5a3daeade69c7498a6aaaac002c463ae260475d127c56d7c8496a677bd963699

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
Size 243KB
Sample260502-2gwweagw21
SHA256 5a3daeade69c7498a6aaaac002c463ae260475d127c56d7c8496a677bd963699
MD5 20dd1e8f8edaca7f673c186c5befd02e
SHA1 8a2cf9ba047a145ee5d07823376bbca6ba31d8b0
SHA512 984f3f92d2ce565e20d21b87f0ec0f2392d16e56bd51249e6c61740c0af988ea04674d96972c8274700d30b1938c101a68f4fd4f70686956fbb66f535e2752aa
SSDEEP 3072:hhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:vn7nLQka3lLNngoqRttA7j
TLSH
T17C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5452	CP.exe
1092	cavsnkfdxv.exe
6004	CP.exe
3856	CP.exe
5652	i_cavsnkfdxv.exe
5944	hfzxrpkhca.sys
5288	CP.exe
5560	usmkecxupn.exe
5752	CP.exe
3700	CP.exe
4544	i_usmkecxupn.exe
3360	omhezxrpjh.sys
4436	CP.exe
820	hbzurpjhbz.exe
4816	CP.exe
1536	CP.exe
4504	i_hbzurpjhbz.exe
1064	jhbztrmjec.sys
5768	CP.exe
1060	rojhbztrlj.exe
2544	CP.exe
5760	CP.exe
2012	i_rojhbztrlj.exe
3292	ztrmjebwuo.sys
1096	CP.exe
2192	jdywrojhbz.exe
5080	CP.exe
2736	CP.exe
1016	i_jdywrojhbz.exe
2940	dywqoigbyt.sys
1028	CP.exe
2596	tnlgdywqoi.exe
5036	CP.exe
5924	CP.exe
4632	i_tnlgdywqoi.exe
5968	lfdyvqniga.sys
5156	CP.exe
5516	aysqlidbvt.exe
1996	CP.exe
3908	CP.exe
5432	i_aysqlidbvt.exe
5724	idavtnlfdx.sys
2800	CP.exe
764	qkidavsnlf.exe
1540	CP.exe
3192	CP.exe
1248	i_qkidavsnlf.exe
2772	xvpnifaysq.sys
5540	CP.exe
3928	nhfaysnkxv.exe
3964	CP.exe
5652	CP.exe
432	i_nhfaysnkxv.exe
4584	mkfcxupnhf.sys
2200	CP.exe
5160	fzxrpkhcax.exe
5236	CP.exe
3980	CP.exe
4912	i_fzxrpkhcax.exe
6092	fzxrpkhcau.sys
5396	CP.exe
3064	upmhbzusmk.exe
2592	CP.exe
6036	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
5632	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1418018598\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1517475483\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_357895489\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1517475483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_357895489\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\sl\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1374744415\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1261730517\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1418018598\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1517475483\edge_autofill_global_block_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaysnkxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhbzusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaysnkxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5324	ipconfig.exe
2168	ipconfig.exe
5992	ipconfig.exe
5236	ipconfig.exe
4588	ipconfig.exe
340	ipconfig.exe
3048	ipconfig.exe
1452	ipconfig.exe
5248	ipconfig.exe
4044	ipconfig.exe
4852	ipconfig.exe
5592	ipconfig.exe
5360	ipconfig.exe
3280	ipconfig.exe
3652	ipconfig.exe
3032	ipconfig.exe
1656	ipconfig.exe
6020	ipconfig.exe
5736	ipconfig.exe
3016	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "10119066"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251084"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222348310528623"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650218026-1419908266-2856590055-1000\{088E4BA1-6272-4612-9421-6C9F8B825558}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5652	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	4544	i_usmkecxupn.exe
Token: SeDebugPrivilege	4504	i_hbzurpjhbz.exe
Token: SeDebugPrivilege	2012	i_rojhbztrlj.exe
Token: SeDebugPrivilege	1016	i_jdywrojhbz.exe
Token: SeDebugPrivilege	4632	i_tnlgdywqoi.exe
Token: SeDebugPrivilege	5432	i_aysqlidbvt.exe
Token: SeDebugPrivilege	1248	i_qkidavsnlf.exe
Token: SeDebugPrivilege	432	i_nhfaysnkxv.exe
Token: SeDebugPrivilege	4912	i_fzxrpkhcax.exe
Token: SeDebugPrivilege	1344	i_upmhbzusmk.exe
Token: SeDebugPrivilege	5052	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	4376	i_bwuomgeroj.exe
Token: SeDebugPrivilege	5716	i_omgeytrljg.exe
Token: SeDebugPrivilege	228	i_gaywqoigay.exe
Token: SeDebugPrivilege	3360	i_vqnigaysqk.exe
Token: SeDebugPrivilege	1784	i_snkfdxnhfa.exe
Token: SeDebugPrivilege	1792	i_icausmkfcx.exe
Token: SeDebugPrivilege	2360	i_usmkecwupm.exe
Token: SeDebugPrivilege	5296	i_mgezwrpjhc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5984	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	78
PID 5984 wrote to memory of 5632	5984	iexplore.exe	79
PID 5632 wrote to memory of 848	5632	msedge.exe	80
PID 5632 wrote to memory of 4720	5632	msedge.exe	81
PID 5632 wrote to memory of 2844	5632	msedge.exe	82
PID 5632 wrote to memory of 2844	5632	msedge.exe	82
PID 5632 wrote to memory of 2844	5632	msedge.exe	82
PID 5632 wrote to memory of 3836	5632	msedge.exe	84
PID 5632 wrote to memory of 3836	5632	msedge.exe	84
PID 5632 wrote to memory of 2820	5632	msedge.exe	85
PID 5632 wrote to memory of 2820	5632	msedge.exe	85
PID 5632 wrote to memory of 2820	5632	msedge.exe	85
PID 5632 wrote to memory of 3332	5632	msedge.exe	86
PID 5632 wrote to memory of 3332	5632	msedge.exe	86
PID 5632 wrote to memory of 3332	5632	msedge.exe	86
PID 5632 wrote to memory of 6092	5632	msedge.exe	88
PID 5632 wrote to memory of 6092	5632	msedge.exe	88
PID 5632 wrote to memory of 6064	5632	msedge.exe	89
PID 5632 wrote to memory of 6064	5632	msedge.exe	89
PID 4604 wrote to memory of 5452	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	90
PID 5632 wrote to memory of 2504	5632	msedge.exe	93
PID 1092 wrote to memory of 6004	1092	cavsnkfdxv.exe	95
PID 5632 wrote to memory of 3684	5632	msedge.exe	96
PID 3684 wrote to memory of 2216	3684	msedge.exe	99
PID 4604 wrote to memory of 3856	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	102
PID 4604 wrote to memory of 5288	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	106
PID 5560 wrote to memory of 5752	5560	usmkecxupn.exe	108
PID 4604 wrote to memory of 3700	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	111
PID 4604 wrote to memory of 4436	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	115
PID 820 wrote to memory of 4816	820	hbzurpjhbz.exe	117
PID 4604 wrote to memory of 1536	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	120
PID 4604 wrote to memory of 5768	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	124
PID 1060 wrote to memory of 2544	1060	rojhbztrlj.exe	126
PID 4604 wrote to memory of 5760	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	129
PID 5632 wrote to memory of 2272	5632	msedge.exe	131
PID 5632 wrote to memory of 5216	5632	msedge.exe	132
PID 5632 wrote to memory of 4688	5632	msedge.exe	133
PID 5632 wrote to memory of 4832	5632	msedge.exe	134
PID 5632 wrote to memory of 4832	5632	msedge.exe	134
PID 5632 wrote to memory of 5104	5632	msedge.exe	137
PID 5632 wrote to memory of 5104	5632	msedge.exe	137
PID 4604 wrote to memory of 1096	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	138
PID 2192 wrote to memory of 5080	2192	jdywrojhbz.exe	140
PID 4604 wrote to memory of 2736	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	143
PID 4604 wrote to memory of 1028	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	147
PID 2596 wrote to memory of 5036	2596	tnlgdywqoi.exe	149
PID 4604 wrote to memory of 5924	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	152
PID 4604 wrote to memory of 5156	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	156
PID 5516 wrote to memory of 1996	5516	aysqlidbvt.exe	158
PID 4604 wrote to memory of 3908	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	161
PID 4604 wrote to memory of 2800	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	165
PID 764 wrote to memory of 1540	764	qkidavsnlf.exe	167
PID 4604 wrote to memory of 3192	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	170
PID 5632 wrote to memory of 5392	5632	msedge.exe	172
PID 5632 wrote to memory of 5392	5632	msedge.exe	172
PID 4604 wrote to memory of 5540	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	177
PID 3928 wrote to memory of 3964	3928	nhfaysnkxv.exe	179
PID 4604 wrote to memory of 5652	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	182
PID 4604 wrote to memory of 2200	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	186
PID 5160 wrote to memory of 5236	5160	fzxrpkhcax.exe	188
PID 5632 wrote to memory of 2568	5632	msedge.exe	191
PID 5632 wrote to memory of 2568	5632	msedge.exe	191
PID 4604 wrote to memory of 3980	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	192
PID 4604 wrote to memory of 5396	4604	2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_20dd1e8f8edaca7f673c186c5befd02e_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7fff8410c188,0x7fff8410c194,0x7fff8410c1a0
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,3412815752347618581,13460289749839509515,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
      4⤵
      System Time Discovery
      PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,14752876464936048634,13874071916821084410,262144 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2326722580699768009,4032467221955133438,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17006921297316560875,3787461657136419310,2097152 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,11302089933654443656,3111161177183366223,2097152 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,7028538041092280436,6116829753624838245,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,6709187951807678165,18120401419821589436,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13363637852584078693,3892312285742240083,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13363637852584078693,3892312285742240083,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,6965477788760339017,13411852214359146574,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,3882264886883954139,869786488422788879,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,1076056356309613180,10280329252484343148,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7491101312148300943,11695580575412434056,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,4080006349213884538,11582056280032000087,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8596884050163440344,5207906173529149415,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,741195061382701444,4098075411461181067,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,3144737853388808776,6848837964434484823,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4301261924417784924,11437795736181794769,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:14
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4234060343118750541,9621995470814965010,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:14
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5668,i,9598706084116768589,12085145617235402576,262144 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,214870277011710530,11439784175382567314,524288 --field-trial-handle=2168,i,3660566888689707539,7986249063963830859,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:4080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnkfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5452
- - C:\Temp\cavsnkfdxv.exe
    C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\i_cavsnkfdxv.exe
    C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5288
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3700
- - C:\Temp\i_usmkecxupn.exe
    C:\Temp\i_usmkecxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\hbzurpjhbz.exe
    C:\Temp\hbzurpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1536
- - C:\Temp\i_hbzurpjhbz.exe
    C:\Temp\i_hbzurpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5768
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Temp\jdywrojhbz.exe
    C:\Temp\jdywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2736
- - C:\Temp\i_jdywrojhbz.exe
    C:\Temp\i_jdywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1028
- - C:\Temp\tnlgdywqoi.exe
    C:\Temp\tnlgdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\i_tnlgdywqoi.exe
    C:\Temp\i_tnlgdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5156
- - C:\Temp\aysqlidbvt.exe
    C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3908
- - C:\Temp\i_aysqlidbvt.exe
    C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2800
- - C:\Temp\qkidavsnlf.exe
    C:\Temp\qkidavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Temp\i_qkidavsnlf.exe
    C:\Temp\i_qkidavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaysnkxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5540
- - C:\Temp\nhfaysnkxv.exe
    C:\Temp\nhfaysnkxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaysnkxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5652
- - C:\Temp\i_nhfaysnkxv.exe
    C:\Temp\i_nhfaysnkxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Temp\fzxrpkhcax.exe
    C:\Temp\fzxrpkhcax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3980
- - C:\Temp\i_fzxrpkhcax.exe
    C:\Temp\i_fzxrpkhcax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhbzusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\upmhbzusmk.exe
    C:\Temp\upmhbzusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhbzusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6036
- - C:\Temp\i_upmhbzusmk.exe
    C:\Temp\i_upmhbzusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhbz.exe ups_run
  2⤵
  PID:4328
- - C:\Temp\gezwrpjhbz.exe
    C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
  2⤵
  PID:5056
- - C:\Temp\i_gezwrpjhbz.exe
    C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeroj.exe ups_run
  2⤵
  PID:4668
- - C:\Temp\bwuomgeroj.exe
    C:\Temp\bwuomgeroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeroj.exe ups_ins
  2⤵
  PID:2160
- - C:\Temp\i_bwuomgeroj.exe
    C:\Temp\i_bwuomgeroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeytrljg.exe ups_run
  2⤵
  PID:4564
- - C:\Temp\omgeytrljg.exe
    C:\Temp\omgeytrljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeytrljg.exe ups_ins
  2⤵
  PID:3084
- - C:\Temp\i_omgeytrljg.exe
    C:\Temp\i_omgeytrljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaywqoigay.exe ups_run
  2⤵
  PID:3256
- - C:\Temp\gaywqoigay.exe
    C:\Temp\gaywqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaywqoigay.exe ups_ins
  2⤵
  PID:2732
- - C:\Temp\i_gaywqoigay.exe
    C:\Temp\i_gaywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  PID:2924
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  PID:3016
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxnhfa.exe ups_run
  2⤵
  PID:5536
- - C:\Temp\snkfdxnhfa.exe
    C:\Temp\snkfdxnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxnhfa.exe ups_ins
  2⤵
  PID:4548
- - C:\Temp\i_snkfdxnhfa.exe
    C:\Temp\i_snkfdxnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkfcx.exe ups_run
  2⤵
  PID:5248
- - C:\Temp\icausmkfcx.exe
    C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkfcx.exe ups_ins
  2⤵
  PID:752
- - C:\Temp\i_icausmkfcx.exe
    C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:4216
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:896
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrpjhc.exe ups_run
  2⤵
  PID:5624
- - C:\Temp\mgezwrpjhc.exe
    C:\Temp\mgezwrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrpjhc.exe ups_ins
  2⤵
  PID:4208
- - C:\Temp\i_mgezwrpjhc.exe
    C:\Temp\i_mgezwrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3840

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
- Executes dropped EXE
PID:5944

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\jhbztrmjec.sys
C:\Temp\jhbztrmjec.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\ztrmjebwuo.sys
C:\Temp\ztrmjebwuo.sys
1⤵
- Executes dropped EXE
PID:3292

C:\Temp\dywqoigbyt.sys
C:\Temp\dywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:2940

C:\Temp\lfdyvqniga.sys
C:\Temp\lfdyvqniga.sys
1⤵
- Executes dropped EXE
PID:5968

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:5724

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
- Executes dropped EXE
PID:2772

C:\Temp\mkfcxupnhf.sys
C:\Temp\mkfcxupnhf.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:6092

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
PID:4460

C:\Temp\ywrljebwto.sys
C:\Temp\ywrljebwto.sys
1⤵
PID:6104

C:\Temp\nlgdywqoig.sys
C:\Temp\nlgdywqoig.sys
1⤵
PID:5616

C:\Temp\oidavtnlxv.sys
C:\Temp\oidavtnlxv.sys
1⤵
PID:5060

C:\Temp\davqnifays.sys
C:\Temp\davqnifays.sys
1⤵
PID:1312

C:\Temp\snhfaxsqki.sys
C:\Temp\snhfaxsqki.sys
1⤵
PID:3028

C:\Temp\hczusmkfzx.sys
C:\Temp\hczusmkfzx.sys
1⤵
PID:5432

C:\Temp\ecxupmhfrp.sys
C:\Temp\ecxupmhfrp.sys
1⤵
PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvt.exe

Path C:\Temp\aysqlidbvt.exe
Size 243KB
SHA256 aa9236469ec170937b1417765752c3d7d806ba45c6258c109965bb29c31b3ef8
MD5 7749713bc44b2cddda6ab7a388b0de37
SHA1 318c599fc72612f729d7cde7ceceda4dce36b6dd
SHA512 65055712948fc9524014f6568ec6c30eb80d1a3947fabf8e301212080b866af2249828722faccba3706c630dd644b3e58499554e797b9eb9d9786716e699b458
SSDEEP 3072:Ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:Un7nLQka3lLNngoqRttA7O
TLSH
T19C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnkfdxv.exe

Path C:\Temp\cavsnkfdxv.exe
Size 243KB
SHA256 839b2520e6567ca8ec23c1661ca3811a2a8d37e32fc7ec39ee9a77a6f9dd540a
MD5 42721d9fdfd6e62ce34943d00b049d6c
SHA1 e32673c85bced705af0443fcd13b6d7397e7cd54
SHA512 5f9f40c6c4422e9e31dfbc459c95b6600fc3ea2ac89b137733684d7239e1380ab0616f75c0a05cff38ee988cdd292fb69a09fa876cd741b4fc264df30ed1b9df
SSDEEP 3072:lhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:bn7nLQka3lLNngoqRttA7P
TLSH
T19034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigbyt.sys

Path C:\Temp\dywqoigbyt.sys
Size 141KB
SHA256 2bda100242348f7416b0fdbd99857f6a8e8ae696005051e8a038c019b20ba077
MD5 1d44ebdaaa83b8190ed637851dc6c02a
SHA1 45f9903f6be4cd5ecc831cfe7e30fda63e780885
SHA512 d259ed3331b2918f7927f0f7a8ed34c76e3c051d687bde12ade4ee4fa0232296ef8a14b1a997446ca6037d7b5b048e878ccaef4b4347be6a14cc7c56ced2b4f9
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpjhbz.exe

Path C:\Temp\hbzurpjhbz.exe
Size 243KB
SHA256 333eecbfefc735f984263b15e5380a9c8f95efc7375a5aec64d1c72529fccf81
MD5 b73f16d7266687e49cb26eec0e5998e2
SHA1 7889172897f17625d80b4e9bdc9135c2f62fccf7
SHA512 719e2a1bfa75a0dc6bac700510c78c6d663986f5f25d33caa655c4b43a4ce2d567571159be8c4e0cf87b2b91261db94d5ad0bfc7a36ce9c44374458e1a09a7a1
SSDEEP 3072:Khn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:Wn7nLQka3lLNngoqRttA7o
TLSH
T16C34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhca.sys

Path C:\Temp\hfzxrpkhca.sys
Size 141KB
SHA256 a672cbfa7b1f9c91f2d45f8763c89e6836ffe1252e54340bc31fe8f37f2f5e20
MD5 09e8db305a56597209c34ca20d90499f
SHA1 8a7c565ca12e37a908b8a8a2892418294d5ae518
SHA512 17fdfb9f6201740ebd7e6ad19b4996fb3b9f3e0a670d8793d10ba2d955ca41de17660d331016c4501e2054bc7f20ac4c370a272e54ed60352518dc44dbd0b184
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T117E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavsnkfdxv.exe

Path C:\Temp\i_cavsnkfdxv.exe
Size 243KB
SHA256 626de90a448e4d2c1c3432762311fd29e0d12b0098eb95010e505768ff5f5215
MD5 e670e0d06152d3ae76baa02842b01cbb
SHA1 8a97a3ea21137b8322c8bc4d0e11b9bc396f4e33
SHA512 c4ad41ba9c80fa721ef2a9af4a6d0304e07831379f65366154a9babfa24d367a21338b4a9e77b8da18f97ad09fa54db8c8e4e8342a13ce1703078f9153227db3
SSDEEP 3072:Phn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:5n7nLQka3lLNngoqRttA7B
TLSH
T15434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurpjhbz.exe

Path C:\Temp\i_hbzurpjhbz.exe
Size 243KB
SHA256 8306fb32460ad237033e7df557b8677b3f0fe19632b9bd8685bb2cca70b103e4
MD5 3613c0677f2745efce71cd9b7392a3ea
SHA1 7c30f88e290f43c9e9df48672ccd54002bf26b34
SHA512 62d8dea2b2229420a66e419136434f42fa858791cf900584a5a14d11d4139d04ec65b1b35dbbc013b2830008a041424a2989fe96a9752b508631e1c1e5c8ce3a
SSDEEP 3072:6hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:Gn7nLQka3lLNngoqRttA70
TLSH
T19834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdywrojhbz.exe

Path C:\Temp\i_jdywrojhbz.exe
Size 243KB
SHA256 9b82025e3a7578536eef2b5eb37f7cc30de65a8d30b58b1d124c36215fa77ac1
MD5 edd38c2cf4193672637267dc97415f0e
SHA1 3a9e8c3976ea770cc6517dcddef44a4ef799060a
SHA512 6243b7244ae86f4db577d0714e1a6fdab78fb948287d800d79dd943afa15d11c6efc0d4b09eebcc947336d65a922f6cd6ed4b49709294d41da6ad5af306260bc
SSDEEP 3072:Bhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:Pn7nLQka3lLNngoqRttA7r
TLSH
T1D834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrlj.exe

Path C:\Temp\i_rojhbztrlj.exe
Size 243KB
SHA256 c7997ded56b2e56de7fda4f9dd5f75a9b1f17b65ac71321786570212d47bbeac
MD5 623191a22fea2b52a5eb1b4cd3f62f69
SHA1 40bde0cedd78e6769bc7109708f7c32c5a89bcd4
SHA512 51fefddec98c7600431e1739753c0d4cadad3cb606ca81b4782bd7e1b8b3c6158e9d4f17b77a61d7ea031a71b85b6bfade9db7251c653eaf29ab8b1755e09a56
SSDEEP 3072:3hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:xn7nLQka3lLNngoqRttA7x
TLSH
T17D34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgdywqoi.exe

Path C:\Temp\i_tnlgdywqoi.exe
Size 243KB
SHA256 f61508f4c0834202660b2575010e6a88d565f95bea3520cd19bc405d03f807d5
MD5 8a5d5759285279edbc3551215fc8e338
SHA1 d10288ea0a2e73494ee0450f89f4c8b3ef95877a
SHA512 640e553eda02a5d5e4f5b93c60707df24791900e65d26c4d8b2ce004de76746ac9198509251aff5343a50ca6b774aff6531b5f172e75a484d8d924e34a701c8b
SSDEEP 3072:qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:2n7nLQka3lLNngoqRttA7s
TLSH
T11834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecxupn.exe

Path C:\Temp\i_usmkecxupn.exe
Size 243KB
SHA256 de1c42f48ad0eabbbe250cc5ab07394ec94a8011d08c074ce99709a96991d712
MD5 cb808e8ebf9b31a316785de9c8dc5fa5
SHA1 b82f70a9df1032833e0ae9ce5f1cb613908106b5
SHA512 c10754be9c8f0cf23e576a72164c3e9550fc2b6faaee0d6916de93f64d8280e729e4189e75cc6b9b0950bb44480bf0173c65d9aa2019c37916cef1b3cb122ec2
SSDEEP 3072:fhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:Jn7nLQka3lLNngoqRttA7l
TLSH
T15434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdywrojhbz.exe

Path C:\Temp\jdywrojhbz.exe
Size 243KB
SHA256 00eb3c53aaf3390ca58371a2dab884893ec39c726e5583afc6e28f786bbfeed1
MD5 2205e3e1cefd76af97732e798114d4a7
SHA1 782d38a029450cb73b53f0b2d8456adeba70a7d9
SHA512 cdcfee1f5d25aa939f25b31362c34949450d28b711e48aee5d4daa307e37a92da3d65a4dc970ff1ad729e40cfe4e7117bf8cb6dcdfaee45efef3322feea52f36
SSDEEP 3072:Zhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:Xn7nLQka3lLNngoqRttA7P
TLSH
T17234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjec.sys

Path C:\Temp\jhbztrmjec.sys
Size 141KB
SHA256 bf8f7999b461927b151dca5d933edd241a32ad44c03caabce453d24a5b3eebe9
MD5 1312d23da18f1cb4797d0d2c9464448b
SHA1 83f06c680e92491bda6f3ec0b9114a4016c8ca79
SHA512 3be203c28f85b2e765a60cce8dacff7f4f27ad3ebc111fe016665e59c071822a423a05f168150da453e8a99879db156b49d35e79e9bb8e4f52c9ed64cfebbb9f
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqniga.sys

Path C:\Temp\lfdyvqniga.sys
Size 141KB
SHA256 73e50c6b02fd6614cb9968564c9ce49733cb75632fbee8eb553a8dd9383cfd23
MD5 d61c19335a1e67c497ab962077d411a0
SHA1 038190aea508d4d052587086f985fc6722b8d2c0
SHA512 e47337170ce0e391977507cbfa8fd63d2a2d81b80ad614000ed90ef122ccd930c9ea8d70dba7a76dd8a064772eb98047fa30dde7ac702935359b4d636559d55d
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.sys

Path C:\Temp\omhezxrpjh.sys
Size 141KB
SHA256 c50e343d8a354bb90f7290a389dc24ef3ec5c4b22e1eec34043f702577d9e3cf
MD5 8124e0d431223143ceb9db7ba6356ca8
SHA1 d53206c2ec7d38ff532665740a8dc4a6c46162aa
SHA512 e833de7d5b4f7b95787e526e6df9b121e620e6c7e466f163006d9e6e9db7a053a1ccbc6a9cf92affc2de0aad98cd8198e0c9245008f4c644d9bdc294bdc47848
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T118E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.exe

Path C:\Temp\rojhbztrlj.exe
Size 243KB
SHA256 603fcb96bbc80aace67c280ece7cb299426070169aec376059ce956a78aca534
MD5 474ee18a3e1777d6363a44b4bc30e6e1
SHA1 283368f10400216eeb8626fa85d3ed7af2dfbfc1
SHA512 7c38ecb038d6fb3b65a53e1e03f0ddc9e7c73255d600e704cd5f3caacca39926cd8a166ca363fe1f8e79f80453f539262aecd7706277fbad85e82990717638a9
SSDEEP 3072:2hn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:Kn7nLQka3lLNngoqRttA7E
TLSH
T1D334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.exe

Path C:\Temp\tnlgdywqoi.exe
Size 243KB
SHA256 e96b70a987835d9dc011b0b6c2dc02d03c9ab697304c1d0ae008c8f9b608af6d
MD5 b71ca46c88b8b7f683609143aa8a60ee
SHA1 3f679595e2476d58f3d58479e91ab3d7acbd2d4e
SHA512 9df512a0bf3ad88e7fdfef15be6abf701fd19842636d92ee3b1c8f44b5b4218f6f41c4d5af840b1d20b0d14400f687b57496baa23942b93ecd13b92317f73189
SSDEEP 3072:dhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:jn7nLQka3lLNngoqRttA7D
TLSH
T15634590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxupn.exe

Path C:\Temp\usmkecxupn.exe
Size 243KB
SHA256 fff9a4f7fee9a6420445eedbd8923e8319bf592320c79e5d10694348829cadba
MD5 b6cf584358f2879f0e98f1c0015b9051
SHA1 04714da2d11a16a5779406ca767202a54a403f38
SHA512 79b68c92a032508680a802e8c621ed108f0a4ac97122db88518a55f7bb2452cb5db0addf4b03631ea15c4a104277d787eb3bc99bf7acb76f8af5550b5db4a959
SSDEEP 3072:rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:tn7nLQka3lLNngoqRttA7Z
TLSH
T18434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjebwuo.sys

Path C:\Temp\ztrmjebwuo.sys
Size 141KB
SHA256 03dd62aeaa1e90a2a172f4a36a8f3c0473fa25fbf6af89d9ff46a5ba4e9e92a6
MD5 2ece63e4d0f2d3a83cc11213d5bad009
SHA1 a5bff58ec1ec261da87985e0ede77bc0263a9357
SHA512 750002de444e7e1b526c253c025809f1ea61a077d83e3607d647cfad908b2b242aef1daa2e7e00dec793ec428b72d87ddce12595e8aeb2ec2c1ddc8a1a6e43f5
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 09d43745b7beb0d2574056dfdacdb3449b786708a0b1a5f978e5c9d69f81a1ce
MD5 c5c86d9c5f7c32a8c4fd09d6ffda4aa8
SHA1 8d3978b900d523ba08075019d6235c1e176294cb
SHA512 e14f89cb3354fd6d7a68e1c291c8723a5bfd3d28140a150bf75ef42a2ef8212eddaed6f6db92cd69e603806f0897ef93b8761a51acd8b8db67878c4cf26ee23d
TLSH
T10AD0C040DAF02820D8046471242CF3C00E09CCA1CC43DA2124E0EF798D820C644C0DD3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ae6cc2452e81bfac2bd5549160ca359a47e4dd2ddbc7735478266fbec731c318
MD5 6ed9440c08d2366fcc9143cc29d90fed
SHA1 0373e0f0bc66f459fb83bd6b2eebe71281bd476a
SHA512 c06410535bc79246d71e45d6dd38708a3f941318b6ddede6df558e6b661b7103453a828db4507f641c2db2c6095d5faf9bc3ff5b56125bdf884ac676e1965db8
TLSH
T11141D1F3C3E8862E890195F0BA187E1BCE1D0654432C3D5AC5E4EF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 579d99c91ccefcc84bf18f8f7caded17b4136c38697741293d97dbae47cee5ce
MD5 2e5b5e963f105f5c5e38a0ac4fbc5321
SHA1 d99dff3cc8ce7028b2a8a7ee0327a46c865356f3
SHA512 0d5df8b3f7b8e0e8847dde0d81782ffd7b96c21f1e454b5fa6d10b86c159739c2e05c3006c4cfc28361ae963211061a7b0d2f4c545e9638ea15f13d244f34ea4
SSDEEP 192:sxZ66RjTyMqZ/K1Ml8UQycp/f3sz0KH7ROzodpZ4/W6+WNswv/Y0tdfrpIg545kr:sxZ31aqBp/f3sz0qRV6/b7/5hKvy
TLSH
T10F72E906AA389D77CCD7D219BA45BF63D7F8156392444E489AFCCA0C04E7AED210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ab9a3b519ea056d039e44eb2eefdb79da757de485c6ac0d644fe76d5d65480e4
MD5 d0d0844a52655bfdb021228afa7e6925
SHA1 7a9f5ca4cf5c606d899f2d56ef6d2082cb95fdbc
SHA512 fa018392556cb3c7ed58a1099fac3d2ee6a432cb703a42a6dd70ea650804b6c3b8a97335f64297b9641d4dcde76744c1ed2fe690ada402e45af9f94cc97eb182
SSDEEP 192:sxZ66RjTyMqZ/K1Ml8Mcp/f3sGeKH7ROzodpZ4/W6+WNswv/Y0tTkVpIgjzJ:sxZ31a0p/f3sGeqRV6/b7/5Cjl
TLSH
T14E72F8056A389D378CC7D209BA45BF63D7F91563D2844E489AFCCA0C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1130274ba34bf1d0dc9e427bbb4e63df5d13bcb54461f0d4f924087b81c3b555
MD5 8b3ede9117e9d3900212842e50b2c4bc
SHA1 b6abb59671d41e0ee7658c396cb0a30af21074c8
SHA512 2462c8a26466f269e555279ffc24ad49bd60948a6854cea9fd77ab7ea5170ed2587eaac7fdcfc919af0f81476e1f57823ecc665bba5b0b4349dcfacbb9c716e7
SSDEEP 768:2DhVP8b320P7pLuL/mKWRmmeQRe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HWWlLlV:2DhVP8b320JE/mKWRmmeQReu1jaKHWWN
TLSH
T148031B3B280CCB7F4F844E9CEC27BE9A6DE8018B9698899447FA444C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fcaf78a0e01a79d0add644bc003eedce4eb9fc536dc7c2e9c7aeba02c3ff3bad
MD5 a42c4853d14f6178dd63fc68deb4a9b8
SHA1 741b6ab1e9bd8723809cad7db6ff39aec285e286
SHA512 8a77898b5fa2abd29be090a1b439415b9a41bfd9dd704b7033d12913a1c98563eb174399a52e3df2a995372c9bce1f36e8fd4c8d9e08da3c076dc9147b70bef1
SSDEEP 96:KcMgKNqmuzuK8AzGYK7CWiGMKrqkEYKR6kGfOKUMLXaKMg3CWIKnKYfeKQo++JmF:qD1rjvYZ5V8fO9ddTXkrno9BBFhF
TLSH
T124B25C11313B13903ABE754A9155B8AF42C271633114F87B7BB904AA4F6BE24DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f5d82b2e-d704-413b-9e62-27cc6c13cae9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5d82b2e-d704-413b-9e62-27cc6c13cae9.tmp
Size 414B
SHA256 5eed4bc06dab1ecf19392dfa3e4954987d56ac40b63a8e05290a3236f966178a
MD5 8339f280a20a37c600370fbb33801c1f
SHA1 571dd9098fbb8152113dea38d9fda73090ef6aa2
SHA512 7096c070d84a6329160f9326ecdd7200b1876fea137b5fa6593893c04c2e2a2e5665c2a2696d2e8292a8ec08cc55a8d5f67bed863f1b1caab801a739bd364c7f
TLSH
T148E02BA9C865DC2B18FC176860640345F76013572A50898F3A3C860C8F74E3B558681C
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 99c82b5f8eccaa0e5ac62551d01a68193a6115a40016ae13d2453b3812ab4a8e
MD5 e6f1c15dcfb644d85db1ae09015fed9f
SHA1 ffdb91c98b4ebd3dda2ad54fc21ed39c5614b456
SHA512 e0716416690b814570d47bc344d2d6696c2f6a5047948789180de14861bf8403cbdebfc9c351c5bb180e527ef5b6d14028108be8a17ec1706bc2cfeb9eee6789
SSDEEP 384:naiFavqMg38Nm8TUNTUlIxBO2+4Or4LJB7SOrfpYQKcMLl5kNs9xEIRYV/Vw1mR4:RFayv3dwgO2ZB7HYQ0MsXjRYk1m37Fc
TLSH
T14CC25C35E854C9B7EDEA8FD9E70A7A07EEE00167D98C4AD8D6D81D1E00D719E230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 892b070bdfe09df705fde65cd2307f5f2b16db58563065eccea523f764d05087
MD5 000e3694fd8e99ec8a8bfa1d2df7906d
SHA1 bdef684e5d77e63718dfc1f8bcb0ce183795691a
SHA512 6e28feef7c0cad9d57259fb4aea89281dd09725f81234a5c0db44cddaa0e7ce48f68dd9f2009b9a686316c61fb1f0a5f3c81ea00887bf918998c5ed7178c6b58
SSDEEP 384:nxiFrcXqnX38NK8TUNTUlIR5O2+4Or4LrmlOrfpYQKcMLl5YX/isBqFvvIt2rN1d:YFzX3Vwgy2Zk8YQ0YasBqVIAd
TLSH
T105C26C35E8A8CD67ACDA8FC9B74F7643AEE01167888C5AD4D6C85E4D00C75DD270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d80e9ccced6504766b4eb2af32d827938ecfa71d3c4e646c44c20829ab65e075
MD5 c1c11a46ee24b53100567cf2e80e2953
SHA1 d99271481656ce86291e89d9f57ad54c35fde42c
SHA512 76685cbcf105097ac57422b8620b3e2a10a154e68d06c56a2d826c84dbb222a01921a56788447336f24f31fd64d63e1f721ac361f4a835e27cd2ccde5085da77
SSDEEP 384:nxiFWcXqnqi38NK8TUNTUlIRFO2+4Or4LrmlOrfpYQKcMLl5YXvisBqFvvIt2rN/:YFEqi3Vwgy2Zk8YQ0YqsBqVIAd
TLSH
T17AD26C75E898CD67ACDA8FC9B34F7643AEE01167888C4AD4D6C85E4D00C75DD270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3832ac3298a0be2cd01fd9d18e787aa583cf6dafdfa5a5e9b441bdbbe33ecc1e
MD5 d0389545cd347528576ac38002a4c98b
SHA1 ec26250ca9402603259a6eddecc5c0d78eb6936b
SHA512 09529c29104347a12dbde7ec5d00100381cae93504e8ae63198d2d1b944549643d20bd994edde66f268778882fa8b577fe22649bfc8e05caa16d2d4101f1c5c5
SSDEEP 384:nfiFavqMg38NG8TUNTUlIxBO2+4Or4LNrGOrfpYQKcMLl5YX/isBRYV/Vw1mR57m:qFayv3lwgO2ZDDYQ0YasBRYk1m37Fc
TLSH
T150C26C35E855CD67EDEA8FD9E74A7A43DEE00167C98C8AD8E6D41E0E008719E270FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a911f119885e193c9ec9e5dfb9921e2346297a9db2cfa7e11b6d7afd3224bddc
MD5 a667042c182bcd47edb60fb6b6d63f14
SHA1 32a2ef68e23f6060f5cd91932f333715e4997223
SHA512 64025ea5a83fa7eafa032d1cbf8bd7002c66821f5544a872e8e1c49934f7a04ae9095b961e21ed3024af8869b25fe86a5f2d0fd9bbe048bd473aaeac0be5128c
SSDEEP 384:nxiFscXqn538NK8TUNTUlIRFO2+4Or4LpmlOrfpYQKcMLl5YXSisBqFvvIt2rN1d:YFu53Vwgy2Z68YQ0YFsBqVIAd
TLSH
T102D25C75E898CDA7ACDA8FC9B34F7643AEE01167888C5AD4D6C85E4D00C75DD270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 46d536eab1e99b6cada17c181ddaa454f88e889924e0dce2198f33f9df43c39d
MD5 11d2d53fc2f447ee16514fd70ef27b7d
SHA1 cec0d640c8644524ce372dafcbd4f20ee020b20f
SHA512 f578e7cb19b5711911f1bf2e4bc003d1148f83a69536eac8198fe5942ccfbd57d1beeb081f3ddd8d7c21a70d52d221d9970a92eac00275bdaba0bf3a1188b7e0
SSDEEP 384:n/iFscXqns38NK8TUNTUlIRFO2+4Or4LBmlOrfpYQKcMLl5YXSisBqFvvIt2rN1d:KFus3Vwgy2Zi8YQ0YFsBqVIAd
TLSH
T18FD25C75E898CDA7ACDA8FC9B34F7643AEE01167888C5AD4D6C85E4D00C75DD270BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 00abcf41f37cce85a96a3f05601fb8503ca5789456dc5c149ba9d512715f4963
MD5 e42947c164dd63af63de6a026a71573d
SHA1 551584d93b9c8d22bb984f98aeaa71f1f91eb993
SHA512 a1861260e9ac542272dba43222e135c9f8a7e15567dd8e484f02ffd7992e6a38363389440a44dba358a509378eab365c6ecf9fa1f6a8b378d4af40484dbb4855
SSDEEP 384:nCiFscXqne38NK8TUNTUlIRFO2+4Or4LzClOrfpYQKcMLl5YXdCsBqFvvIt2rN1d:JFue3Vwgy2ZQ8YQ0YssBqVIAd
TLSH
T118E2C3F598D78976D89E4B87A37E2E429AFCC153B8484994F7C45D0CCC861BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7386e212f2eec38e1d53dd5e4e86348a8b91f082aecf53d9e0182b0bbe7d9af3
MD5 28a53be2d338247816cdd1ed4cdcc893
SHA1 f5d3cbd178e0fee3012f26dcd1dcd336edfa5aa5
SHA512 b43e54941e97eab0dba269524b64dfb43324f0776122075e6439e05ab758d240675ea1840f9e228dbc1d75fa3a0fe9efd4691f4b24bbb76fc740b6b9d27be264
TLSH
T1EA515EE05C3D1AD1D0BD1A3EB48B38FC81DCC72AF4A4347D6824EE880A3A60D604483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 96267db50672fe3ae7551e09826d59f7f083380fc8e91ec1f8009bd2269c9da6
MD5 dc654d866459761d9e7bb107b1f002f8
SHA1 812b8a1b77aa23a20e0fa808d3ba4d23716171ee
SHA512 7a15883eb52ec01f938efd5dc9bf6579a98a50a0407a9ab8924b1ee9d824b641dbe11a9c2e357d44d1673c092d7cb22967ba059049ddae0224f168d92179bc6f
TLSH
T107513FE05C3D2AD1D1BD1A3EB48B38FC95DCC726F4A4347D6815EA884A7A64D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8c2868fde215e77093207d371ec6605a594d9849fb391e68f73c82d755872e45
MD5 fb2e85964ff4ecd8fe5abc97090b1018
SHA1 c8eef782cfcacc21afe71008945b2f0790f770f5
SHA512 ab9e4d111c18e2a1960f53cca11ba7fdf4065c26e21bdc95c7436f1a9c64a5ec834025f9378acd0db303a6abc0ed1346c4b6894347119324453b09722997eda7
TLSH
T1D15140E05C3D2AD1D4BD0A7EB48B34FC91ECD726F4A4343D6814EA884A7A24D248483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a11ac0d44eb530066ae501c04df59992e1884fc29df8cbc94ee0900b58eb1b59
MD5 13acd1496ab6a69935952ae7562cb5dd
SHA1 4dd2668a01820b75d8ae94061a65f7fdd081ea50
SHA512 1a18eea9a29d4f4a0644d41b25c80d56a3bbd7764263b1807b8c12b26d56f80b16cec873960b52bd5759a0f4a2d6be254715ef4a886d1d2c183ee31d682d34fc
TLSH
T1AC5130D19C3D2AD1D4BD1A3EB08B78FC95DCD72AF4A4347D6824EE88463A61E604543F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1261730517\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1261730517\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1418018598\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_1517475483\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_357895489\manifest.json
Size 165B
SHA256 daf50c160ae8f5935baa4a7207e9d04afbbc81a6dd9ed02d99de12056743eeb6
MD5 8ff4c35081337b1ba6731cc36163c2a8
SHA1 31c80c4a98e5492fbf1b6b3e050446e7240c24a6
SHA512 1a616b9b797441fb438c89864beae36c1a151b1c85e1288481dc61d9f82df2c1fd5e002dbacc05d3070323f56325ed960df3e353d314eb2ee218f8e93aea3fac
TLSH
T1D6C0805294011D7419CE47150D5CE3889723D7152980B0155BD7C218DC3DC8B68F3B4D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1312-766-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2216-63-0x000002EDA5570000-0x000002EDA55A1000-memory.dmp

Download

memory/2504-207-0x00000230DF800000-0x00000230DF831000-memory.dmp

Download

memory/2772-575-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-778-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3080-828-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3292-355-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-218-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-648-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-587-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5060-745-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5432-800-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5616-701-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5724-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-182-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5968-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6092-623-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download