40a0518dd104de825d66cc4d656aa9b2b1176ff4e56770527c90095af24f062c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe
Size 243KB
Sample261003-mtgjxsysbt
SHA256 40a0518dd104de825d66cc4d656aa9b2b1176ff4e56770527c90095af24f062c
MD5 6bec39ad3bfa3ece3f624a9bc90d2240
SHA1 66d28ad5b49bf3ed88c9aa0196b25c9eba6b43b8
SHA512 333fa7c70b1a4e25a325ffa28053d3e5e1575e11a55a0bdc9ef862bc1ac5eaa33237a8ba4a7dd04c555adaa72c1ffec9cff48328db7369cc04f9c92e6eca4f1e
SSDEEP 3072:aBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:yb3TfLAUa3lLNngoqRttA7+
TLSH
T10834490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5980	CP.exe
1808	mkezupkezx.exe
5236	CP.exe
2572	CP.exe
1232	i_mkezupkezx.exe
2868	hbztrmjebz.sys
2060	CP.exe
2772	bzuomgezwr.exe
2100	CP.exe
3992	CP.exe
2276	i_bzuomgezwr.exe
1836	gbywrojhtr.sys
1084	CP.exe
2072	wtrljdbwto.exe
5200	CP.exe
4848	CP.exe
4608	i_wtrljdbwto.exe
5680	ebwtomgeyw.sys
5124	CP.exe
1724	bytqljdbvt.exe
5740	CP.exe
3304	CP.exe
944	i_bytqljdbvt.exe
3852	dbvtqligay.sys
692	CP.exe
3580	yvtnljdbvt.exe
1080	CP.exe
2576	CP.exe
5368	i_yvtnljdbvt.exe
3460	davtnlfdav.sys
4680	CP.exe
5168	dxvqnifaxv.exe
6132	CP.exe
5800	CP.exe
6084	i_dxvqnifaxv.exe
5392	igaxsqkica.sys
2328	CP.exe
1992	snhfdxspki.exe
1052	CP.exe
4184	CP.exe
4364	i_snhfdxspki.exe
3080	caxspkicau.sys
264	CP.exe
5784	fzxspkhcau.exe
236	CP.exe
4228	CP.exe
5484	i_fzxspkhcau.exe
6140	fzxrpjhczu.sys
2276	CP.exe
5080	eczusmkezu.exe
3084	CP.exe
4544	CP.exe
3268	i_eczusmkezu.exe
4692	hezwuomjhb.sys
3908	CP.exe
1684	gezwuojhbz.exe
4504	CP.exe
5456	CP.exe
5192	i_gezwuojhbz.exe
4412	wuomhezwro.sys
4936	CP.exe
3180	jebwtomgbz.exe
4212	CP.exe
4856	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1343837771\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1255982143\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1255982143\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_779583564\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1040410129\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_779583564\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1040410129\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1040410129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1040410129\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvtnlige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snhfdxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvtnlige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkezupkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snhfdxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkezupkezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqomgebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqomgebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4772	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3336	ipconfig.exe
2044	ipconfig.exe
2560	ipconfig.exe
6084	ipconfig.exe
1684	ipconfig.exe
4120	ipconfig.exe
5068	ipconfig.exe
6084	ipconfig.exe
4548	ipconfig.exe
4908	ipconfig.exe
3556	ipconfig.exe
3616	ipconfig.exe
4596	ipconfig.exe
3948	ipconfig.exe
5000	ipconfig.exe
2188	ipconfig.exe
3048	ipconfig.exe
1216	ipconfig.exe
2388	ipconfig.exe
3732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{F6555F3A-07ED-4DD4-AD62-7E947AFECAE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6104	msedge.exe
6104	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	i_mkezupkezx.exe
Token: SeDebugPrivilege	2276	i_bzuomgezwr.exe
Token: SeDebugPrivilege	4608	i_wtrljdbwto.exe
Token: SeDebugPrivilege	944	i_bytqljdbvt.exe
Token: SeDebugPrivilege	5368	i_yvtnljdbvt.exe
Token: SeDebugPrivilege	6084	i_dxvqnifaxv.exe
Token: SeDebugPrivilege	4364	i_snhfdxspki.exe
Token: SeDebugPrivilege	5484	i_fzxspkhcau.exe
Token: SeDebugPrivilege	3268	i_eczusmkezu.exe
Token: SeDebugPrivilege	5192	i_gezwuojhbz.exe
Token: SeDebugPrivilege	1336	i_jebwtomgbz.exe
Token: SeDebugPrivilege	2404	i_wqomgebztr.exe
Token: SeDebugPrivilege	4456	i_gayvtnlige.exe
Token: SeDebugPrivilege	2284	i_igavtnlfdy.exe
Token: SeDebugPrivilege	4908	i_ausnkifdxv.exe
Token: SeDebugPrivilege	5484	i_sqkicaxsqk.exe
Token: SeDebugPrivilege	4692	i_xusmkfcxrp.exe
Token: SeDebugPrivilege	2896	i_usmkecwupm.exe
Token: SeDebugPrivilege	4920	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	6140	i_jebztrojge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4248	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	88
PID 4248 wrote to memory of 5064	4248	iexplore.exe	90
PID 5064 wrote to memory of 1620	5064	msedge.exe	91
PID 5064 wrote to memory of 2532	5064	msedge.exe	92
PID 5064 wrote to memory of 4772	5064	msedge.exe	93
PID 5064 wrote to memory of 2532	5064	msedge.exe	92
PID 5064 wrote to memory of 2532	5064	msedge.exe	92
PID 5064 wrote to memory of 2916	5064	msedge.exe	94
PID 5064 wrote to memory of 2916	5064	msedge.exe	94
PID 5064 wrote to memory of 6136	5064	msedge.exe	96
PID 5064 wrote to memory of 6136	5064	msedge.exe	96
PID 5064 wrote to memory of 6136	5064	msedge.exe	96
PID 5064 wrote to memory of 1780	5064	msedge.exe	97
PID 5064 wrote to memory of 1780	5064	msedge.exe	97
PID 5064 wrote to memory of 1780	5064	msedge.exe	97
PID 5064 wrote to memory of 4544	5064	msedge.exe	98
PID 5064 wrote to memory of 3172	5064	msedge.exe	99
PID 5064 wrote to memory of 4544	5064	msedge.exe	98
PID 5064 wrote to memory of 4544	5064	msedge.exe	98
PID 5064 wrote to memory of 3172	5064	msedge.exe	99
PID 5064 wrote to memory of 3172	5064	msedge.exe	99
PID 5064 wrote to memory of 2960	5064	msedge.exe	100
PID 5064 wrote to memory of 2960	5064	msedge.exe	100
PID 5064 wrote to memory of 3888	5064	msedge.exe	102
PID 5064 wrote to memory of 3664	5064	msedge.exe	103
PID 5064 wrote to memory of 3888	5064	msedge.exe	102
PID 5064 wrote to memory of 3664	5064	msedge.exe	103
PID 3564 wrote to memory of 5980	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	104
PID 5064 wrote to memory of 4520	5064	msedge.exe	107
PID 1808 wrote to memory of 5236	1808	mkezupkezx.exe	109
PID 5064 wrote to memory of 5140	5064	msedge.exe	112
PID 5064 wrote to memory of 5140	5064	msedge.exe	112
PID 5064 wrote to memory of 4840	5064	msedge.exe	113
PID 5064 wrote to memory of 4840	5064	msedge.exe	113
PID 3564 wrote to memory of 2572	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	116
PID 3564 wrote to memory of 2060	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	120
PID 2772 wrote to memory of 2100	2772	bzuomgezwr.exe	122
PID 3564 wrote to memory of 3992	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	125
PID 3564 wrote to memory of 1084	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	129
PID 2072 wrote to memory of 5200	2072	wtrljdbwto.exe	131
PID 3564 wrote to memory of 4848	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	134
PID 3564 wrote to memory of 5124	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	138
PID 1724 wrote to memory of 5740	1724	bytqljdbvt.exe	140
PID 3564 wrote to memory of 3304	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	143
PID 5064 wrote to memory of 5132	5064	msedge.exe	146
PID 5064 wrote to memory of 4228	5064	msedge.exe	147
PID 5064 wrote to memory of 4548	5064	msedge.exe	148
PID 3564 wrote to memory of 692	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	151
PID 3580 wrote to memory of 1080	3580	yvtnljdbvt.exe	153
PID 3564 wrote to memory of 2576	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	156
PID 3564 wrote to memory of 4680	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	160
PID 5168 wrote to memory of 6132	5168	dxvqnifaxv.exe	162
PID 3564 wrote to memory of 5800	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	165
PID 3564 wrote to memory of 2328	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	169
PID 1992 wrote to memory of 1052	1992	snhfdxspki.exe	171
PID 3564 wrote to memory of 4184	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	174
PID 3564 wrote to memory of 264	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	178
PID 5784 wrote to memory of 236	5784	fzxspkhcau.exe	180
PID 3564 wrote to memory of 4228	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	183
PID 5064 wrote to memory of 3884	5064	msedge.exe	185
PID 5064 wrote to memory of 3884	5064	msedge.exe	185
PID 3564 wrote to memory of 2276	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	191
PID 5080 wrote to memory of 3084	5080	eczusmkezu.exe	193
PID 3564 wrote to memory of 4544	3564	2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_6bec39ad3bfa3ece3f624a9bc90d2240_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x300,0x7ff9c9f6c188,0x7ff9c9f6c194,0x7ff9c9f6c1a0
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,12261918188555572566,6134623933554889635,262144 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10937060469249278656,4174583479664230308,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
      4⤵
      System Time Discovery
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,7722966625728442180,12762090291932172761,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,11631147625716171481,7744805434405629447,2097152 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,2473750406479914278,15607932551736436866,2097152 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,7694673668497313068,11105358748903435006,2097152 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,10426061451038243405,459680675061211275,2097152 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,11476462902249824229,15671087420218409086,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14659436143933902213,14157353928950603065,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,10516856159563118924,1356587545931868376,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1724128378846765931,16595348564675789773,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:1336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1724128378846765931,16595348564675789773,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,5817400826417872884,12449719597774395755,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,13020039563641779547,7392779395031859412,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,6028924388529810662,11982542095472813340,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,13506623938698394704,13568296874709220680,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,9108388176326472747,4076281782722222257,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,2551678037581214092,14061053371759175849,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9908973653317026731,976425250700029840,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,4572548936703953491,9811816873846663435,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,8452195361548277051,5052945864736699136,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:14
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5672,i,15919118414952476103,16353751844076163964,262144 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,5975692884452714127,15248761613913926509,524288 --field-trial-handle=2352,i,10410647600775972014,9567516898982893252,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
      4⤵
      PID:5880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkezupkezx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5980
- - C:\Temp\mkezupkezx.exe
    C:\Temp\mkezupkezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkezupkezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Temp\i_mkezupkezx.exe
    C:\Temp\i_mkezupkezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2060
- - C:\Temp\bzuomgezwr.exe
    C:\Temp\bzuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3992
- - C:\Temp\i_bzuomgezwr.exe
    C:\Temp\i_bzuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1084
- - C:\Temp\wtrljdbwto.exe
    C:\Temp\wtrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\i_wtrljdbwto.exe
    C:\Temp\i_wtrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3304
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtnljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Temp\yvtnljdbvt.exe
    C:\Temp\yvtnljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtnljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2576
- - C:\Temp\i_yvtnljdbvt.exe
    C:\Temp\i_yvtnljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnifaxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4680
- - C:\Temp\dxvqnifaxv.exe
    C:\Temp\dxvqnifaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnifaxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5800
- - C:\Temp\i_dxvqnifaxv.exe
    C:\Temp\i_dxvqnifaxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snhfdxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Temp\snhfdxspki.exe
    C:\Temp\snhfdxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snhfdxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\i_snhfdxspki.exe
    C:\Temp\i_snhfdxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:264
- - C:\Temp\fzxspkhcau.exe
    C:\Temp\fzxspkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4228
- - C:\Temp\i_fzxspkhcau.exe
    C:\Temp\i_fzxspkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczusmkezu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\eczusmkezu.exe
    C:\Temp\eczusmkezu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczusmkezu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4544
- - C:\Temp\i_eczusmkezu.exe
    C:\Temp\i_eczusmkezu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwuojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3908
- - C:\Temp\gezwuojhbz.exe
    C:\Temp\gezwuojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwuojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5456
- - C:\Temp\i_gezwuojhbz.exe
    C:\Temp\i_gezwuojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtomgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4936
- - C:\Temp\jebwtomgbz.exe
    C:\Temp\jebwtomgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtomgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4856
- - C:\Temp\i_jebwtomgbz.exe
    C:\Temp\i_jebwtomgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqomgebztr.exe ups_run
  2⤵
  PID:6096
- - C:\Temp\wqomgebztr.exe
    C:\Temp\wqomgebztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqomgebztr.exe ups_ins
  2⤵
  PID:5928
- - C:\Temp\i_wqomgebztr.exe
    C:\Temp\i_wqomgebztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gayvtnlige.exe ups_run
  2⤵
  PID:2504
- - C:\Temp\gayvtnlige.exe
    C:\Temp\gayvtnlige.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gayvtnlige.exe ups_ins
  2⤵
  PID:2728
- - C:\Temp\i_gayvtnlige.exe
    C:\Temp\i_gayvtnlige.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igavtnlfdy.exe ups_run
  2⤵
  PID:2036
- - C:\Temp\igavtnlfdy.exe
    C:\Temp\igavtnlfdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igavtnlfdy.exe ups_ins
  2⤵
  PID:1276
- - C:\Temp\i_igavtnlfdy.exe
    C:\Temp\i_igavtnlfdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkifdxv.exe ups_run
  2⤵
  PID:3684
- - C:\Temp\ausnkifdxv.exe
    C:\Temp\ausnkifdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkifdxv.exe ups_ins
  2⤵
  PID:2940
- - C:\Temp\i_ausnkifdxv.exe
    C:\Temp\i_ausnkifdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicaxsqk.exe ups_run
  2⤵
  PID:5192
- - C:\Temp\sqkicaxsqk.exe
    C:\Temp\sqkicaxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicaxsqk.exe ups_ins
  2⤵
  PID:4880
- - C:\Temp\i_sqkicaxsqk.exe
    C:\Temp\i_sqkicaxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkfcxrp.exe ups_run
  2⤵
  PID:1560
- - C:\Temp\xusmkfcxrp.exe
    C:\Temp\xusmkfcxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkfcxrp.exe ups_ins
  2⤵
  PID:5756
- - C:\Temp\i_xusmkfcxrp.exe
    C:\Temp\i_xusmkfcxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:5724
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:820
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  PID:992
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  PID:1696
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebztrojge.exe ups_run
  2⤵
  PID:1256
- - C:\Temp\jebztrojge.exe
    C:\Temp\jebztrojge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebztrojge.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_jebztrojge.exe
    C:\Temp\i_jebztrojge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1580

C:\Temp\hbztrmjebz.sys
C:\Temp\hbztrmjebz.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\gbywrojhtr.sys
C:\Temp\gbywrojhtr.sys
1⤵
- Executes dropped EXE
PID:1836

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\dbvtqligay.sys
C:\Temp\dbvtqligay.sys
1⤵
- Executes dropped EXE
PID:3852

C:\Temp\davtnlfdav.sys
C:\Temp\davtnlfdav.sys
1⤵
- Executes dropped EXE
PID:3460

C:\Temp\igaxsqkica.sys
C:\Temp\igaxsqkica.sys
1⤵
- Executes dropped EXE
PID:5392

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
- Executes dropped EXE
PID:3080

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:6140

C:\Temp\hezwuomjhb.sys
C:\Temp\hezwuomjhb.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\wuomhezwro.sys
C:\Temp\wuomhezwro.sys
1⤵
- Executes dropped EXE
PID:4412

C:\Temp\toljgbztro.sys
C:\Temp\toljgbztro.sys
1⤵
PID:3968

C:\Temp\dbywqljgey.sys
C:\Temp\dbywqljgey.sys
1⤵
PID:4200

C:\Temp\oifdyvqoid.sys
C:\Temp\oifdyvqoid.sys
1⤵
PID:3732

C:\Temp\nlfdxvsnlf.sys
C:\Temp\nlfdxvsnlf.sys
1⤵
PID:5680

C:\Temp\pnkfdausqk.sys
C:\Temp\pnkfdausqk.sys
1⤵
PID:2144

C:\Temp\xusmkfzxvp.sys
C:\Temp\xusmkfzxvp.sys
1⤵
PID:4904

C:\Temp\fzxrpjhfcx.sys
C:\Temp\fzxrpjhfcx.sys
1⤵
PID:936

C:\Temp\hbzwuomhez.sys
C:\Temp\hbzwuomhez.sys
1⤵
PID:4108

C:\Temp\jebwurmjeb.sys
C:\Temp\jebwurmjeb.sys
1⤵
PID:4528

C:\Temp\ljdbvtrljd.sys
C:\Temp\ljdbvtrljd.sys
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqljdbvt.exe

Path C:\Temp\bytqljdbvt.exe
Size 243KB
SHA256 44834f7ad59ccc3aa8466213008359eade54acc2c215dc133e4bb64c7dec8dc9
MD5 85e61f66c812c9feb421c501f3e10388
SHA1 108492068e2a62df2060ccb03fb7d5535265e2d2
SHA512 40493a32915b1c843f2742c2cf714264f9d9baf4dd0995f7c8cf9e8a6e465a1369729c4f3bfeb31f7cb78bf41e73e602b393bb43cb9266648546dfa1e669bf35
SSDEEP 3072:FBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:Pb3TfLAUa3lLNngoqRttA7d
TLSH
T1FF34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzuomgezwr.exe

Path C:\Temp\bzuomgezwr.exe
Size 243KB
SHA256 35190a32b304a2d6a66e4098fdb31151d4ce0901e2dada1550c48f3d6d68ce5f
MD5 0fd1ef23fef0d362400422fc221c1042
SHA1 7883b204bb63fc0a476fe6e247b8925102e18662
SHA512 e8bb2450039d2d75026993b5de405939ff890457985093eb4c63c0aa1b2337df28d1be0e4463aff23cd4e8d4363c0c3faa480b10e787233ff703f00cae94a837
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:ab3TfLAUa3lLNngoqRttA7O
TLSH
T14D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdav.sys

Path C:\Temp\davtnlfdav.sys
Size 141KB
SHA256 be3eea44006ad748517f00309982ddf2b1a2eee3035bff327ecbc1fd5591510d
MD5 88a2a0fed3d5a514fe3c053481c4f944
SHA1 f2b01842062fecba1282c232e93fe46ce6144481
SHA512 061f6f9b9135d74419afa0a7d0ee650ff005f61380b7d29149e8140751c2b9683ae99d97e9601c0028b1640adbc9e77515d5601eeb3ea14837806e844a8efc29
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11FE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqligay.sys

Path C:\Temp\dbvtqligay.sys
Size 141KB
SHA256 158b1c2c07df9043f091175880b15f51c2ce13b7b86217a804befebe141c1a25
MD5 84fb0c8448609f7cb388307913f3c801
SHA1 c96475d3ff8e96f137553bdbb1d4ef6534045b7e
SHA512 575cba2a83f69f5ab706b0a0ba5da1f04a40abfec50d88512c4acb9d0564e71ead9ef8dbf42bc6072fa881017370ac340f07c496e4337fdf03af337eceb651ce
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifaxv.exe

Path C:\Temp\dxvqnifaxv.exe
Size 243KB
SHA256 a0c4f0d5107f2207b89279a2bfe085369acbf516a1c5b43fbcb59ad75071e2f3
MD5 488f2a04680211e8984f829d7ccf7c3e
SHA1 6dfc42d7fa37e0c024b56193ce8cdab133bbe71e
SHA512 03c4bdfcc5837ebde2c0b3454d120000f87158ba7f64eea228741fb9547265e4dde660f67443c690dcdb2df5986df6f50b5bace5eedaf49b03b114dfc3a0eea8
SSDEEP 3072:PBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:Jb3TfLAUa3lLNngoqRttA7z
TLSH
T15634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeyw.sys

Path C:\Temp\ebwtomgeyw.sys
Size 141KB
SHA256 7678a2cba418059fe85f2f8e6e9a8e41bfa7f0685b589c7b78d75c1bf8bd70ba
MD5 68bf69d58126442722020ac93532f25d
SHA1 abdcd049e377e8f6aa2a897f133b94d86abd449c
SHA512 7187a7d501da859bb6efb2c0d14e3673d24ce74e23530a84fc3906626f826fbc563cd54028619886c0089f6b289c5ce400fb7bcccff4bb8005ef34e3926d7955
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywrojhtr.sys

Path C:\Temp\gbywrojhtr.sys
Size 141KB
SHA256 0dd4587f5888329eac87a0159c25b3b092f69e128326d1528ebbba1ddd7929dc
MD5 f81b66a2a80952349e6b45fb181368fb
SHA1 8323c8782962c0f35853a20cb59d2894b6575005
SHA512 873525f1ada5d8cd6d404472255654d7f7ab506127c01527e1cda36876ec351bf3088bc8635c1ae287af31cf0753b69b6badb8d1a39908a2e8b6c594e029490d
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjebz.sys

Path C:\Temp\hbztrmjebz.sys
Size 141KB
SHA256 d5c35d713b4903352ed827d7c024bbb3098d143a0cce229813b56866d2cefff5
MD5 b92e8f8be7bf39587a3d4dec317c72d4
SHA1 4385ac37a80e7b04b1617521d08b85cefb75bf54
SHA512 ce0252d4656d44b3c3537be92bdfa0309e55e3b2a316126074e785c2eacf222dabbf91599575b5b810f96d5b6fa9fc3e259ec7131f2e37c3231ac403007ae2f2
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqljdbvt.exe

Path C:\Temp\i_bytqljdbvt.exe
Size 243KB
SHA256 bccc13ab8e1f9ea2b9b6321b36802432bb0e33484d19a2e0bcbaa36f840608c8
MD5 51e147e06f9e76048fa033650025a9f0
SHA1 c61ecd0143dad86f54aee59dd543697ef3e70460
SHA512 28c75ef15410812300d2289aab4674623596ae78b92b7d25140bf27b94b1cd7e2a2840c64fc0827e68930fe3254a8e8bba4aa2921748874c6d9ad87c813aa7d2
SSDEEP 3072:cBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:0b3TfLAUa3lLNngoqRttA7A
TLSH
T11F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzuomgezwr.exe

Path C:\Temp\i_bzuomgezwr.exe
Size 243KB
SHA256 425b5005ba2308bff9ebf775b9dc5c1453c91a1c5a8db3fca93f1df6a5e44107
MD5 f14d30eb950332535513cf6805ff2baa
SHA1 6144e03ee59e6adf9c07d75d1f39975a52b1f635
SHA512 e14766d89f63eb023e9866be3117f7e5a1dc85ca666cb15f4803654772f03e16fc113f367e1e74461bcda47d6f17b6adfc525fe04324239b14e7ce9361f81b6c
SSDEEP 3072:uBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:Ob3TfLAUa3lLNngoqRttA7q
TLSH
T11E34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqnifaxv.exe

Path C:\Temp\i_dxvqnifaxv.exe
Size 243KB
SHA256 f2fec8e0e4535e593cadd513bce9db18c74e09af2a3baa7c5123b93ecc2f54f8
MD5 3abc88653cdb94a81117371a08c4b83c
SHA1 23af8200b7a07adba17d52dfdf7c07068ce608fa
SHA512 be2d00a497ba30e5fc520a0f4c910de3ccbbb9ed4f0f62c0e03b9ddc772a9bf14b63d57dd53caac15448a0d3e003e2147a5e8624ebfaa2e23756061296f79800
SSDEEP 3072:mBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:mb3TfLAUa3lLNngoqRttA7q
TLSH
T12934490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkezupkezx.exe

Path C:\Temp\i_mkezupkezx.exe
Size 243KB
SHA256 566f2c61e4d0830b70ff8112924f6c20437b15eecf7bfa9efa9edd9d1a6696b5
MD5 f4e93bb158c3f96e2291b722f2726438
SHA1 ac4f54f2ca7eec5dc0d163502d37f4dccd3d7c81
SHA512 3ed57a69212b5a3452edbf5487f9693923d996e2c1091306a2659e5877c794b111f44e631f16ed8c34405e1e03e999516884afd761137f86fa73c1c41cae54d6
SSDEEP 3072:UBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:Mb3TfLAUa3lLNngoqRttA7g
TLSH
T1F234490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljdbwto.exe

Path C:\Temp\i_wtrljdbwto.exe
Size 243KB
SHA256 9df949c39955c7625ee47f2fd4a1c6d06c6f72ed7b0c07d1b2180e900a18047b
MD5 61b7f94e65b40427f1a100857041b4a1
SHA1 ee893f049abaf6ec7e57a41ede54386303dc9ae9
SHA512 b0cd1dee2dd94ee81bc2d2cc4b30d1464d63282bdaefd05014f8d06e9b50153b54ec309f2efbd87e377fe3e6185c28d16dd428860dd3b0892bf9a9451c761d4a
SSDEEP 3072:QBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Ab3TfLAUa3lLNngoqRttA7s
TLSH
T13734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtnljdbvt.exe

Path C:\Temp\i_yvtnljdbvt.exe
Size 243KB
SHA256 fa0fd6fbe82db0cf5a89965a851e409f2c25be1796c528c8067a932142ab9f02
MD5 f926d3e4c531d280ee1e91c73823fcac
SHA1 e11a3c5abcdc16eedf7e5c10fc6d889f0d8769d8
SHA512 b4fe63c28ba229e53bd17c256de343034aaf0e1c8ca0d3ad567b95d09aa29dcfa12e86fc6e53a386ddc54992ca50e334eb30642dabc47865c00a17d0e2abaecf
SSDEEP 3072:pBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:rb3TfLAUa3lLNngoqRttA7d
TLSH
T1DB344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkezupkezx.exe

Path C:\Temp\mkezupkezx.exe
Size 243KB
SHA256 c70c5349b387e6ce9e59d3e5dafa67894e8dd4d76e9c38b4fb6df196039d2585
MD5 031e67955e7ee39992d0875a23039166
SHA1 a072cf0badb7ac149a1c25beb2aee96c25d77a5f
SHA512 f629f49b047faac1e6b0a236a403defa8425071a2f1572cc482cd4b76a1e188e04cc9ab999418c055bd3e921070174e30146378f13a36f903b3a2baf480f0c0a
SSDEEP 3072:xBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:zb3TfLAUa3lLNngoqRttA7V
TLSH
T10C344A0172818071E75A0B74045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbwto.exe

Path C:\Temp\wtrljdbwto.exe
Size 243KB
SHA256 980579e75c6582b501c6fe675d706017726739c3671a7e9928648cc3de7109b7
MD5 1e12d31289db86f98c9ec3d9817a5800
SHA1 8b5773ac99daaaf94ca4d5fd854b830f0981952e
SHA512 6d5216d05257993402685c1e0e21453598e33e532645425c849e8661d3ec1fd41dfb5e66012afab093b4e80d093d00fcd08b11119d6fd983645a9d7fc19658bd
SSDEEP 3072:CBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:ab3TfLAUa3lLNngoqRttA7W
TLSH
T17F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnljdbvt.exe

Path C:\Temp\yvtnljdbvt.exe
Size 243KB
SHA256 45bed8b72018143d494c3f9dad812a7e2be67888763597f1c6ff39674d15fe16
MD5 d1e530ab50b70cd1044f44fa3ac15bb0
SHA1 c8244057ba3b558e7b2f4a162b65293ec78e8fb9
SHA512 d64e0c322c88bd290d4626848ea957bad769f47e1ca870256b55f7a7104e0436657030baa04435440fcd06231c7067433b1b0c597163ab7bec4da741220cb69e
SSDEEP 3072:nBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:Bb3TfLAUa3lLNngoqRttA7T
TLSH
T14C34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

271a4dd0-2061-4f21-8fe6-f3bb4549baf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\271a4dd0-2061-4f21-8fe6-f3bb4549baf1.tmp
Size 42KB
SHA256 c0009ffa8e63fe86895689d5b4580031a76f2ba56d6d7788a7f7dfbab150d00b
MD5 c435edac6370d2b603b80f4092169a6e
SHA1 971299a166d1695a2e1737ee64d6f8adca756c65
SHA512 7aafa64cacc31c22b3b7ad461ba2068ee21d72bf2e352440ecaecaad61d44dd3c18d298195c916fa8d7954a8c7fcae0350ee85ade32856d445a45e7bb5feff42
SSDEEP 768:8FQGP3QwgWyOv8OfHfotLfptABGJYe1ELsAvC8/YER2sdfR:vGP39fHfKfcuYe1EQujYc2s5R
TLSH
T11D1329F198E7C976E9AE5787637D6E02ADBCC123B4888994B7C51D4CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31a941a8-f5ab-4714-90a3-7ea86cc59705.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31a941a8-f5ab-4714-90a3-7ea86cc59705.tmp
Size 33KB
SHA256 88b3876f1c17cd70827bb56d429dd5b391ac47c63339aaa70895d40ffd1375c5
MD5 f347115054fa0ed2d0ceb44d8f330788
SHA1 1d024a691c57e659d20b58c1ce538ac7241d4c48
SHA512 7fa97dd3c8002e2e1ffe72339bcca4e554dacdc1eb9c8a5f6aa9d99805cc981115dab4371c1ed69702501c45ca3796f0ee6943633f274954e792895fc4a97f2d
SSDEEP 768:CuP3nyV39TOfHfotLfptLyJYe1ELsAvC8/YER2sdfR:CuP3vfHfKfYYe1EQujYc2s5R
TLSH
T11EF2AE71DC75CE735DFAA289B3866703BEF84123D4C88A58D1DA170D44836AD274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e5a3581-e6ff-44f2-b612-536819f8942e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6e5a3581-e6ff-44f2-b612-536819f8942e.tmp
Size 37KB
SHA256 4a13a3a5dbac075218be432765e7ebcc657c361ed986bf02f4851d7ff229861e
MD5 afe02c2dec64a2ab30b4aa4f6a91bfb3
SHA1 37f2774be285237d12d3556a37b37677288fe09d
SHA512 556893228893bf71b87f2c8a30cd3509e2afdbd6eca227498f6b3790659ea773ed2a9703982b9ffae0670bb813508c273c98fc4a79cb84997d5cc5163e1c7d05
SSDEEP 768:h/UxvxjgC+i3qv9TOfHfotwKJYe1ELsAvC8/YMpkSHrkw:0Zj3+i3xfHfCYe1EQujYLS4w
TLSH
T16503C036ECA48D375DF2A388774A5717FEF4812394C45AA886DD2B0D15C73AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

10afc3c9-032d-445d-bd76-6fd3b233ce3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10afc3c9-032d-445d-bd76-6fd3b233ce3f.tmp
Size 11KB
SHA256 f4ce4feb3e384d4bb5d24276b10d3a0ac03717d18da2f9ab73be28d512f26153
MD5 656cdd8740103815af08d03672111b22
SHA1 bf7a296d9c73f4e286655531d2d7b5f80952ec58
SHA512 c71a47d7a4959e74b7a533c392242d25c2bd0066c9f5bfe82e3025c2fda2b1cb59eb71f2f0c9d928cfa830e9e61a646f7bb7fc3f6c2819ad66d83379347021f2
SSDEEP 192:sxR4RYCb/feMsy2yZk5FzoA8p9t/g6+WNCCC/YxWsUrG0IgVdJ:sxR45b/fJsNULH/5W/YUlp
TLSH
T18B42B915AD28AA7B8CCBD21DBB55BF53E2F91032A1D11E48A6FC861C04E66DD230750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2975395e-3144-4147-81d4-1f421f1452ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2975395e-3144-4147-81d4-1f421f1452ac.tmp
Size 12KB
SHA256 7be5139b650be3a1716321c97fdce45ade3e494515fc69801a4f8d4f1fa5cc19
MD5 fc410276a64a6c2cfdd13c23e5fd9361
SHA1 b8b35ddbd03b6fe13f4a11e5d68ca8687bb93178
SHA512 696924de58bc84fcf6bb0194e378aecd6c81b185eebd7befaa1050fb6b23a435272b911aa83e6024989b721fb307a50297c9fbbd10a0240ee8dd078fae951cf8
SSDEEP 192:sxRnRYCb/feMsUFyZk5FzoA8p9t/g6+WNCCC/YxLsUrG0IgD1dJ:sxRn5b/fJsoULH/5W/RUl9
TLSH
T12142B715AD286A7B9CCBD21DBB56BF53E2F95032A0D11E48A6FC8A1C04E76DD230750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334ab902-c84f-4203-899e-50d0e8396495.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\334ab902-c84f-4203-899e-50d0e8396495.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c81f03d67c91d02e6c0b40213710cfd036aacb49dd82ec0bc707ef1dc463398f
MD5 f870085d36dfcf7f550947454b841c1a
SHA1 4b1eaa2c3723569d5d13d4a019127bfea4aad010
SHA512 edcfdb74f7592b588cf112d0598062ca7cf4119e4ea50d2a655e8b297bd5b88d26f29046cec259d08e918df602fd5111106cc7447e680537fcd50162cd45c044
TLSH
T194613E40B091811EF79A02B2F2ED4C873B749EBB5E833E9205C7D577DA467A9C1C19C6
MD5 SHA1 SHA512 TLSH

Submit Download

29096ec9-e0cf-4e80-a987-ad6174b74f7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\29096ec9-e0cf-4e80-a987-ad6174b74f7d.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

371b0c4d-4ce1-4338-ba19-29e6dd584489.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\371b0c4d-4ce1-4338-ba19-29e6dd584489.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d1812cbd-bbdc-4d1f-9d33-9eee254388cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1812cbd-bbdc-4d1f-9d33-9eee254388cd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ffaf84d5-3bb2-4804-bbc6-377afaed5c9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ffaf84d5-3bb2-4804-bbc6-377afaed5c9b.tmp
Size 2KB
SHA256 caeb913c712357ae992b1c7ef79c3c22d97c3d189d705654d578dd4a6b239351
MD5 90f63615a94efc2d67b9a0910bea2403
SHA1 b0a2dfec7b0c193e400adc64b16b5d0c40743dd8
SHA512 9bd7fa41d2f8c9bca1585adca4b2e7785170a6a9ba11618b8b67a14ac220427d1e6e78fa4c1d342c29852e7fe4054d951fd89cb25e187fb1b34ca2391748078d
TLSH
T1DE41C0F7C2F8867D891195F4AB186E1BCF1D0954432C3D5AC8E4AE1B93E24B1D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a789cde1b92985ab736e8b5b34e667fabd7d1b4329d0595843063ba20018d76f
MD5 35ed2b0ac787078d1655d286eb664ba6
SHA1 4f1643ab7412d45f1ad7f15f20ea77cedba50f94
SHA512 7af5a69de8b284becdd818b7d5fa0d25383e505c52d1068e601ed6080ecdfbcce0f2a43c62be8b58618592745495cd6d8e76acc8ed8a4034a9d2c62c43631fc1
SSDEEP 48:KYa3EgaU0x5ApsIKYxKH4f6x7yhMBY0SyNfIlKoU4gHIZKkAkbyi:KQLyKYYKufqKoUTH6KkAyl
TLSH
T15B912561726B0241387E291E54D5E72B8A9231A3306DEA2F37DD54668F7BD054CFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae72f83f-480e-4646-8e2b-5e6e35c58208.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae72f83f-480e-4646-8e2b-5e6e35c58208.tmp
Size 29KB
SHA256 cb0571d9d89f91137005d1f9b92c1f57466d8ef54282404e54a5e3d49359e41d
MD5 d894538bb98ddf411ab30b0a10f264b4
SHA1 7fd177d327d5f05c8a14018656a7a8b4e3e68999
SHA512 001e4b292179f216941e4fe69cc92b9b4de1e1afeb51fcf30a545f5aabdc029226f1c63caac1d2900f1dd3b99cae74e7d2571859ad7ec65dd431b78570c8ec88
SSDEEP 768:zBDnBx7pLuLbYFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OVm9ZBK3Aro/TB:zBDnBnEbYFWgbjfkWu1jat9Z03L7B
TLSH
T107D2D97B780CCB7F4F804A9D9C197E9E6DA802CB9698CD4047FE945C02C67EE52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9cbff59-8777-4886-9e86-17b8ec3bb6f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9cbff59-8777-4886-9e86-17b8ec3bb6f9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff1265b8-7036-4050-80b5-b4b01e7de255.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff1265b8-7036-4050-80b5-b4b01e7de255.tmp
Size 11KB
SHA256 07856654c0092d74685b7d875d3f65eaabd3c8eb650369bb32848f5f752262f8
MD5 1231897e71626fedec65560285efd5e5
SHA1 71e0077ab09199f5baedefde2577d06354d8c789
SHA512 c5c6f565dd1ffb1c5ef9a72798ab5f64edfeb9d9d26fb5db53570f49b1a567a095d7399b90e2e36f3851e2f8d1e0da4df2aa2687b8fa79fe6a7da3e350d5c5e2
SSDEEP 192:sxRnRYCb/feMsU2yZk5FzoA8p9t/g6+WNCCC/YxWsUrG0IgD3dJ:sxRn5b/fJsvULH/5W/YUlL
TLSH
T19C42A715AD28AA7B8CCBD21DBB55BF53E2F95032A1D11E48A6FC8A1C04E66DD230750F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

dc61df36-94bb-45f1-bd63-5cf0b48db704.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dc61df36-94bb-45f1-bd63-5cf0b48db704.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b72eefd9-eb27-47b5-b36a-f296f3e0e75c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b72eefd9-eb27-47b5-b36a-f296f3e0e75c.tmp
Size 33KB
SHA256 b2e905845347749d22fb83cfde710107225b557cad808368d50aa1d3f182edee
MD5 6d9db418d5c8a514cae3e702bf4257cf
SHA1 0d54d60867ea40968b9f1e1230826c929b1f0254
SHA512 644a16e432ed27879f65c724e44b4960bb75da1a3b1677f19fa65183be325f3d99d48f44c6935d0cd3f4a3e47faf905b4c0fd9f0c570a8da836ff011551b24d0
SSDEEP 768:8uP3Uyn39TOfHfotLfptAyJYe1ELsAvC8/YER2sdfR:8uP3qfHfKf9Ye1EQujYc2s5R
TLSH
T1C9F2BF71DC79CD735DFAA289B3866743BEF84123D4C88A58D1DE170D44836AD274F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49c28c4c-7d4f-4293-9bde-3dd679b5827a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\49c28c4c-7d4f-4293-9bde-3dd679b5827a.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

ad47920a-b17c-4a67-ac76-b8007a9e4671.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ad47920a-b17c-4a67-ac76-b8007a9e4671.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

ee7fd09b-96fe-4f04-9cf6-b7af6fdd7d04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\ee7fd09b-96fe-4f04-9cf6-b7af6fdd7d04.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

f1334337-ffde-4844-b003-396a71fa025b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f1334337-ffde-4844-b003-396a71fa025b.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

1d527084-933c-4a40-8aeb-2e3ed843ba6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d527084-933c-4a40-8aeb-2e3ed843ba6a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

97f1a8d8-2baa-4741-a9ef-b0565eb39e0b.tmp

Path C:\Users\Admin\AppData\Local\Temp\97f1a8d8-2baa-4741-a9ef-b0565eb39e0b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a926ed39-747e-494c-b109-453e977a2da5.tmp

Path C:\Users\Admin\AppData\Local\Temp\a926ed39-747e-494c-b109-453e977a2da5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5064_1008275144\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1040410129\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_1255982143\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5064_779583564\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

memory/936-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1836-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2144-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3080-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3460-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3852-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3968-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4200-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4412-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4904-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5392-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-260-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6140-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download