
SHA512 5d98f45fd1383c3c3594c14e45d58cbae8690e2b1bba8baf4d32de1dfa94a7d63d516223143add971db5e88558732e6e8225febdc005cd4084dc82af03d4c496
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T12A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecwupmh.exe

Path C:\Temp\i_smkecwupmh.exe
Size 226KB
SHA256 38c909ba0edfbd3b57f1edbbff2908f9168b02899066f1cc57a495bd2aafd499
MD5 5b8c982a795648ef686ee436de500ea9
SHA1 d3852b4ed42d0e5ecb6e14375eb78b560ceda151
SHA512 8f42c469481295a787e945c418a493be21ccc7a59896a5bf8c14c4ca077c7786f14a03e1d2c0027f402dde0f535777675c7d149a07b29d0ed64af2ccf4cfaf62
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T15934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtom.exe

Path C:\Temp\i_trljdbwtom.exe
Size 226KB
SHA256 52f5e4c28d53c3af33731be757fc3bc151a9f3ae9e8235165ee4819129a85b44
MD5 b7e630301acba09a9d6c2eed91b0078e
SHA1 e45f15889c33aa30381e04c4f0a2b6b85fab78a8
SHA512 56c6bf09afcc78cc3a33ae0038e9909a33124fed62c93b4e8d80498847811d3d0085b77d72344bc653e459ce49191b74e306cabd19a4420ed394157daf9b54c9
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1E234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tromhezwrp.exe

Path C:\Temp\i_tromhezwrp.exe
Size 226KB
SHA256 53ca9166d0035f70f73248396c8ad4e225de3ce30aaa041e22a8ecb923fb57a0
MD5 a0411ff1c08b2d84a3c258cd848ac009
SHA1 be3fecf9c29ccd81c18929d0518c048e127d9d26
SHA512 03a9339911c9efda2af5310be0718362138214e33a76253a51c99069c6aceb6fe1bc66b7da021db59c3b9750d490e559f3705fc3a2d5d9f9ee362078adc45a60
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T11434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnidavtn.exe

Path C:\Temp\i_xvpnidavtn.exe
Size 226KB
SHA256 160527c6c2cc56858e20f1adbd3a1be2e1c10f44bd00c9b52705a26a889481b7
MD5 adfc2b22a89edeb7003fc2e876f9c84c
SHA1 f9bbc15633451ead2c87ef1025501ef174881936
SHA512 1d2a794cfee07b370ef16c442408880bfea33721763318bcca1f3264416e4bab422e4be546abffbea252613af2537114a16d59d151cd82bb3f822f31128b0200
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icauspnkfc.exe

Path C:\Temp\icauspnkfc.exe
Size 226KB
SHA256 0d17a944c20ce921ef53086c954ea8ede36b8be229229c141cee41de4b77fb02
MD5 005357725f4381ed1e5265fefb2c58b9
SHA1 817e4fa5f025b16964f3ac882ed1ad95d4b53046
SHA512 a0dd1e730a9110548e5fb944b2bc19abe7121f0997fbef4c06a6783c9134665281bda4e0e5c21c23d4a98d2960453904fa71f450f109b1729cb419bcf6c88e5f
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoigb.sys

Path C:\Temp\igdywqoigb.sys
Size 141KB
SHA256 a4b139b70ad885f658a73a48030b0e46f2d383470d5c6fdb9a05a38459e59b68
MD5 a89be2015e086224598587f08a52f329
SHA1 39a9dad71aca0cb557f66e71fe8ee2ec0d5ed895
SHA512 2994b4e065fd63d850066b273381fd107ad81c46011b45f80a40eb3ccb07969c1b6497eff0b9ecdd642a163f72f73c98b5b870660a59347831fef63d693bd92d
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T107E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.sys

Path C:\Temp\nhfaxspkic.sys
Size 141KB
SHA256 b73d536ba0564569285d28bf39ff4d85800dfba1ffc8157a3a9b6e62c9cb4832
MD5 5ecd24c6ea5a55a75d819425ce0ff292
SHA1 f580005092900f376bdabd5590065faa83d8e727
SHA512 b7d2449b8ee6d6f75bc315c8f7bbbec638b84b1b747a5ad95e5be300e5f4302e5c7112407709291d28f42e5b7fc6a1da63c0d2f0ca54dfbcea21797df4ed0321
SSDEEP 1536:5da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXl+:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhecwurm.exe

Path C:\Temp\rmjhecwurm.exe
Size 226KB
SHA256 2ac5b6b92216c0160c6da4af1b2ed76db80f1af86a68942da4c2c160c6661eb1
MD5 1cb4a2a9fd0646fcc549439b5a41f7d5
SHA1 f50f0b48b05c92c2783621f542938241c78c1d87
SHA512 48741df280001ee5d78294bef422396fc86df7f6c88ebd2fe2cecee80f287a6f5894b7d5f2d8e635fcbbf05512fa4f30d4f6dda8cf80f6b9dff4f346613d22a9
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T11B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecwupmh.exe

Path C:\Temp\smkecwupmh.exe
Size 226KB
SHA256 36197bbd394f7cc51d08c03b4c23836abfbcf67d3a3f57c8aeda7982ace41b89
MD5 a3c19121ee4de3b22de1c42cf69e954c
SHA1 5343ac7d784cda70cb08a0b3dd758ce9ff2d8a9b
SHA512 57ae32e8acae10dde4fa38f539aab1570ef0b4371d26f5ffe4e6e09a87da4d310fd159accffdfb3a8d0c5cdf8883f072c027a44a5c63ae1e3868f17f0463c1a8
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1FE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.exe

Path C:\Temp\trljdbwtom.exe
Size 226KB
SHA256 43facba9dfd86168f03feaf93298931b78ffff1c2416d00ef754124e3ddbb423
MD5 6fb6a2c9f947b2aa2d14f42a2316616c
SHA1 231a619781c8eb2b1fb78375587c2e183abbc04a
SHA512 0068d67e5b6477bd5745670fe3a0ac83a392bba886bbb4548bdc0d0d3feda82ac638d620ad4fe5e9e0ac590ad7a09b3f53d63cd2566faf1057b453f9655c314f
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1EA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tromhezwrp.exe

Path C:\Temp\tromhezwrp.exe
Size 226KB
SHA256 4fe82ca3d75537312055f3c210f1a3aade52a0dbb0c331c85de76dd18d1e838c
MD5 4f635ea909208b47d041adb3cdf989c8
SHA1 ecd98d1f580568b4a50fabd1e379326e345e23d8
SHA512 3fc40f741638a894600cc540159ff6883cb83fe3802343a71588c803b554856417ddeab3da0ba64866212700e2f981e3ac2613fc42f5e7c4789944fe4367b528
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T17D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.sys

Path C:\Temp\usmkecwupm.sys
Size 141KB
SHA256 24f4df3f6d16dd069b3e789d684621e1a825df679e97bbe21c0c843c194270d0
MD5 f7e20a8aa11acbb3263c2e442a4f7a3a
SHA1 f16b84d61267c8b5d9c0c9487e0464aa1d781623
SHA512 7388929c5efb60b2dd05f97d5d28fad088a2a733d37369e01c1a37c1fd16c3fc5aca927667cd473d8e59395fb2408ffa50713842df2925e9b8e1049d0522bb05
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T166E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbztrl.sys

Path C:\Temp\wrojgbztrl.sys
Size 141KB
SHA256 726c61a737e5b6a251568a3eab52a7af6be20bceabfcfce425a51afd2613ba1c
MD5 ede270e01c6156eb5d33ecd0ca1aa523
SHA1 48cecf0be0192c191bb40ae132580e31113c4213
SHA512 1b60be965061ee9bab00340b87a77968970febae0472533a93015765ca796947786f9dbb629cb0f4ecb5417fd0a63ca3e7cb0d7a5de353e7b0f91f04bb63d6ff
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmhfzxup.sys

Path C:\Temp\xrpmhfzxup.sys
Size 141KB
SHA256 e04fba8ae742b65c7b282ddb0e73288691f31e997dd23a958f5199f93df1c394
MD5 093812c9beacab9b1d4ff888076835f4
SHA1 622e7126e59eea00aa97cfd177e3abc15bc721f0
SHA512 eb02e3b088bb90da43d5465a393651a138807281d23eb8d5e903993b1ad0cc7b0ec24e5e4460fabff15433d369beeb016a32880682c5452f490007c27df95f2e
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnidavtn.exe

Path C:\Temp\xvpnidavtn.exe
Size 226KB
SHA256 a99111ba591306d3d6f5cc0854f078886323acfed73634e7f1fb1801e960bbf7
MD5 46301dcb6b05ba81dc83df81686bc661
SHA1 370d6d33324f8b65c30b48c525233afb4e01597e
SHA512 4f57831c47d51be58ebedf7b586d179c590179ea948953a1e3fec1dba8190253a9a4399d2f36fee5b48cfb49d3c07a49824f93a62f471a20c509845145ee9e5b
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1E034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c6d25e8-4c7f-461c-8ead-c16bff5de702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c6d25e8-4c7f-461c-8ead-c16bff5de702.tmp
Size 33KB
SHA256 c137f32f8a3fc67e31a5f4b3572112ab08dafb627edf22bb90c7a59c48899ee5
MD5 31be165c81eea1e78040c35c76d132ef
SHA1 67ae7c058bc0054fffacf01435da5d3441371aa6
SHA512 ea74d45e85127ef7833141bd9f0ffbcefc55ecb258f680572dc2b931fb695516d83292954534aec4530f8a3da33119b634a1e2ab91dc05b5da1ec88d212f7eda
SSDEEP 768:w43/EbIac7fZrKwmp5XSwQs88uBkiT2ZykJCCx:w43/Ebutr0ILNBgyQX
TLSH
T1ECF2C075FC95AD73ACA69382768637026FF06157E8C40B48C5EDA61E008376E374BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95df89c5-6c67-48bb-bad0-81d446da859f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95df89c5-6c67-48bb-bad0-81d446da859f.tmp
Size 42KB
SHA256 c492a17d04db8ad755cc42f50f761ec66bca19f68fd6b181821d53a447481dc2
MD5 0c3d06b8090f3f0589bf17b050040484
SHA1 7a06b21de1f67b6973146f09937f7b29010c74d5
SHA512 ef1acd51770550d69ea6a926d70a4b5581efdcbfc02ae825f173621da83f1cc4f303f5b42890983b6fdac21ed77db2ab92ecc2a3212c6714d47a355631f06c12
SSDEEP 768:W/FQm3Rwg9Ebnq5erK+bmp5XSwQs88uBkiT2ZykJCCx:3m3NEb7rrcILNBgyQX
TLSH
T1351338F598D39976E8AE4783677D2E025EFCD153B4840984B7D85C0DCC822BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

0eb5c975-ac6c-4175-be3f-1eb52ab5d9f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0eb5c975-ac6c-4175-be3f-1eb52ab5d9f9.tmp
Size 12KB
SHA256 016399c04493fbbe2f678e0b81e594b5855aa73500f288f4938304950699bebb
MD5 11fcf4dcb26cf83a45144941d6bec9d7
SHA1 2791709759b0090c664a7f508aaf2eebbc4c93e1
SHA512 b6e7b904e0cdf2d8bd3f2f3c1b46c23c6c3e0b5c9439f1c315fd2a52e7125fd5e698d514400e5dc034d6b078e7262073f203d25ce8bb163de321caec080caf6a
SSDEEP 192:sxRNRLCF/fDsTbZ8zQLEKzoA8p93/g6+WNCi21/YEcYnGwIgDDPVuBnJ:sxRNcF/fDsTV8zQoHR/5e1/J9uT
TLSH
T1C742C815AE24A97B8CD7D619BB65BF53E3F85132A0811E4CA6FC8A1C04E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2728b95e-2b9e-445d-b155-322ea7b860e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2728b95e-2b9e-445d-b155-322ea7b860e7.tmp
Size 12KB
SHA256 26849d92aede7430690ee47071a3abb06c4df0965ec87718defb1eabb1a39365
MD5 f9060680fe631118b9f2f4049a76a0fc
SHA1 ceb43f8975f607d5573712f9402b75cb5b016ec1
SHA512 01d2c98ff02642a966d313ce582cd0ddc7da9e39587e39096a3ac62e6cc0aa0046986a41f1bec7e6627f4df14a68897a1afe954900fdf7999190d0118bfb7cd4
SSDEEP 192:sxRNRLCF/fDsCbZ8zQLEKzoA8p93/g6+WNCi21/YEOQnGwIgDD1VuBnJ:sxRNcF/fDsCV8zQoHR/5e1/5buT
TLSH
T1C842C915AE24A93B8CD7D619BB657F53E7F85132A0911E4CA6FC8A1C04E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49cf1a70-84a7-4b08-a44c-f0649c56857f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49cf1a70-84a7-4b08-a44c-f0649c56857f.tmp
Size 11KB
SHA256 a537bfc5bdec1f5c68e70aae6b10b4ab300ac0cda672e00c6e80f84530da8e9e
MD5 3ad7646fc7c8ce5afb023532a88b49cf
SHA1 8b7ce6ee13444c9a77545e0632b4de020dc03e1e
SHA512 85c0d17b9a06122c961c1c43008eceeb36a1606c03fe8a53dd35539142b2b3719082ebd605acab62485f999e082f076ed2f73dee45b48ef8f115536a74b7d380
SSDEEP 192:sxRyRLCF/fDsRbZ8zQLEKzoA8p93/g6+WNCi21/YEOQnGwIgVVuBnJ:sxRycF/fDsRV8zQoHR/5e1/5buT
TLSH
T1AD42C915AE24A93B8CC7D619BB657F53E7F95132A0911E4CA6FC8A1C04E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59902f85-9b88-483d-9308-b7b0a2cf4368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59902f85-9b88-483d-9308-b7b0a2cf4368.tmp
Size 29KB
SHA256 13232f20077062fabbacc616369a2a36a659de5ff40af88f698f82b2ba227366
MD5 dd7f23838a9a9c7487e445e12b049aa1
SHA1 cf8c785ff1c846488cd0ae50cd9f4012e6065421
SHA512 e0a873a9bf1b32ffd549010dc1f33a13bca4415cfe601ca79c6bc040828ea3c5eb3571191ba839ac6ec691d6833652db84a559d222242d23b843f583f7b0b480
SSDEEP 768:U/pC0x7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCIuyhp/roJZ:U/pC0nEbLmWg8KfrLu1jatIu8ps3
TLSH
T176D2E97B740CCB7F4F804ADDA8197A9B6DA902CB9A98CD4047FE941C02C77EB91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b659ba0-e7d2-4223-97a7-1ea426bf83f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b659ba0-e7d2-4223-97a7-1ea426bf83f4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f78615af61724078c67fe65ea79f6d82f772d11908c0bfcdf10701935d9456dc
MD5 a78b1cab6990b027a54c5d97f987fc8a
SHA1 8897209f0a9d079b67fa531c81bac487d25344d9
SHA512 2d88265ccb365271526865c4fd77d632498a0e87491994b0e70d7ea7c6dfcaf53f39bd3dc0a1fede604ae6e879f4eb7d3b19526d21761aca49a358214bd7147e
TLSH
T1B1E026E646C8C22EE30DEA8B01A85B4CC380375E93C0AA1F2740C5D875CA384F2837E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 3f01c05f1b7fb0671c35a84d513fa60faec29a2bb3a16c07f8f1a4217f0cb976
MD5 e2a7a7078bd86834126dcc5776a7a3a6
SHA1 8820cbcfcb4e6a9693ca5d03914dd7d749aa9fe2
SHA512 cbd51792c8528f7b5ec1e6ec65bfdd9639a9f07497390cab5b0b9980f2b61d7a7aeae70179d7cb301a377d96c5d5475b44a018ee3d3d08c0e80c5d71abbb0d1f
TLSH
T13241C9828AC40044E7AE26F985EE3B733AB854BF4E731E012D68C876635776441C2B6C
MD5 SHA1 SHA512 TLSH

Submit Download

a8dbab13-e2f6-4b5a-be06-39e4b1e75911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a8dbab13-e2f6-4b5a-be06-39e4b1e75911.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7db101b3-63e9-439b-8ce5-3893508f1489.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7db101b3-63e9-439b-8ce5-3893508f1489.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e0ee663d-73f9-4c17-8cdd-44e2a759b9d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0ee663d-73f9-4c17-8cdd-44e2a759b9d3.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ea6605b6-1614-47a9-89f2-7dcb97a0844a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ea6605b6-1614-47a9-89f2-7dcb97a0844a.tmp
Size 2KB
SHA256 42d59f184c3215f617bc7c0bd7df7ba833bd558f18370f082834746f6057db68
MD5 71052762bf38ea6ab2d808fb7d8c84cd
SHA1 386d326ddcfa6f4db15f591bf7a0eef1888a4d99
SHA512 40ecda12028b6d9f0baa7881ba1dbed87c2f7848f22e333993e5a5f9fb0987a95305b5d44865f92c11f455a1378eaf16712b1148cbedd34646007834aaff9ef7
TLSH
T19B41AFF783F4866E8A0156F0AA14AE1BCE2D0515432C7D5A85E49E2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f1bff5ca632faba37b7005c795e2d8e498a58aef505730e6c5a5c575b27b9da9
MD5 de4c74d6c608150bdfb0d390b4fb581c
SHA1 30846338e52caa90fa7e4697331acccc47705b4a
SHA512 0a9f60e4904d601b29f7ad4a24bfc9d47b27f999919aefef44d517c2c4a6d0f9eef383d69f9f2711460c9c2fa5b59c316dfb9e5facce309b13f03493e68efaa3
SSDEEP 48:KbwIDKFqcDyBGI3KP6AOA7EgSaq2oaF9IHg2KCTqm2WYm1d2AnyY4T84K5:KbwgKFqyiGkKP6ElWKmgqx
TLSH
T10591508071BF020678BD6A494075C72A4A8275B37069E57B7BBC40B64E2FE046DFDEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb481c6c-479f-43a0-ac78-bd54b24ecd41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bb481c6c-479f-43a0-ac78-bd54b24ecd41.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3dca5b0-a197-4995-9f6b-3798a71f26f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a3dca5b0-a197-4995-9f6b-3798a71f26f8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccb16fa4-eaf8-40ab-ae8e-27d570ac40b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ccb16fa4-eaf8-40ab-ae8e-27d570ac40b5.tmp
Size 37KB
SHA256 3e8905b571b72fd8a6eb5cf23e12de7a981b5b4e6786d0ff49e2d7d70fd93692
MD5 19b3bf2e3ea159ad3c193364980751cd
SHA1 1f72723a79ed60b259f13950619bb90c077ec8aa
SHA512 c3a9a8b8a9d7c40a2384eac7fdad00f3ae74055c3305284752c390b8a6556be8106d3522d60d0ee079b6a52836bec1bf3614bd23d515b7fc792499f730125ce7
SSDEEP 768:R/UxvxjgC+W3DOgc7fZrKrp5XSwQs88uBkiTCr5Z/P84g:kZj3+W3DetrgILNBa5ZHg
TLSH
T13603D039EC946873ACB39385365A275BAFF06153C4C41B9849EE7A0F028B35DA707C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64fe3f45-e125-4660-b6c7-afdb27695af1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\64fe3f45-e125-4660-b6c7-afdb27695af1.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

7f561d63-2ce3-443c-b972-eb1c740f9dcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\7f561d63-2ce3-443c-b972-eb1c740f9dcc.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

8344dcc4-730a-4e7b-bc61-2cab21720640.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8344dcc4-730a-4e7b-bc61-2cab21720640.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

d6a339c3-4472-4713-94e7-e5452add288c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d6a339c3-4472-4713-94e7-e5452add288c.tmp
Size 40KB
SHA256 bf5c2e0c8080cb6c58d40a91e739e19c1a01b66a0cd9382f383fb3ecf166dcf1
MD5 7a3a2ea0f2a96277fe6c498c33450bab
SHA1 c9d79a1344292bfc0a92bb5f446de61510129bcf
SHA512 e0ae8156eff348e6a17137ce6296e30923b8f03642ad0816d56858aeb846b1eaa0211f07c672ba8556b1c4f698da21da6e79227e6323bf3d43f8b37a4f0a2bf9
SSDEEP 768:F/UxvxjgC+p30Ebyac7fZrKfp5XSwQs88uBkiT2ZykJCCIo:oZj3+p30Eb0trUILNBgyQio
TLSH
T1DE03D039F8956D63ACB39341764B2787AFF02157D4C00A9C89EE6A0E01C339D674BC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e2cdf751-d4d2-432b-abde-f6986c6ce50a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e2cdf751-d4d2-432b-abde-f6986c6ce50a.tmp
Size 33KB
SHA256 5672eb0ce275053f3a211a8ea0a17c6173f2d44c00a46e55d16be327bce26afc
MD5 9b9b9ae17ba5df7088c02a0eb10102b8
SHA1 56ff2402e328a6e5bd0888efa73d9a61b6416269
SHA512 70eb786348baa9d4b4739c79dd9d1d3efe5c75377f51dc24df29b313fb9c56758bc68e7503eee6a40888394266559b1fc9374e9b3e2f0e9a339e9b6c6887f948
SSDEEP 768:543GEbIac7fZrKwmp5XSwQs88uBkiT2ZykJCCx:543GEbutr0ILNBgyQX
TLSH
T185F2C075FC95AD73ACA69382768637062FF06157E8C40B48C5EDA61E008376E374BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20edd068-6df2-44ed-bc44-bb573f6295a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\20edd068-6df2-44ed-bc44-bb573f6295a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ffc31e22-8b7e-4106-a2cc-e0f4579f2888.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ffc31e22-8b7e-4106-a2cc-e0f4579f2888.tmp
Size 38KB
SHA256 181cea498ebf0263b7915394898af46e6cd404ee83ce233585ceca279709449b
MD5 abe4408832f0de1906881cf6ffaec044
SHA1 6b9069c4551d65876910430469c396ce6835a927
SHA512 258132bbef76a743cdf3f88d0cd68cc9e42b18ed0cda3b6a678be8c6c1f0cca94d0d7af31eccb3530fe42b28eaa5db281c6a5f96ae0a92acd871596fc340dd22
SSDEEP 768:o/UxvxjgC+W3jnkc7fZrKfp5XSwQs88uBkiTzZ/P84g:1Zj3+W3jvtrUILNBXHg
TLSH
T19E03C039F8945C63ECB39351365B279BAFF02193C4C00E9889EE6A1E018735D7B4B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02c577b2-2aa4-4fe8-b6f9-6c8581dfe6e1.tmp

Path C:\Users\Admin\AppData\Local\Temp\02c577b2-2aa4-4fe8-b6f9-6c8581dfe6e1.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6bc2393-9d45-42cb-96ad-1927a18bca1b.tmp

Path C:\Users\Admin\AppData\Local\Temp\b6bc2393-9d45-42cb-96ad-1927a18bca1b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3444_2057110775\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1012341113\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1096064641\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_1493042188\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_2018541750\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3444_725653205\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/976-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/976-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1268-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2476-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2476-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2536-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2860-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2860-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3548-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-403-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4724-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5648-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5792-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5928-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5984-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5984-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6036-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6076-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download