f1285130199948aae3da3af92960fc9308d2a23a6816768b9612c3d4338b1f19

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe
Size 243KB
Sample260421-1pplmacv6q
SHA256 f1285130199948aae3da3af92960fc9308d2a23a6816768b9612c3d4338b1f19
MD5 3e10eb97e7e5626e277b2549cbe8ae68
SHA1 b6f3ac6d2a63db188264dc8024ea198ad0a92698
SHA512 3964f2763ed75dd1c75f2f493bcfe11f9cb9674d564facd8d48e99810c3ed3e86fd16854ba13cc2dfe2b4736274edcde9e73393de505b56cd6867954639ef802
SSDEEP 3072:xVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:jXP7LQMa3lLNngoqRttA7k
TLSH
T1D3345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4372	CP.exe
4160	rmkecwupjz.exe
788	CP.exe
4168	CP.exe
2132	i_rmkecwupjz.exe
1576	rpmhezwuom.sys
1508	CP.exe
1328	hbztrljebz.exe
3752	CP.exe
2212	CP.exe
1952	i_hbztrljebz.exe
3132	trljebwuom.sys
1388	CP.exe
4324	rljebwuomg.exe
2528	CP.exe
3232	CP.exe
848	i_rljebwuomg.exe
1412	qojgbztrlj.sys
3924	CP.exe
2624	eywqljdbvt.exe
3216	CP.exe
4656	CP.exe
1656	i_eywqljdbvt.exe
2284	lgdqoigays.sys
4912	CP.exe
220	qoigaysnlf.exe
2216	CP.exe
3568	CP.exe
2448	i_qoigaysnlf.exe
416	yvqnigaysq.sys
1212	CP.exe
3148	icavsnlfdx.exe
3376	CP.exe
2028	CP.exe
2776	i_icavsnlfdx.exe
784	pkicausnkf.sys
3400	CP.exe
4928	icavsnifay.exe
1736	CP.exe
1788	CP.exe
4712	i_icavsnifay.exe
4548	hcausmkfcx.sys
584	CP.exe
1748	xvpnhfzxsp.exe
2880	CP.exe
2220	CP.exe
1184	i_xvpnhfzxsp.exe
3320	icxmhfzxrp.sys
1576	CP.exe
4312	mkecwupmhc.exe
4852	CP.exe
4964	CP.exe
2304	i_mkecwupmhc.exe
2064	pjhbzurmke.sys
4944	CP.exe
1076	wuomgezwro.exe
3836	CP.exe
3744	CP.exe
4676	i_wuomgezwro.exe
1676	ebwuomgeyw.sys
1744	CP.exe
1716	wrojhbztrm.exe
2968	CP.exe
2556	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_523269559\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_930174743\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_1329815622\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_1329815622\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_930174743\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_621144621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_621144621\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_1329815622\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwupjz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jezwromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aupmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwupjz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aupmhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jezwromhez.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5076	ipconfig.exe
1592	ipconfig.exe
4620	ipconfig.exe
3368	ipconfig.exe
3080	ipconfig.exe
2900	ipconfig.exe
1836	ipconfig.exe
4668	ipconfig.exe
3456	ipconfig.exe
3508	ipconfig.exe
1992	ipconfig.exe
2060	ipconfig.exe
4592	ipconfig.exe
820	ipconfig.exe
396	ipconfig.exe
3160	ipconfig.exe
1864	ipconfig.exe
3320	ipconfig.exe
580	ipconfig.exe
3368	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31248931"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3944556714"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212817881416229"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{DF27AFFD-7FC9-41B9-8BC6-935446450095}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	msedge.exe
2412	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	i_rmkecwupjz.exe
Token: SeDebugPrivilege	1952	i_hbztrljebz.exe
Token: SeDebugPrivilege	848	i_rljebwuomg.exe
Token: SeDebugPrivilege	1656	i_eywqljdbvt.exe
Token: SeDebugPrivilege	2448	i_qoigaysnlf.exe
Token: SeDebugPrivilege	2776	i_icavsnlfdx.exe
Token: SeDebugPrivilege	4712	i_icavsnifay.exe
Token: SeDebugPrivilege	1184	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	2304	i_mkecwupmhc.exe
Token: SeDebugPrivilege	4676	i_wuomgezwro.exe
Token: SeDebugPrivilege	1288	i_wrojhbztrm.exe
Token: SeDebugPrivilege	232	i_ojgbwtolge.exe
Token: SeDebugPrivilege	2576	i_dyvqoigays.exe
Token: SeDebugPrivilege	2276	i_tnlfdavtnl.exe
Token: SeDebugPrivilege	3728	i_snlfdxvpni.exe
Token: SeDebugPrivilege	4344	i_kfcxvpnkfa.exe
Token: SeDebugPrivilege	3040	i_aupmhczusm.exe
Token: SeDebugPrivilege	4804	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	936	i_jezwromhez.exe
Token: SeDebugPrivilege	2260	i_tomgeywroj.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 3356	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	80
PID 3356 wrote to memory of 684	3356	iexplore.exe	81
PID 684 wrote to memory of 4296	684	msedge.exe	82
PID 684 wrote to memory of 4024	684	msedge.exe	83
PID 684 wrote to memory of 716	684	msedge.exe	84
PID 684 wrote to memory of 716	684	msedge.exe	84
PID 684 wrote to memory of 716	684	msedge.exe	84
PID 684 wrote to memory of 4916	684	msedge.exe	86
PID 684 wrote to memory of 4916	684	msedge.exe	86
PID 684 wrote to memory of 3728	684	msedge.exe	87
PID 684 wrote to memory of 3728	684	msedge.exe	87
PID 684 wrote to memory of 3728	684	msedge.exe	87
PID 684 wrote to memory of 2400	684	msedge.exe	88
PID 684 wrote to memory of 2400	684	msedge.exe	88
PID 684 wrote to memory of 2400	684	msedge.exe	88
PID 684 wrote to memory of 3556	684	msedge.exe	89
PID 684 wrote to memory of 3556	684	msedge.exe	89
PID 684 wrote to memory of 3556	684	msedge.exe	89
PID 684 wrote to memory of 3100	684	msedge.exe	90
PID 684 wrote to memory of 1920	684	msedge.exe	91
PID 684 wrote to memory of 3100	684	msedge.exe	90
PID 684 wrote to memory of 3100	684	msedge.exe	90
PID 684 wrote to memory of 5032	684	msedge.exe	92
PID 684 wrote to memory of 1920	684	msedge.exe	91
PID 684 wrote to memory of 1920	684	msedge.exe	91
PID 684 wrote to memory of 5032	684	msedge.exe	92
PID 684 wrote to memory of 5032	684	msedge.exe	92
PID 684 wrote to memory of 4412	684	msedge.exe	94
PID 684 wrote to memory of 4412	684	msedge.exe	94
PID 684 wrote to memory of 4628	684	msedge.exe	96
PID 684 wrote to memory of 4628	684	msedge.exe	96
PID 684 wrote to memory of 2560	684	msedge.exe	97
PID 684 wrote to memory of 2560	684	msedge.exe	97
PID 684 wrote to memory of 3172	684	msedge.exe	98
PID 684 wrote to memory of 3172	684	msedge.exe	98
PID 684 wrote to memory of 3944	684	msedge.exe	99
PID 684 wrote to memory of 4292	684	msedge.exe	101
PID 1456 wrote to memory of 4372	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	102
PID 3944 wrote to memory of 3416	3944	msedge.exe	104
PID 4160 wrote to memory of 788	4160	rmkecwupjz.exe	106
PID 684 wrote to memory of 2900	684	msedge.exe	109
PID 684 wrote to memory of 2900	684	msedge.exe	109
PID 684 wrote to memory of 1144	684	msedge.exe	110
PID 684 wrote to memory of 1144	684	msedge.exe	110
PID 684 wrote to memory of 3400	684	msedge.exe	111
PID 684 wrote to memory of 3400	684	msedge.exe	111
PID 684 wrote to memory of 2660	684	msedge.exe	112
PID 684 wrote to memory of 2660	684	msedge.exe	112
PID 684 wrote to memory of 4400	684	msedge.exe	113
PID 684 wrote to memory of 4400	684	msedge.exe	113
PID 1456 wrote to memory of 4168	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	114
PID 1456 wrote to memory of 1508	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	118
PID 1328 wrote to memory of 3752	1328	hbztrljebz.exe	120
PID 1456 wrote to memory of 2212	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	123
PID 1456 wrote to memory of 1388	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	127
PID 4324 wrote to memory of 2528	4324	rljebwuomg.exe	129
PID 1456 wrote to memory of 3232	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	132
PID 1456 wrote to memory of 3924	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	136
PID 2624 wrote to memory of 3216	2624	eywqljdbvt.exe	138
PID 1456 wrote to memory of 4656	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	141
PID 684 wrote to memory of 3080	684	msedge.exe	143
PID 684 wrote to memory of 1736	684	msedge.exe	144
PID 684 wrote to memory of 4972	684	msedge.exe	145
PID 1456 wrote to memory of 4912	1456	2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_3e10eb97e7e5626e277b2549cbe8ae68_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ff82db8c188,0x7ff82db8c194,0x7ff82db8c1a0
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2003957520348615502,5990659848918890856,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
      4⤵
      System Time Discovery
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,10586625888531282514,15831444099974874461,262144 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8580535470131925465,13230586396448038314,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:13
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14974928777983062447,12849650674820814802,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16853471195220938200,7163102025094010118,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4100,i,14550171065319913209,7120917405572793389,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,9447442928761669070,4394840302000413216,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:9
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,11040641732531187664,6252069317532930852,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,8069972149579238273,13727934740022951120,2097152 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:9
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,14057385769910890691,4687771785129258542,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,4649457322285237062,12799241120787346482,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,13417935114259708409,13633348925188725152,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,15279278962582425975,738815184798100375,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3473469274775450310,13318777577346488717,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,10107685356457005208,12036596104672819567,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,10107685356457005208,12036596104672819567,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9531556515685724678,11628821117038880762,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,6964027666706708410,16082073793999766966,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,5290269494521231735,18100533374255133460,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,3204705249299047100,15154735427976951822,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15547443626590804635,16599254477078437454,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,5516144301341769556,12557858290814003371,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,11156016209246781414,10026238388887524361,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,7318737964106041109,4131629000933355071,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12872436224617948804,417892361878159376,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,15831852238836320721,527628534154299745,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4132,i,8033727862252178120,7805944272453162812,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,6106731162972438944,12069859518128000047,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4436,i,2553516467690316231,7591200577492443962,262144 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1031741090056049449,16681347793402614796,524288 --field-trial-handle=2040,i,9569513841342054959,7063104479752804178,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwupjz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4372
- - C:\Temp\rmkecwupjz.exe
    C:\Temp\rmkecwupjz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwupjz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\i_rmkecwupjz.exe
    C:\Temp\i_rmkecwupjz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1508
- - C:\Temp\hbztrljebz.exe
    C:\Temp\hbztrljebz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2212
- - C:\Temp\i_hbztrljebz.exe
    C:\Temp\i_hbztrljebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1388
- - C:\Temp\rljebwuomg.exe
    C:\Temp\rljebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Temp\i_rljebwuomg.exe
    C:\Temp\i_rljebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3924
- - C:\Temp\eywqljdbvt.exe
    C:\Temp\eywqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4656
- - C:\Temp\i_eywqljdbvt.exe
    C:\Temp\i_eywqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\qoigaysnlf.exe
    C:\Temp\qoigaysnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3568
- - C:\Temp\i_qoigaysnlf.exe
    C:\Temp\i_qoigaysnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Temp\icavsnlfdx.exe
    C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2028
- - C:\Temp\i_icavsnlfdx.exe
    C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\icavsnifay.exe
    C:\Temp\icavsnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1788
- - C:\Temp\i_icavsnifay.exe
    C:\Temp\i_icavsnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:584
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2220
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1576
- - C:\Temp\mkecwupmhc.exe
    C:\Temp\mkecwupmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\i_mkecwupmhc.exe
    C:\Temp\i_mkecwupmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3744
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Temp\wrojhbztrm.exe
    C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\i_wrojhbztrm.exe
    C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbwtolge.exe ups_run
  2⤵
  PID:3508
- - C:\Temp\ojgbwtolge.exe
    C:\Temp\ojgbwtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbwtolge.exe ups_ins
  2⤵
  PID:3372
- - C:\Temp\i_ojgbwtolge.exe
    C:\Temp\i_ojgbwtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run
  2⤵
  PID:4616
- - C:\Temp\dyvqoigays.exe
    C:\Temp\dyvqoigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins
  2⤵
  PID:2364
- - C:\Temp\i_dyvqoigays.exe
    C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdavtnl.exe ups_run
  2⤵
  PID:2596
- - C:\Temp\tnlfdavtnl.exe
    C:\Temp\tnlfdavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdavtnl.exe ups_ins
  2⤵
  PID:2500
- - C:\Temp\i_tnlfdavtnl.exe
    C:\Temp\i_tnlfdavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  PID:2804
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  PID:2900
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnkfa.exe ups_run
  2⤵
  PID:4712
- - C:\Temp\kfcxvpnkfa.exe
    C:\Temp\kfcxvpnkfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnkfa.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_kfcxvpnkfa.exe
    C:\Temp\i_kfcxvpnkfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aupmhczusm.exe ups_run
  2⤵
  PID:4628
- - C:\Temp\aupmhczusm.exe
    C:\Temp\aupmhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aupmhczusm.exe ups_ins
  2⤵
  PID:3852
- - C:\Temp\i_aupmhczusm.exe
    C:\Temp\i_aupmhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  PID:4592
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  PID:5076
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jezwromhez.exe ups_run
  2⤵
  PID:4984
- - C:\Temp\jezwromhez.exe
    C:\Temp\jezwromhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jezwromhez.exe ups_ins
  2⤵
  PID:1596
- - C:\Temp\i_jezwromhez.exe
    C:\Temp\i_jezwromhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywroj.exe ups_run
  2⤵
  PID:4972
- - C:\Temp\tomgeywroj.exe
    C:\Temp\tomgeywroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywroj.exe ups_ins
  2⤵
  PID:4140
- - C:\Temp\i_tomgeywroj.exe
    C:\Temp\i_tomgeywroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:644

C:\Temp\rpmhezwuom.sys
C:\Temp\rpmhezwuom.sys
1⤵
- Executes dropped EXE
PID:1576

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\qojgbztrlj.sys
C:\Temp\qojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:1412

C:\Temp\lgdqoigays.sys
C:\Temp\lgdqoigays.sys
1⤵
- Executes dropped EXE
PID:2284

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:416

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
- Executes dropped EXE
PID:784

C:\Temp\hcausmkfcx.sys
C:\Temp\hcausmkfcx.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\icxmhfzxrp.sys
C:\Temp\icxmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:1676

C:\Temp\wtolgeywro.sys
C:\Temp\wtolgeywro.sys
1⤵
PID:4580

C:\Temp\vtgdyvqoig.sys
C:\Temp\vtgdyvqoig.sys
1⤵
PID:1184

C:\Temp\lgdywqoidb.sys
C:\Temp\lgdywqoidb.sys
1⤵
PID:768

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
PID:1192

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
PID:3896

C:\Temp\spcausnhfz.sys
C:\Temp\spcausnhfz.sys
1⤵
PID:3296

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:3536

C:\Temp\rpjhbzuomh.sys
C:\Temp\rpjhbzuomh.sys
1⤵
PID:740

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqljdbvt.exe

Path C:\Temp\eywqljdbvt.exe
Size 243KB
SHA256 1ba80ebddc4e5bb90e63fedf000773ad0c8fccc13f9174b31af3ce189339d8e4
MD5 2763aaaf9985a50180ddd2f7d10b23df
SHA1 49c8f53fed4bbca2902b525d74305c272911b495
SHA512 c3597ec4c09e0e9c1b62f5297bfb90ee17043f34a75d31e46b4898c782b51c24946cc0005bd21af473f56ee5fa3891122ed2dd1aad9dbda4aec9ba84293574fa
SSDEEP 3072:0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:wXP7LQMa3lLNngoqRttA71
TLSH
T1B8345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljebz.exe

Path C:\Temp\hbztrljebz.exe
Size 243KB
SHA256 223aab38554a243d3d30879aa2c22e7baf235242af3f315754adb9b158799433
MD5 8a4d46d55640a07d61cb6e1adbb29ada
SHA1 f07ab0d74dc45e6cd2a82c4a5c09a02498d97556
SHA512 21f73599cf4e5cc58be2fb9c8b8f510bbab05e42c555c017ba50ba25e377250d80a000dad781621469c8e2eb4445d854f67d3b476bfbb748d078a6e27ddaede2
SSDEEP 3072:uVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:eXP7LQMa3lLNngoqRttA7T
TLSH
T1A5345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqljdbvt.exe

Path C:\Temp\i_eywqljdbvt.exe
Size 243KB
SHA256 996a170f2234205b54185aa43024be7af3e00bd632d10b0f45dcd39785cadace
MD5 5ed4f3cf85b03ff763d8b3186d84d24a
SHA1 eb8bf91586a3ed35d74a037e5bc66dffbff93292
SHA512 5aca8a070ddc89fefd235cf18ea2dcb795953d51548983357d8609daf793544c7293e27d12dad17e9b6727f77ea1a54ec9e67afa6a70f9e583ae8e3213ac1687
SSDEEP 3072:qVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:qXP7LQMa3lLNngoqRttA7v
TLSH
T1F7345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrljebz.exe

Path C:\Temp\i_hbztrljebz.exe
Size 243KB
SHA256 3b6895f849b4d398d86cf46e330f8184956812cb8b39e7a9e2ceb7b1cb743397
MD5 45a9cbfc9bca4529b2b082ab04ce8cc8
SHA1 1d372fad2b38c0aa1bf467e30d144c90935553e9
SHA512 05ee6c806a0836a5a01b19c5d9a1fe1a82555f7e9518b2bc001086ff6ad0fecea188291c6dde95fb007cbd01047aea74a7ff50e83695894e3ec9142cf0a197bc
SSDEEP 3072:XVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:FXP7LQMa3lLNngoqRttA7K
TLSH
T145345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysnlf.exe

Path C:\Temp\i_qoigaysnlf.exe
Size 243KB
SHA256 6551c4fc49915b6229dfdc7a7bb6f9eb1852e8efbd967a43c1a30cc7e754d368
MD5 34cbb86fd91d937ad6a0be1f51ebe102
SHA1 cf5f43bb412a92d4466f266e8bcf4351b56b489d
SHA512 6aeffd45372e1d3c1b9b6d5c17b9a02cbec5e2412b46922bdc2358d18867df2a0398d1a975fd3ddd75605d6086656713a995edacc0b2a65bdd4c10f1b92a846c
SSDEEP 3072:yVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:yXP7LQMa3lLNngoqRttA7f
TLSH
T1B1345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljebwuomg.exe

Path C:\Temp\i_rljebwuomg.exe
Size 243KB
SHA256 e3358574c8d4d23b6df0fdabe2d03d1bbaa9cdd367367ec31c9379b54db8aee2
MD5 27bf47f26ae2f36df3808c263c33b3f7
SHA1 b0ff6287d6e5858ff9f2bb265396b761148fb81c
SHA512 7d122b516ba2aaa70ade2f0b3655a00efbf37523aff583eae6de5fad50ba3db1bec736acd4cacd3d24fd2da1794233c1f3eb414322a52fe0cdc49c229002f794
SSDEEP 3072:zVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:BXP7LQMa3lLNngoqRttA7e
TLSH
T15E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmkecwupjz.exe

Path C:\Temp\i_rmkecwupjz.exe
Size 243KB
SHA256 e64c77da67b34b3ac28a8472efbcf46f19210d43715213f79c9e9ac8a200c585
MD5 7dee31807d41c4e8a6c2b52217728abe
SHA1 bfe46646636d7d2438d1a7c4e5070670aef88492
SHA512 6261756ac7b79cc41d36caf969a36466a9203cdb756c2957e0ca95e51ec11437db57169ec5e6256186a4794a17399e121df6142d1cbe88bf8f39f465b4368e91
SSDEEP 3072:MVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:oXP7LQMa3lLNngoqRttA7d
TLSH
T124345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.exe

Path C:\Temp\icavsnlfdx.exe
Size 243KB
SHA256 eb68691e812252a9ed3c2b035468e0cd6e0aec37e4586bf178c4549d9d76434f
MD5 70bc59f8663b463330889f3bac55a1c8
SHA1 7f935b9024d4fb40a4520610c251fb3ad6fca4b4
SHA512 609347b5eb27bfa263a087004782b947e59714353b861043f36a5ab521f6271172fd201b960a6c5bb82346699b903219b675c246c620b88cfa5839e3592a8305
SSDEEP 3072:TVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:hXP7LQMa3lLNngoqRttA7a
TLSH
T17E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdqoigays.sys

Path C:\Temp\lgdqoigays.sys
Size 141KB
SHA256 e3c3170355108420cd061f2a6bea4ab7d82012079fd421f345cab0b39acef68d
MD5 17e53d835da2d1384f5a98e76a30c100
SHA1 77b21f8b4dc1cc11370def0639bac05bd6f38740
SHA512 46bdb6594ece1afc41a6fd0cfecb7be61522707b6a52c3084e3392ae898550e04a566bb0a657d3fd5419a4c07dc8ffe8b17b26e2c74b0ecf841489c477ab5354
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysnlf.exe

Path C:\Temp\qoigaysnlf.exe
Size 243KB
SHA256 673987efd96b0dc0ef9fa65e6d690b6478baceba55506d60f64dad08714e41fe
MD5 32dd4edc7a80cd56bb4976ae59766a83
SHA1 8c5089722012c6867a8f9b2999d52c00537960bd
SHA512 c2b5d45c547c62c4ca97629b988af3327e665c9d837e54fc8d9743ca5c4e8ad93a87e6dcd5677275341407386fc53dfdb96d95f30a5cd4a6f66252dda5c433d9
SSDEEP 3072:tVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:/XP7LQMa3lLNngoqRttA7E
TLSH
T1B2345A0172818031E75A0B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbztrlj.sys

Path C:\Temp\qojgbztrlj.sys
Size 141KB
SHA256 9a400cb5542128de74492a3407c11567663f7b76c15e1e1dea316b07d7450b76
MD5 86ece61ad80e10b75337b643dc4d76b3
SHA1 69f0ef9df72c8730b6e33311a80378ccfb77432d
SHA512 a434f5b6838c38fabaed2e369805fd3819a5653634fd89d1ae7eeaff02476fa5150943ca1f55de882f86486294da05bd11c93cb4475e6f7993aa592c81948ef0
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.exe

Path C:\Temp\rljebwuomg.exe
Size 243KB
SHA256 0b09d9cff8dd44ec0b9d796620929bdceca058ae26d80238a8c4d5a1468e626d
MD5 e53220518d1051c16079353ff21fcf32
SHA1 113b490a0e5de6ec5708c20d1200e86469d44e18
SHA512 6a6b297b3aa47758dc05c53f3fd193a8766c23e7fbc0a9c332dd86e8ca17f78bc5568460ec05ec097d2e2231c66962290f4ba42bb6bf0b0e7e26c73874b2760a
SSDEEP 3072:UVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:QXP7LQMa3lLNngoqRttA71
TLSH
T106345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwupjz.exe

Path C:\Temp\rmkecwupjz.exe
Size 243KB
SHA256 3590c925d3ddc1ef49c06c27ffeb76a8d6381968516ca01fef35ee699db14a09
MD5 f66ca97a548975f8bafb4777fa41e81e
SHA1 899b6bf4a71f3583df1c77d4e3e3a4e4e4cb1e8c
SHA512 1d52d8e223d9fb6c1ef24870d3f9844a0ebd1335874badd4320386eb8e82a51ce83fd7e8c27c796c6bca10b7c6760897472769f159afcb1020af25644474cbdd
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:aXP7LQMa3lLNngoqRttA7n
TLSH
T117345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhezwuom.sys

Path C:\Temp\rpmhezwuom.sys
Size 141KB
SHA256 9ad6f0261e091a76708e1b4696a87508aa9925734480f88a0f4aef434b2ab4a0
MD5 57cddb4a4156ddbf17a77ea411cc7a6f
SHA1 c06fd4503e5882035d4d61e26d698033a3351630
SHA512 7f2ed5cd7502d50a4b8764c50964e1df75892801f1f5f956f49ee37257cb19e082639bac8302ea5aab9685912f572b637d5cf997dfc64f69775cbfba40e38dea
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T162E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebwuom.sys

Path C:\Temp\trljebwuom.sys
Size 141KB
SHA256 7452fbb18b3af8b9e94e85cb1392a10164fe333695f558c4da316dd528d106f7
MD5 cf5d3ffba31c8e9b0d82f014f4b9873e
SHA1 b35b4b4f6c477ed2652c06a0f31d6409a2e8b705
SHA512 cfb423ddab4782b577e164738f6c4a2289d382a94cde952bcda486c9259131d4cc67a7558dd91b0e487b8c65bb1972f8a86a39bba03fbc9f92232f0a6f3e657c
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigaysq.sys

Path C:\Temp\yvqnigaysq.sys
Size 141KB
SHA256 09e3f4e3fe847c97a7fd59f213c10c5c652b09d4b62286e390424479993ccf67
MD5 951343dce710d99c9f083279e49e264e
SHA1 6b8205f0fc75813e7faf4183b96086b25d3b90a5
SHA512 725ebc77d8bc13515f0b212fba6897b16a1883920b3e11f0ca525104612a37fff0a6fcabc35ca35b3d5e2c47efa653c49247c59f4a0efa9c9cc381e9221debf7
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B292D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 3181581ff9a1d358cbc13c4b5b51ac0d60650b41933ed6f6b59bddd8d0e5ebcd
MD5 e7877ff8212ffab65a63d728bb0a4a95
SHA1 732a295e598c9c2eff559eae0b202b2b90c22e97
SHA512 59e3fef7e209202f0bce60bcaea0d1784e307f0ecdb58c9425fd2c2b21ab46234c614607e21af11add2b5ce8855fa0d25771d55233fb0d43b2c774455b99e2a0
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T11CB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68cca1981bbfe461a50af50bb4bb92fa65f90d062a82f89c3839591230e8e96b
MD5 5e9579eab5589f91bfa33397890f2053
SHA1 54e69e6ddb162c86552f2b557bb485e673c52625
SHA512 6a6af47f1799f8fe965e6b7b960dd1e5a4b52d44b807f4d42da0f389fdcda64617dd74ce40077fdbc8dd2d60961c2f3497f95ec679b06bf60b5fc899cd13f71f
TLSH
T15F71C344DDA9C42AE3EB49B7C6ED10147A700BB9703B3EAB12FD953D8A29BF040D490C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 527cca331f7b3c4f21eda69f9bbfee8ef07ce020f2ca5d06199e605e5f363f8f
MD5 4a0205d6bebdce07e15797c8537cfd8d
SHA1 e2aede7441d2823090f347f40399c244f64eeb46
SHA512 3d17a0b8272c48267aafb04b9dfea85653ae69fba83c8850db32e3a42c1a8f9de526441a196ad7aafd914cd5374bd1578d5031e865aa9c52fe4a75235ce8f456
TLSH
T15D410EF3C3E8856E890156F0BA187E1BCE2D0914832C3D9AC9E4EF1B93E2870D10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba342013a26c9300e278fcb5cc6b61202184993fe0af323074552af7ebf0b6f7
MD5 c4dc24172618abe6740683c6440a13e2
SHA1 a7eb1a018d818d3067ed1515baad0d6c652c2a47
SHA512 7dfd45df4a0cfaaebf3b7253ab8690fdd2d9c7dd584f7e8574b55e00882f0004e66e3027b25143ed9979c9d57bd801fd4b00302338e65e261b590a4b6fab2219
SSDEEP 192:sxZ8RxyM//K1Ml8Mcd/fpsMsWyB3Idp/k/W6+WNsYX/Y0xkMbsTIg4J:sxZ8L0d/fpsMsms/bn/56c
TLSH
T12D52D8166A34A97BCCDBD209F945BF53D6F51462D2941E449EFCDA0C04E6AED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5df36c8b871ccab24c9ed00c7a1c5f199fc667106ce79dbe9a6d92869c4b246b
MD5 d2e3c5d7895d7dde7ba5381556aab59b
SHA1 6dfe46e34ffaec9dce861bfd4284d3edca207502
SHA512 b6ed10f5eaec1c61601d37c1966202543e1b6f72fdfc50124f9519bcc89bbd8cad95b6171a15ae40e4b846cd304f2b65707edadc55a10e6e4993fb594d448b17
SSDEEP 192:sxZ8RxyM//K1Ml8UQPcd/fpsfpWyB3IdpZk/W6+WNsYX/Y0xkf9wTIg5/J:sxZ8LqEd/fpsfpmG/bn/5Bv
TLSH
T1F862E856AA34997BCCDBD209F945BF53D6F5146292A01E449EFCCB0C05E6AED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f5f5028d1b461af40224cc15b0266abeec7574e5452d449727ae369c3f3203f8
MD5 110574aa32c84c7ac33b79ba6b6689d6
SHA1 daa6518240acc33e526cff065cf9a28f8accfe19
SHA512 f54e1e7914679e1bb1b90d64ddb9862d2b77bbf07bbe406806d7a0bd0a5ca701c00aa61c3213b7ef18cfa848ec91d6374ebb8b08c407adda613e4602ef93f843
SSDEEP 768:rrK2G8g+2aK7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3MPn8LlI:rrK2G8g+2aiEndJWRmdnQaPu1jaKMPnH
TLSH
T1EB031C3B280CCB7E4F844E9CEC267F9A6DE8018B9698C99447FA844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 db90a1b59e835cac77687c10e0b6d5276b070fdae5bd992b4e684949a25e9ca5
MD5 03ae935fc5a050ec0089473256294f3d
SHA1 ac60ee5346993debcc9e7d8245cf21a16088437e
SHA512 9518514196514b8f59b781160414951f63fefaee50353dc4bcdac04c4d917c3a5355ac165a59d5d552ae8c59fee584489eae32fe1e4e0ff7219288b254a603c0
SSDEEP 96:KAhyKisSO/iKoU+GfWKIgNvKrPxpp+P5klhv+KJLhN+VHvM9/fKqQKTCn:olB5dfjX4
TLSH
T143E13E51B03A02913A7E399E95E1F47F428231633508E53B3BBA01A64F66E21DDFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590dd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590dd1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ad8c77cafbb9a147d357a32b398d49410bd34c012b3b6823252c7dd0275981e3
MD5 946919b953ab5a6f0dc6ec55ca16130e
SHA1 7b447198d2f9e50e6c7e089798381c27fbbd9393
SHA512 fd12de3f86fae966673e9798b5abaa328e8db4b8f530e8c9f54dbedfe91c21402d94998932533654531754e06d349e63465c7616d7079621717c1e07cc171f65
SSDEEP 384:nRiFejccCs+Bt0S3c8NL8TUNTUlIlE2dx82eJkNVDfQ4vAwVTKWl1F+2FJMSBFbv:4FIccQ8awgldOa04PVTKWl3lfMSp3d
TLSH
T185D2B6F588E3993AE8AE9787A33E6E4659BCC05375845984FBD44E0CCC871BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 966e0b71c1c06c4e2a9a29cf61ddf527b3d5ae7dfa572ec41accca3576d224ba
MD5 5b91923f9f218d653244fe954b55ab1c
SHA1 c315f9617946c89479abe158caa971a773c76a20
SHA512 35047fcb93eb15816f2febe7978334466334bb30ee2240a779d8ec6d85a459c16b18c4e6ec0041ef6d21cd970c2c59b67e98631fb7a8d8889a432029ab7089ea
SSDEEP 384:ntjccCs+Bt0S3P8NpD2dx82eCyNQvAwVTKWl1F+2XMSBFb1Pf3d:tccQvzdOpGPVTKWl3lXMSp3d
TLSH
T140827D7118B56C3A99F7F569B54A3B535EB820679AC42F54D9E84F0C00CB38C1B4AA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 afccaacd9059a213f825d692782b1fbd2f5acac2ca5bb1210faefcbc113214b2
MD5 25292363bf64d28e41669cf239c9e0c8
SHA1 bc978c32a1762c7b32a82fb9defcaf3eb3276139
SHA512 3f04cd04fbcd39f0898c7af3196eb75845642b624e34b4837e70e0bf4c78a3e9878a68aac3df7782d8418cce1b9873814a1d894c7e1b17321a1f8845290f2bf2
SSDEEP 384:nOjccCs+Bt0S3P8Np32dx82e+yNQvAwVTKWl1F+2XMSBFb1Pf3d:4ccQvTdO9GPVTKWl3lXMSp3d
TLSH
T129827D3118746C3A99F7F569B54A3B535EB820679AC42F54D9E88F0C00CB28C1B4AA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e01400573bd9cb501823582af49105e780fd0b488b2c76ab841312406dbe0622
MD5 b612e7b62fc688ad2907aea08557affa
SHA1 f479c44e36a7ae3cca995195a4336d5bbfb65f3d
SHA512 d3bc147d3fa402b61b937e23532f1117b1177f7f166bd3e9202024a593a4ecca421e73534c022f2a7e556803bec88d68a72d6db7f020aeea0d502ea5a1958998
SSDEEP 384:nAjccCs+Bt0S3K8NpE2dx82efyNQvAwVTKWl1F+2xMSBFb1Pf3d:eccQqEdOKGPVTKWl3lxMSp3d
TLSH
T1E3827D7118756C3A99F7F569B54A3B535EB810679AC42F54DAE88F0C00CB38C174AA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7460ead48620ef4d0411be60fd470f994cabf2990100dc554621a0c1b0be8499
MD5 9b94b3c79d163a704b3e2c693ed63391
SHA1 ad05ab98e345da94fbfff3e627a64aee79ac3b43
SHA512 49dbc59a688c3cd3fa4bfbe85606904d86aae878496cbf2f456604439119efdd512412ab8c79cf3ab9c61781afc9227d13dcde6bc6b918fb4c2a052770cf2dc1
SSDEEP 384:n3jccCs+Bt0S3V8NpE2dx82eayNQvAwVTKWl1F+22MSBFb1Pf3d:zccQ1EdORGPVTKWl3l2MSp3d
TLSH
T1EE827D7118756C3A99F7F569B54A3B535EB810679AC42F54DAE88F0C00CB38C174BA3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e62c06d96ff10edc7874c0ac406c3a937bd3e5b36dbed48728fcf69b5c5732b
MD5 ad74beed5d01a9bcfeca3c77938aa0a3
SHA1 6790839b536e003bbf4431dba86f8ef4d9b464c1
SHA512 01fff3f997d253e0d9f303c190bd47b7d87c57fb07704655fc7736acff4563be1cb87fd8d0a96d0bb8f005e5cf5a3b06259c6600be2696683a3ea71b8f3f9d62
SSDEEP 192:VGNO6EajeQmiUyxw/1nRvAwVW/oKTq6ZnVU6:VGNO6ENqwdnRvAwVTKrNVU6
TLSH
T14C02E735A87C3C7B8EF3AD55B5837B276FA5102BE9942B84D9F81B0C40EB34C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5bcf39c8f96044ba4438877b76771d0425aef755457e2976631d6763eaa06ed9
MD5 9de3033aafa7074011544623aa5e8a1a
SHA1 2dd81ca8e3b4da0d226f2efa4a914861ecd21a4e
SHA512 31da7e4e66022703d0f84371192d57d25cca8a5fbd512ee8467ddc5901543348a34901f1a56ae628113379cdf72b0381b970027af2302142b3afea02ef7a14d5
SSDEEP 384:n8jccCs+Bt0S3V8NpE2dx82eoyNQvAwVTKWl1F+2qMSBFb1Pf3d:6ccQ1EdOjGPVTKWl3lqMSp3d
TLSH
T1D9827D7118746C3A99F7F569B14A3B535EB820679AC42F54DAE84F0C00CB38C1B4A93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5dbfe4d2d628de0f3b05f06f828b99c6573a4dc2dbc4c01b61c4618d70c8ecae
MD5 9ec446441d1457ede5c1b8af51747455
SHA1 7e701560e3c0f6c19624f5ce432fefc39cd2cb0a
SHA512 b3bee15cfdfa6d9fef9fa2c11991ca2c9da3eba095ddd17ce463796f0567679920745fae2d3e495123b138377e31f05a2f02a544a3b958d94107631ca7890bfc
SSDEEP 192:PGN06EajmQmiUyM1PRvAwVW/oKWl1LYq+2HupZqmsU6:PGN06EVNPRvAwVTKWl1F+2AMU6
TLSH
T10D12F975A878BC2A5DE3F855B4873B676EA51127EDC46F44E5F40B0C40DB34C2B0E52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 557e923659bfbe07a660e7b2d429e699b149f398c2d490936c66d9ffb61917d5
MD5 a518b085916fc2db41af66264fffef10
SHA1 92b4f397f4af1d9fd4cb494040d76e896776c65d
SHA512 2ca7b3ad6e5e67fa5bae65ef6eb90de6b136e42e7b4f1621e9c92d44ca68c837e85a46a1dde2123894f94f2514979c16824aeb74967c3d2ec59ff712ce674b29
SSDEEP 384:nRiF3jccCs+Bt0S368NE8TUNTUlIlE2dx82eRkNVifp4vAwVTKWl1F+2gMSBFb1t:4FzccQazwgldOy44PVTKWl3lgMSp3d
TLSH
T1BBD2C6F188E3993AE8AE9797A33D6E4699BCC05375845984FBD44E0CCC871BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 a41ed44b7f7cc30c9f75d70dbed9545036b09ee2200c7ac7964d06a04c32e281
MD5 82ccaad69f297f28350a3096b6f020ed
SHA1 67dd7b66d7129abeca25d145223e944bb39f9b5b
SHA512 0ea22fc077ddeff28cbc42bf66a29be162e03510cf7ff130e0de09114e2dea8dfe04fa19c65b74d5c5406d89fc2d14dd9d505dc870758ff3fb85674b55b4401d
SSDEEP 384:nRiFXjccCs+Bt0S388NE8TUNTUlIlE2dx82e4kNVifp4vAwVTKWl1F+2NMSBFb1t:4FTccQczwgldOF44PVTKWl3lNMSp3d
TLSH
T1D1D2C7F188E3993AE8AE9787A33D6E4299BCC05375845984FBD44E0CCC871BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6737f787-9d0f-4e90-a3c0-9422737318c7.tmp

Path C:\Users\Admin\AppData\Local\Temp\6737f787-9d0f-4e90-a3c0-9422737318c7.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c573b29-45b9-479f-80a8-67ccd98fa85d.tmp

Path C:\Users\Admin\AppData\Local\Temp\7c573b29-45b9-479f-80a8-67ccd98fa85d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

0efa027b-6db2-4eb5-a1bf-ffabfdfee2b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir684_1177489134\0efa027b-6db2-4eb5-a1bf-ffabfdfee2b3.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir684_1548672066\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_1329815622\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_523269559\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_621144621\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping684_930174743\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-628-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/416-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/740-850-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/768-755-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/784-627-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1184-751-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1192-783-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1412-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1576-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-667-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2284-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-854-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3132-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3132-527-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3296-820-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-663-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3416-110-0x000001796C010000-0x000001796C041000-memory.dmp

Download

memory/3536-824-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-797-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4292-523-0x000001AF94D70000-0x000001AF94DA1000-memory.dmp

Download

memory/4548-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4580-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download