7fd919548b4485edf2b90850bea5129c2f030bb7fb09807ad1fd270e43e6aac6

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
Size 243KB
Sample260511-rbfbcsfs3m
SHA256 7fd919548b4485edf2b90850bea5129c2f030bb7fb09807ad1fd270e43e6aac6
MD5 0605641eb68d6b682a5bc192d61bb6c0
SHA1 63077d6ca1a0cc47254f92e092545804883fb422
SHA512 73af49b16b5018ed2ee6f5c907d77acd6f27eae696e576a7aecf4291040b8ba0437a92e3f6ee62f1338783a9d86391fd99800f4d672d1eadecfba2663a7d8bd7
SSDEEP 3072:YF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:U3frLQsa3lLNngoqRttA7M
TLSH
T1F2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4292	CP.exe
4980	mhfzxrpjhc.exe
1300	CP.exe
4872	CP.exe
4276	i_mhfzxrpjhc.exe
4424	wrpjhbztrm.sys
2836	CP.exe
4952	khbzuomhez.exe
3104	CP.exe
4924	CP.exe
4624	i_khbzuomhez.exe
1260	gbztrljebw.sys
1700	CP.exe
2304	wrljdbwtom.exe
3368	CP.exe
2992	CP.exe
4968	i_wrljdbwtom.exe
1432	trljdbwtom.sys
4404	CP.exe
2404	igbytrljdb.exe
784	CP.exe
3856	CP.exe
3288	i_igbytrljdb.exe
3212	tolgeywqoi.sys
460	CP.exe
4888	bvtnlgdywq.exe
2064	CP.exe
4048	CP.exe
1112	i_bvtnlgdywq.exe
2492	igaysqlida.sys
1568	CP.exe
3420	avtnlfdxvq.exe
3928	CP.exe
4608	CP.exe
4148	i_avtnlfdxvq.exe
564	avsnkfdxvp.sys
4960	CP.exe
804	qkicavsnkf.exe
1260	CP.exe
1716	CP.exe
3112	i_qkicavsnkf.exe
3108	smkfcxupnh.sys
3700	CP.exe
1544	kfcxvpnhfa.exe
3048	CP.exe
4728	CP.exe
4580	i_kfcxvpnhfa.exe
2940	smkfcxvpnh.sys
2116	CP.exe
3892	xupjhczusm.exe
4304	CP.exe
2544	CP.exe
792	i_xupjhczusm.exe
4820	zurmkezxrp.sys
2436	CP.exe
2144	pjhczurmke.exe
3804	CP.exe
2740	CP.exe
324	i_pjhczurmke.exe
4584	mgeywrojhb.sys
4816	CP.exe
3196	ebwuomgeyw.exe
2940	CP.exe
1168	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1752306688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_631821571\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1743087150\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1743087150\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_991320798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_631821571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_991320798\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_991320798\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khbzuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khbzuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3120	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
132	ipconfig.exe
1748	ipconfig.exe
4608	ipconfig.exe
3160	ipconfig.exe
1388	ipconfig.exe
1704	ipconfig.exe
3168	ipconfig.exe
772	ipconfig.exe
2404	ipconfig.exe
560	ipconfig.exe
1076	ipconfig.exe
2208	ipconfig.exe
2876	ipconfig.exe
3140	ipconfig.exe
4920	ipconfig.exe
5064	ipconfig.exe
2116	ipconfig.exe
1492	ipconfig.exe
564	ipconfig.exe
3108	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31252876"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4028047439"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229816599481344"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3847269522-1618051987-1942096715-1000\{29CBBC16-D24F-452B-A76F-C15BD0BC8FAB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4228	msedge.exe
4228	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	4624	i_khbzuomhez.exe
Token: SeDebugPrivilege	4968	i_wrljdbwtom.exe
Token: SeDebugPrivilege	3288	i_igbytrljdb.exe
Token: SeDebugPrivilege	1112	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	4148	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	3112	i_qkicavsnkf.exe
Token: SeDebugPrivilege	4580	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	792	i_xupjhczusm.exe
Token: SeDebugPrivilege	324	i_pjhczurmke.exe
Token: SeDebugPrivilege	3712	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	3160	i_wqoigbytrl.exe
Token: SeDebugPrivilege	3372	i_nlgdywqoig.exe
Token: SeDebugPrivilege	2876	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	4768	i_igaysqkida.exe
Token: SeDebugPrivilege	5044	i_xsqkicausn.exe
Token: SeDebugPrivilege	2108	i_spkhcausmh.exe
Token: SeDebugPrivilege	1464	i_smkecwupmh.exe
Token: SeDebugPrivilege	764	i_ecwuomhecw.exe
Token: SeDebugPrivilege	4896	i_ywrljdbwto.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3264	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	80
PID 3264 wrote to memory of 4720	3264	iexplore.exe	81
PID 4720 wrote to memory of 2652	4720	msedge.exe	82
PID 4720 wrote to memory of 3120	4720	msedge.exe	83
PID 4720 wrote to memory of 1944	4720	msedge.exe	84
PID 4720 wrote to memory of 1944	4720	msedge.exe	84
PID 4720 wrote to memory of 1944	4720	msedge.exe	84
PID 4720 wrote to memory of 4140	4720	msedge.exe	86
PID 4720 wrote to memory of 4140	4720	msedge.exe	86
PID 4720 wrote to memory of 3836	4720	msedge.exe	87
PID 4720 wrote to memory of 4784	4720	msedge.exe	88
PID 4720 wrote to memory of 3836	4720	msedge.exe	87
PID 4720 wrote to memory of 3836	4720	msedge.exe	87
PID 4720 wrote to memory of 4784	4720	msedge.exe	88
PID 4720 wrote to memory of 4784	4720	msedge.exe	88
PID 4720 wrote to memory of 3104	4720	msedge.exe	89
PID 4720 wrote to memory of 3104	4720	msedge.exe	89
PID 4720 wrote to memory of 3104	4720	msedge.exe	89
PID 4720 wrote to memory of 4036	4720	msedge.exe	90
PID 4720 wrote to memory of 4036	4720	msedge.exe	90
PID 4720 wrote to memory of 4036	4720	msedge.exe	90
PID 4720 wrote to memory of 3676	4720	msedge.exe	91
PID 4720 wrote to memory of 4236	4720	msedge.exe	92
PID 4720 wrote to memory of 3676	4720	msedge.exe	91
PID 4720 wrote to memory of 3676	4720	msedge.exe	91
PID 4720 wrote to memory of 4236	4720	msedge.exe	92
PID 4720 wrote to memory of 4236	4720	msedge.exe	92
PID 4720 wrote to memory of 2836	4720	msedge.exe	94
PID 4720 wrote to memory of 2836	4720	msedge.exe	94
PID 4720 wrote to memory of 2528	4720	msedge.exe	95
PID 4720 wrote to memory of 2528	4720	msedge.exe	95
PID 4720 wrote to memory of 4956	4720	msedge.exe	97
PID 4720 wrote to memory of 484	4720	msedge.exe	98
PID 4720 wrote to memory of 4956	4720	msedge.exe	97
PID 4720 wrote to memory of 484	4720	msedge.exe	98
PID 3208 wrote to memory of 4292	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	99
PID 4720 wrote to memory of 3932	4720	msedge.exe	102
PID 4720 wrote to memory of 1744	4720	msedge.exe	103
PID 4980 wrote to memory of 1300	4980	mhfzxrpjhc.exe	105
PID 1744 wrote to memory of 984	1744	msedge.exe	108
PID 4720 wrote to memory of 1172	4720	msedge.exe	109
PID 4720 wrote to memory of 1172	4720	msedge.exe	109
PID 4720 wrote to memory of 4628	4720	msedge.exe	110
PID 4720 wrote to memory of 4628	4720	msedge.exe	110
PID 4720 wrote to memory of 2744	4720	msedge.exe	111
PID 4720 wrote to memory of 4528	4720	msedge.exe	112
PID 4720 wrote to memory of 2744	4720	msedge.exe	111
PID 4720 wrote to memory of 4528	4720	msedge.exe	112
PID 4720 wrote to memory of 3144	4720	msedge.exe	113
PID 4720 wrote to memory of 3144	4720	msedge.exe	113
PID 3208 wrote to memory of 4872	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	114
PID 3208 wrote to memory of 2836	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	118
PID 4952 wrote to memory of 3104	4952	khbzuomhez.exe	120
PID 3208 wrote to memory of 4924	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	123
PID 3208 wrote to memory of 1700	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	127
PID 2304 wrote to memory of 3368	2304	wrljdbwtom.exe	129
PID 3208 wrote to memory of 2992	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	132
PID 3208 wrote to memory of 4404	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	136
PID 2404 wrote to memory of 784	2404	igbytrljdb.exe	138
PID 3208 wrote to memory of 3856	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	141
PID 4720 wrote to memory of 4312	4720	msedge.exe	143
PID 4720 wrote to memory of 3932	4720	msedge.exe	144
PID 4720 wrote to memory of 2544	4720	msedge.exe	145
PID 3208 wrote to memory of 460	3208	2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_0605641eb68d6b682a5bc192d61bb6c0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffddfc2c188,0x7ffddfc2c194,0x7ffddfc2c1a0
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,11384433234106229292,15943065126223805702,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
      4⤵
      System Time Discovery
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,9860956080109960077,10026905504251589350,262144 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,10403615899841639144,15884955581433672984,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:13
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17765126860992584175,16220817757247681185,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,15745017584732532105,1118774045356571648,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,17003025921391916572,9983016906923110959,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,18184752451283449318,6360790440404298933,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:9
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,13022043122361070069,7479044722634282526,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:9
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,10319214385394259965,8788708028551442748,2097152 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,13029138973217186246,422763374397290848,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,291134774476743625,12557936522284844917,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17606776805689279609,3350677870363622758,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,13933167559884661202,11114868907154484110,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,7335888561032536943,4190341822513785519,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,7335888561032536943,4190341822513785519,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,12736454630037728358,17511254759660701748,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16877610635755410586,16557150321747130023,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,6349682852882822278,17856767271782528381,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,14995461655051586944,4343772570799902095,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,2683881816639026167,7567154796172995953,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,14576939190475362203,2489019771931888409,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,5247345035185404501,7745683427671265840,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,9329651536978497783,8845122940122173920,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,1596476594802746957,7276455540239794951,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,11349729096998470117,16247152689664772187,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15824577770413759097,341823054103764232,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,14420984250175825498,16170407629792635959,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,15336170671561602107,7190348603495702689,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4140,i,15636147727826934397,1522115557698019499,262144 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,2896545191560230610,3598565560921405281,524288 --field-trial-handle=2080,i,15130532093513018848,3292725549094284965,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4292
- - C:\Temp\mhfzxrpjhc.exe
    C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\i_mhfzxrpjhc.exe
    C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khbzuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\khbzuomhez.exe
    C:\Temp\khbzuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khbzuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\i_khbzuomhez.exe
    C:\Temp\i_khbzuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Temp\wrljdbwtom.exe
    C:\Temp\wrljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\i_wrljdbwtom.exe
    C:\Temp\i_wrljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\igbytrljdb.exe
    C:\Temp\igbytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\i_igbytrljdb.exe
    C:\Temp\i_igbytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:460
- - C:\Temp\bvtnlgdywq.exe
    C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4048
- - C:\Temp\i_bvtnlgdywq.exe
    C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1568
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\qkicavsnkf.exe
    C:\Temp\qkicavsnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\i_qkicavsnkf.exe
    C:\Temp\i_qkicavsnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3700
- - C:\Temp\kfcxvpnhfa.exe
    C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Temp\i_kfcxvpnhfa.exe
    C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupjhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2116
- - C:\Temp\xupjhczusm.exe
    C:\Temp\xupjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupjhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Temp\i_xupjhczusm.exe
    C:\Temp\i_xupjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2436
- - C:\Temp\pjhczurmke.exe
    C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2740
- - C:\Temp\i_pjhczurmke.exe
    C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1168
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
  2⤵
  PID:1800
- - C:\Temp\wqoigbytrl.exe
    C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
  2⤵
  PID:2592
- - C:\Temp\i_wqoigbytrl.exe
    C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  PID:1192
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  PID:3684
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run
  2⤵
  PID:4700
- - C:\Temp\qlidbvtnlg.exe
    C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
  2⤵
  PID:4288
- - C:\Temp\i_qlidbvtnlg.exe
    C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  PID:1504
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  PID:4020
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkicausn.exe ups_run
  2⤵
  PID:1724
- - C:\Temp\xsqkicausn.exe
    C:\Temp\xsqkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkicausn.exe ups_ins
  2⤵
  PID:4036
- - C:\Temp\i_xsqkicausn.exe
    C:\Temp\i_xsqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmh.exe ups_run
  2⤵
  PID:1476
- - C:\Temp\spkhcausmh.exe
    C:\Temp\spkhcausmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmh.exe ups_ins
  2⤵
  PID:1472
- - C:\Temp\i_spkhcausmh.exe
    C:\Temp\i_spkhcausmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwupmh.exe ups_run
  2⤵
  PID:3764
- - C:\Temp\smkecwupmh.exe
    C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwupmh.exe ups_ins
  2⤵
  PID:4780
- - C:\Temp\i_smkecwupmh.exe
    C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhecw.exe ups_run
  2⤵
  PID:4520
- - C:\Temp\ecwuomhecw.exe
    C:\Temp\ecwuomhecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhecw.exe ups_ins
  2⤵
  PID:2356
- - C:\Temp\i_ecwuomhecw.exe
    C:\Temp\i_ecwuomhecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrljdbwto.exe ups_run
  2⤵
  PID:3592
- - C:\Temp\ywrljdbwto.exe
    C:\Temp\ywrljdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrljdbwto.exe ups_ins
  2⤵
  PID:1336
- - C:\Temp\i_ywrljdbwto.exe
    C:\Temp\i_ywrljdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
- Executes dropped EXE
PID:4424

C:\Temp\gbztrljebw.sys
C:\Temp\gbztrljebw.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:1432

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
- Executes dropped EXE
PID:3212

C:\Temp\igaysqlida.sys
C:\Temp\igaysqlida.sys
1⤵
- Executes dropped EXE
PID:2492

C:\Temp\avsnkfdxvp.sys
C:\Temp\avsnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:564

C:\Temp\smkfcxupnh.sys
C:\Temp\smkfcxupnh.sys
1⤵
- Executes dropped EXE
PID:3108

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:2940

C:\Temp\zurmkezxrp.sys
C:\Temp\zurmkezxrp.sys
1⤵
- Executes dropped EXE
PID:4820

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
PID:1780

C:\Temp\gdywqoigby.sys
C:\Temp\gdywqoigby.sys
1⤵
PID:3176

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:3848

C:\Temp\sqlfdxvqni.sys
C:\Temp\sqlfdxvqni.sys
1⤵
PID:1864

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
PID:560

C:\Temp\hfzxspkhca.sys
C:\Temp\hfzxspkhca.sys
1⤵
PID:1416

C:\Temp\zxrpkhcaus.sys
C:\Temp\zxrpkhcaus.sys
1⤵
PID:4460

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
PID:1152

C:\Temp\geywuomgeb.sys
C:\Temp\geywuomgeb.sys
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnlfdxvq.exe

Path C:\Temp\avtnlfdxvq.exe
Size 243KB
SHA256 5dd832eb9b290aafd0ef353df4d1c886ad9eef7d29a200daa61e83c74387f337
MD5 c65879531337b4fff969376401c314fd
SHA1 0d4309e5f35c2ceca61e06d6833a3b33caf98003
SHA512 d131caa3419d74bd23bd1db83acbc15eda1e217850d5223384a404d5fc81f3e0907b930459890f81b95dee5fda636e85eaf336e910f7d14fdb9235b9c70c047e
SSDEEP 3072:iF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:y3frLQsa3lLNngoqRttA7+
TLSH
T128345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.exe

Path C:\Temp\bvtnlgdywq.exe
Size 243KB
SHA256 240ae50fc4f29c1acd03e38a6f50b648d81c97f730b6bf6fbc28da179e70bc6d
MD5 4265f71b97dd9c095891bca63bda254f
SHA1 3bcb8932a34b55a0322055484a92345bacf21546
SHA512 f173d8a7f91094b8c5e9d2bc12beaf9959dee6b758170ed7c78ad250ae6ab41c33019e0f3a118833d3c10769a15661ea4d02bcb76f075abf63baf0654109c271
SSDEEP 3072:SF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:C3frLQsa3lLNngoqRttA7S
TLSH
T11A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljebw.sys

Path C:\Temp\gbztrljebw.sys
Size 141KB
SHA256 2e818bdd2c1fd8d99e93087046e7bfaec44c20942b97d82d61f83e49b09eecc8
MD5 eed64359ed43b0ba79c58635de017380
SHA1 6b73b47e2032ba81998f26f793ae43b6a7a3dda3
SHA512 4e247e6f7785293fc8a8799414a162e9be87e0b90519618f0183b2e9cb49fc0a69923c31e210f5af7a160891eef08f5996286f7df2c03ae3573a00778e49c8c6
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdywq.exe

Path C:\Temp\i_bvtnlgdywq.exe
Size 243KB
SHA256 46ddcaf4a63c2da81e7dc924a9e6fdde3da23c1f20737b66a67e11da4e8ddbfe
MD5 0b974ac202d970f0027cce06580369b5
SHA1 540ac071dcde360dd6402a33bdaef66c1a48c69b
SHA512 cf02301024466103e177c06bad07a15878e1f0aaf2699e1e470bc34ac6f67685e4b8cd91daacfe6dcd20aab52d073eecdd9c7e6e6ba4697a303f7c89942d5e35
SSDEEP 3072:pF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:L3frLQsa3lLNngoqRttA75
TLSH
T165345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytrljdb.exe

Path C:\Temp\i_igbytrljdb.exe
Size 243KB
SHA256 1322851edc2fdaf9c8242e4d18ba06f6ebb4d445b5d8062feb7572e066900127
MD5 f2db3469a38738e865d3149bfc988a46
SHA1 178855d3f3e5e10017150c4cf8f99dde0fac1097
SHA512 a058a29f6644da62c6e1fa65af747fca49caf6be0545eb455c480bddc2813ca76e9c575256042d7faa901a41c14442e0d84960177e0ade7898f4ef6e3e2c5dc3
SSDEEP 3072:oF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:E3frLQsa3lLNngoqRttA7k
TLSH
T101345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khbzuomhez.exe

Path C:\Temp\i_khbzuomhez.exe
Size 243KB
SHA256 3aeb0312ae5d0f72b0a4367fefbef9ec6680d03df3bd0bfa85954826bb2098bf
MD5 31e9629e44fc59463587321d3f571224
SHA1 60f342144426353cbd01f269967392864304f00b
SHA512 f6875672ab7b4c0cc740fd4eed703945f1781fd34e89e4b22b8b8d439f9c0ab120529f09a294767f6ca618c250f4bfbf3a5d6cd1ba7966e3907fc850dacc5ca7
SSDEEP 3072:XF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:V3frLQsa3lLNngoqRttA7j
TLSH
T13C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpjhc.exe

Path C:\Temp\i_mhfzxrpjhc.exe
Size 243KB
SHA256 0ea8d0a843dc897850958c039b32a2ca4358d0b1c20022891f8fcf559b8f183c
MD5 c5788c56825587d6866acd7b2c8929fe
SHA1 ad19f37bd5e0e2f969b53c633637a1a8fbb4fcf0
SHA512 bfc6e24be338a440a10c2363a247de6b4ccac60263cc7fe0f62e1c1d2a69a50d415afd6a5fba90035ddbf71ec88352c75cf389ee9b549f5b74f0a4336c3a09f9
SSDEEP 3072:7F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:Z3frLQsa3lLNngoqRttA73
TLSH
T15A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrljdbwtom.exe

Path C:\Temp\i_wrljdbwtom.exe
Size 243KB
SHA256 0dc4797c864ed7b57f2222e38b76e6f235975830012f83dd5981b7c485e2c256
MD5 05286597166dbade2cb475b02e9f7f9d
SHA1 9413712d62120d4a4f649b6a6723b5b1aa1cb395
SHA512 dfa10f76604509ee9ac5eb10d54d3938498be858d64cdbd651b52db902b9a8cf86b7edd56425da4884dce165111fee847b20bf773b5e6fea465e2708fd4e4a78
SSDEEP 3072:wF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:s3frLQsa3lLNngoqRttA7o
TLSH
T1C5345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlida.sys

Path C:\Temp\igaysqlida.sys
Size 141KB
SHA256 9f3b87992b2e63e576bd75094288c756243bf596e498bdacdbbc0b030624ff2a
MD5 08d4fb1e8e48409646da2a965ac1af14
SHA1 598acf573f8994563586b7ea4ae309f349bcd7ab
SHA512 d29457541e438b8b99ef7d4c1146262530c48092bcf1204350c239109faea2792353961cb7aaa261706498500b6db28551b18a9deb57f483759c13a535586b29
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T174E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytrljdb.exe

Path C:\Temp\igbytrljdb.exe
Size 243KB
SHA256 47e82e7f7551ecfd7ae0aba605c5ed97c7f629ebe399ca86881dfdfa0c8e04fa
MD5 08f1ff1cf48ebb5a0e07c1df68bee90c
SHA1 f5a209bf348d7fafd2b2401e3539674475b2062c
SHA512 e9f8d18ce4b22bbdfadf7b9719f4c1940fd4ad6775f58e1569ac4f45e19f0daf0aa3b37a03bce5188a663eb623c796304374c2c249e422e9bd8a5e880fe2b2d3
SSDEEP 3072:9F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:/3frLQsa3lLNngoqRttA7F
TLSH
T189345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khbzuomhez.exe

Path C:\Temp\khbzuomhez.exe
Size 243KB
SHA256 110d9340e3a9d26bf54c66aba77d7b05c408fccd2cb5948e8739b99fc4c48a1b
MD5 4de66c1482c439a754fb4d68dce30c72
SHA1 863878de714137d7a8c0169e2f81bafbd6f4624d
SHA512 6c20eb3da6fd139f48ad2046cd42d1585cc7339a89a05fd979b868a9b5eedf22ba23c214fa139469eaaf81aba84eff2ed7a6941635809d81dca74dba9e49eb8d
SSDEEP 3072:ZF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:b3frLQsa3lLNngoqRttA79
TLSH
T18E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.exe

Path C:\Temp\mhfzxrpjhc.exe
Size 243KB
SHA256 9618542130e690e919ae16b94639bc209ccfb5f17e20af562806c97d5a236188
MD5 2252bf3bcba1c33d12aaedf1a6fc884a
SHA1 cac36b1704a30fc7a2cba9507bcb8d49eaf75663
SHA512 7cf381b5ee981c0021af65b9fd76f8d78fa01c829f8014702f844b5ab5b21ba348f2ee1d1fb267bc9b582189c00ad8a93e26038e2df9bd1fc405931f0fe620e0
SSDEEP 3072:HF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:l3frLQsa3lLNngoqRttA7v
TLSH
T1C7345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoi.sys

Path C:\Temp\tolgeywqoi.sys
Size 141KB
SHA256 2a753cf8bc033b7c2b81805828615f2ae573595acb7d7e85cf1f20364957221d
MD5 9d0e6fc1662dc47f9c2041839d153718
SHA1 83a77fdeec196b6cef96697c1729ddb0a1eb4a0a
SHA512 a92d13091ac67a0e2ba93e64fa3c1106ebc278c44ed2b7d6646e944468c82e942649c0a989d367050bc4017a2edd14e8941b213bd753ee3f8fe246154b42f9b9
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.sys

Path C:\Temp\trljdbwtom.sys
Size 141KB
SHA256 6873738d8164b149b41ffba6668a378190b2ab7e1fb57cee1921569446f27699
MD5 02ca5b32a9f41d6429813c07d0d5e6e5
SHA1 4cc5b959787f27343357156f05a56510e5463095
SHA512 3435b2cc9317207893d98fe140e2eecfb701bdf05999a8d10d98c78a70e37b4cba9685529d2bb24034a862595d62c9bbc1e5cac0c04c27541bf2306e0aa79ce8
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrljdbwtom.exe

Path C:\Temp\wrljdbwtom.exe
Size 243KB
SHA256 2fe53ecd1383a69db2b3593e7efe5ea64ae5207ce056fd6ff0a75f70938622df
MD5 c5d0b6a27a94db944e42eebe8724fd51
SHA1 2991788373bf33107756316d371e67a86152c949
SHA512 83d29f8456c3f6b9f07773ac7a20f1ccfa262857bdd4e32591b43738647bc0ac37e3de92df3a3e43b9df9629e1ac8d3a6ec2780bd056a1b28983b8f0967116bf
SSDEEP 3072:ZF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:b3frLQsa3lLNngoqRttA7d
TLSH
T167345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.sys

Path C:\Temp\wrpjhbztrm.sys
Size 141KB
SHA256 68d6ff8d5a1efd9681997b8107f424cb64d54f24d1832073f29044396a6d004f
MD5 0cf68d2a5856a631d5cfe095ce3ebfa2
SHA1 64e242d5916b1ec4962e5ae6e6b0d9d79f680f81
SHA512 7efb2720145c70c9f713bd80a568053add5098f58bb22a767b1dccf48440a777193cfe3354cd579c89ebab6c4f429905cd757cfc85e94d53f5df903893ec42a6
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6a6727a0a4fa4cb1a57a4c321f756d9dd6f44ea45d205327c5e7e5f18c2f6950
MD5 8f53b23305ec44c09bb086cb47d00ebe
SHA1 a54d190b6b6e3b05a68b18a4e38bc67e0d914f6d
SHA512 24004588102e1fa8a9bf07c27541083145da06836345681ba0f438a086ca89db4bcfe563005d6b736f731acf1ba98f4abfdd021ee48bd0cd93d4afd01bba7f70
TLSH
T1DBD0805C57B76C31E554AD7004573F15BA55D5B39B49973164732C791C4104215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e365308021ade71cd7fd8bcb77743afa8328c70101415bb9b419c11ce7afa8b2
MD5 20d252cf697b00581a3fc1a7eb0aa400
SHA1 999f264f6caea10fd708d20094aec5024868af67
SHA512 7bdbd68d07d0b20ca7f49d51c821765822e32a81d51915eddc65d999ab43472632b096aaaf0a8fc634bc0a88ab61a5ff5c5b9e3a19f7fb7623f3e7b7a69eb13a
TLSH
T1ACD0805C17F76C31E554AD7004563F15BA55D5B39B49D73164732C791C4208215911C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6783a2ca745bcade0132ea3a0442142c51c734bbc3f02329ec074ad643aff436
MD5 4ca79ec7b2504f9954235cafaa434c03
SHA1 5e7c8553d9b63dddaa091db75528398aed275038
SHA512 4d376f2ae54332fbc16d9f2c8cd73ee81c5fb9284bd0498a7081ef6ec648757a4c2467094b0a5959de04fc0552413bb1e877572b4edca273d724166c6012929a
TLSH
T1CC61D44471D69618EBF84274378F2006BAA3556B077F0E5BABD44A7CAB2BF0261CDC01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c90.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586c90.TMP
Size 3KB
SHA256 c73a1cc148d5f4dd1c7a5725c20c31724b8555e4481505b17ca12df5cfd2f3ea
MD5 273a35291877b0361b9fa72ab0a2e9e2
SHA1 a19ed1d164da0c8b7980e2700cbfa0bbc1996cbe
SHA512 7095fb8e2e0dfd749d7c48098ef36ea9127b356e42d5f88bef477220d62da9ef1402282c813eb1cd26d4be53369a63b461356929a4abdd1581af492584744750
TLSH
T16161D44471D69618EBF84274379F2046BAA24567037E0E5BABD44A7CAB2BF0261CDC01
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9f0e82831427c96764158ed5a9758000f31bb38bd4bd4d6000ca12dc9f549327
MD5 e4b22a0b91b94d24c4733f2c6d851798
SHA1 ba95327e4862324298add33580efb917fa89d114
SHA512 4966a87cdee18f768b2adc9b67550df18794e2c79862b7e7baee49b7ced4310da174b9349ca00dbe4f131738332ef80f07ab8cdd1b95825248ed0ac2658c3e60
TLSH
T18A41ADF3C3E8866E8A0156F0BA187E2BCE1D0954532C3D5EC9E4AF1B97E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c0d16976a23c177c89267d2262cbfda660a981f2fc0704021d621b0732e87a7
MD5 d05397686e22ead0b6ea8f06bf182d4b
SHA1 358a31e386619b4b6037c5551d98835278e392dc
SHA512 7da96f94e5b370e0ef5ee6a87aa55aaff74203ca09540dcdeefb659d2c16386f2e36a16d9dc67161956ae8136abf34752b64bf55db0f58178c4d410a7a724721
SSDEEP 192:sxZrRFyM//K1Ml8Mco/f0ssWhwhaw9Idp/V/W6+WNsoO/Y0GsK5PIg4J:sxZrj0o/f0ssWWgxd/bu/5gc
TLSH
T1C85208067A34597BCCDBD309FA45BF53D6F8156292944E44AAFCDA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92c85c89aca6c2ff0567004d7572605e3540a2aec5c9b2be680c1db4bf1f796a
MD5 7a47b186ebc4ffdcd8fad1e9ff936117
SHA1 204c384f7a4f9900c31d44010eaf036a3ca646de
SHA512 26429a0f73cb3e0a76701be2e2918993c69a7d67ba5cd1df2d4757b5a119c0666d0b90af30f6cfff61a10972c1fffdb479f6c6de42c27de8a45a14793b74e1ac
SSDEEP 192:sxZrRFyM//K1Ml8UQfco/f0s+Mhwhaw9IdpZV/W6+WNsoO/Y0Gr9msPIg5bJ:sxZrjq0o/f0s+MWgxv/bu/53iz
TLSH
T1BE62F806BA345977CCDBD209BA55BF53D6F8147292904E44AAFCDA0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 1c3b3555e3e0985e96862673d1223fccbd05464ceef1938d1977552a2004a78c
MD5 99167ea8052203543045419855f85b43
SHA1 e0827032d784894784b163d3d9fcedfccfba3f35
SHA512 4f4c584bc31576692028963ecbc99a8916b2ea6d9adc67826c11c6d67caaac80093958ee9b7cdeb1699107f6644c471702acf013fc3089189364359374639264
SSDEEP 768:fw91L8/j2c97pLuLnqeWRmqSQBq8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3e/zJLlX:fw91L8/j2crEnqeWRmqSQBqu1jaKe/zj
TLSH
T164030B3B3C4CCB7E4F804E9CEC26BE9A6DE8018B9698C95447EA444C03C77EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e4ec33cf9789bb66cf2b9d1597a36f589aab5ca5bc47a18c7518ddd7dcd6773
MD5 5094a7c27ae02508e88c42c754db33ae
SHA1 dc67582991f4ea05d3205c821c03474dd4efeac0
SHA512 ae417570c6acac029a72655b856d0cb655f87056974fb8d0e7cf2a2ee906e7324d4ba2f2f18ad6d59c2d2b4f7206dc23d67b82184f2d871c9a366910995071b4
SSDEEP 48:KUEIfKN+cvypQI7KIsQrylxI1KiIoIkfeqsm:KUEgKN+eaQQKIsO+xKKiIJkfeqsm
TLSH
T1BF91C491B13722403A7D254E85E4B4BB02C271633129647B3BFC96665F27EA0CDFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

392c2179-071b-4634-81bd-338691f52bac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\392c2179-071b-4634-81bd-338691f52bac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 37f2c4d970249872c5071290d79bbe069d37d69f8e5cdcfa76e46eeb496167c6
MD5 1102f683d4d2f860a3d61f98d7a2daa5
SHA1 10896d06d5fa2040e44182ba70829b85150b36f6
SHA512 8c9b62c74dc066ca95e999f8c32d9c7d87fb12b88901fedd228a07438f0258c06790ede4e03e1f1b55d564a79dea1b49a829fa6f1794089cf5372099776de2e1
SSDEEP 384:nOZCcmyWCJ8NwoRCyO2pbDryVJX5Q/5+/88fNalzXX86zse4KV8p0Jmk:bcpJoRnAw4vSM6zsI8p0h
TLSH
T1CA827D7168395C3799E7A249F48B36438EE46077A6D56F94EAFC8F1C018B2AC174EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 29812ecda2221a1eb070d407eee3d607f7a2d27bc5e8ad231b1ac13bfeab2657
MD5 173b717aca908634e12e81d424bde0be
SHA1 a4fc62de0d2bec9aba8b04bc9ab39e509fc155b4
SHA512 6ff9a4839a078777ec205a9fa0a602541ca60a842e798075c6a354c2586f969dcc19411b3dce7d9aa41c78a2c39bec607eb1af70b79672188a9af4fa12e7fef3
SSDEEP 384:nOZCcmyWCW8NwoRCyO2plDryVJX5Q/5+/88fNalzXX86zse4KV8p0Jmk:bcpWoRdAw4vSM6zsI8p0h
TLSH
T1B4827C7168395C3799E7A249F48B36438EE46077A6D56F94EAFC8F1C018B2A8174EC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2bc6cd32334c0fc58dbc406b1143c16a181da7e8670f5754a14db3f58520d866
MD5 6967a91fe83019b7e3d240dc931d33c6
SHA1 1f1cd1ede8cc075c8b61169e4ab37c262e210bd6
SHA512 5842921ff248e97755afc247fb753829c5c43a0bb4b08bbbc06fb0eeaf42cd3fc7bfe85ae5d233fc2c94b4718d3daad7075aaa9d1c6f42612327dfe5b31cab95
SSDEEP 384:nCEiF2CcmyWCDo8NL8TUNTUlIlPRCyO2pMa3ryVmxfYMX5Q/5+/88fNalzXX87zv:CF1cpDo4wgJRn7EEw4vSM7zsI8p0h
TLSH
T181D280F198D78937E8AE5787A73E6D428DBCD06375889994B7984D0CCC861BFC70AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 2c251ed41cd6be7b11934ad626fac2c55ac9ea3ecd8027aeafdcfe641ed68b7e
MD5 6037a219823259cf237bf998b289e1e8
SHA1 f488bd95217e9bb7240b57bc28bd1db114295c13
SHA512 f1861844da382e9af34ec323d56c51cfe1a387897f54b569a5e158052836bae87ac154c309e098c1c9dfff663eb8a5e095939ce37e99c77ee26a905a162a2f78
SSDEEP 384:nCEiFYCcmyWCDG8NL8TUNTUlIlPRCyO2paa3ryVmxfNMX5Q/5+/88fNalzXX8nzv:CF7cpDG4wgJRdbpEw4vSMnzsI8p0h
TLSH
T189D280F198D78937E8AE5787A73E6D428DBCD06375889994B7984D0CCC861BFC70AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 42850e51f40911a830398ef1191db413bcd15d0687430aad129529f0a97af706
MD5 d6bca3a272f1e7ceddb2a62a6fc4c454
SHA1 e033ea59626a6d4462f929d9e8005f78b4e9498a
SHA512 df0333c4e149f8c2e0503344de4f66a80b196b235ed622c93fb85ee36bf65aa6f4f9ef7c41f35e87a6474b2f42599841ee2ddbc4a55119cc3ad6e8fb4def0aea
SSDEEP 384:n6VCcmyWCx8NwPRCyO2p5DryVJX5Q/5+/88fNalzXX86zse4KV8p0Jmk:RcpxPRJAw4vSM6zsI8p0h
TLSH
T163826C7168295C3799E7A249F49B36438EF46077A6C56F94DAFC8F1C018B2A8174EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3845dad5da25ca096cbc77110adadcb8f421ffc17c11390db640185c4cc33c64
MD5 d77e8b6bb9d14c4edef9eac76731a223
SHA1 015c7733d7b51ff2fbb503266ea77da2a625bd2b
SHA512 9a36d107f3262c16ac584dd2c7ee0d09cbb3c64bacbea5a3d89baf13f435f62c6abe491361a18d73c098c9f03b179f157ce6204974052679a30fb4d70504adab
SSDEEP 384:n64CcmyWCU8NwPRCyO2poDryVJX5Q/5+/88fNalzXX8Dzse4KV8p0Jmk:wcpUPRWAw4vSMDzsI8p0h
TLSH
T13D826C7168295C3799E7A249F48B36438EF46077A6D56F95D6FC8F0C018B2A8274EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 c401c0ac0e1ead5773d1ad01ab1a68edb0f59e37e4a7cbe6b5abf1b9e37bbfdf
MD5 a2d8913ee7e5add377a58f52168d0967
SHA1 0e2fc8f70a5b0b5bd8506c19223a42e3ab778327
SHA512 542a6bf7c39d1c35b7d20ca6e0a8fb90fc3652cabdce5c031c1310604d6d465aa61dd001aafb407fe78848aacce9196874af3e9e8a2990b795653055e0809c0b
SSDEEP 384:nCEiFLCcmyWCDe8Nw8TUNTUlIlPRCyO2poDryVmDf0MX5Q/5+/88fNalzXX81zsq:CF+cpDe5wgJRWSEw4vSM1zsI8p0h
TLSH
T1ABB23A76E869CE3BEDE757C5B64A7643DEE0106385C99ED4DAE84E0C00872DD170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e1a2548d05e68deb15898725683f6bccecf27f7e4d04e871532ce21bca46fad2
MD5 44736c11bef3310e556933410af8b331
SHA1 842d5f4768a2986cbc809ffac84bca02d69eb125
SHA512 35168756ba2d2a3ca4798e19689170b4be9ab0627702493083d5d43cb86856c64f8716d36ce86c1dcbba266b1f3bff90f743319395033f745975b755ea1bdc5d
SSDEEP 384:nCEiFHCcmyWCDq8NL8TUNTUlIlPRCyO2pxa3ryVmifNMX5Q/5+/88fNalzXX8Azv:CFicpDq4wgJRQbeEw4vSMAzsI8p0h
TLSH
T15BD281F198D78937E8AE5787A73E6D428DBCD06375889994B7984D0CCC861BFC70AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 20c782df0512836363169655b2657fd366c35abcaf2adff5d4545f3e1edfb9b2
MD5 331e4ec26332bb03dc59baef1b8c26ba
SHA1 36df8679c1907314acb1aa43412d54c7971b277a
SHA512 2737f38358d43194a39beeb6851550870f08f07a95f2fe9613be4c38214f8771956c9d1156f322d659c84452357fa21dcb09a5615b5bbbc362867d1f145dd3d4
SSDEEP 192:ZGNR6hNQmiUyDGhoNYX5Hw/5+/MjzorfNPCfWYzHuZU6:ZGNR6R4GGNYX5Q/5+/88fNanzOZU6
TLSH
T15C02D839B8687C7B8EF26E45B54637179FE5116BEA951B84EAE80F1D00C765C2305C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 44c1765b35b9ecdbd37d0af5e4dc207f2c33026c66a9c78541c4ab9505f66e17
MD5 5e7f83ec176a37706a08cf2ecc9c046a
SHA1 5de60585b8306da878d7770924a254c60cfe2c9b
SHA512 67ad5930348ddd1e9416e5fdf966cefc1cf7ebc5051f83e772c8ea779a7d3fc6d35ed2caed7dc4b0a97c2edc5bf754681da2150df62e45cb8d9d723719712c21
SSDEEP 192:yHGNR6hWvQmiUymloynYX5Hw/5+/MjzorfNPClzXI+8nPqLzgqc5U6:yHGNR6sxPqynYX5Q/5+/88fNalzXX8gi
TLSH
T180121875B468AC275DE3A549B4C732939FE5117BEE899F84E6F80B1C008B65C2B4DC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 32689aea8b065bef6eea1680c8d796be681fb54ec6358989cf34b4bb2e03bfed
MD5 07e0b86c12d26a366522cc7925f73b30
SHA1 da1fbc3bd4215077be1a5486236a0cfee71403bc
SHA512 3921a9f023ee98113e79232f4efdf92f91f7b28c8e316512a9a9dc0d2656b634b90eb8590c47ae5a77c1fcf951e02d6629e668c8aa55702ffbfa0e996c735917
SSDEEP 384:nCEiF0CcmyWCDT8NL8TUNTUlIlPRCyO2pxa3ryVmDfNMX5Q/5+/88fNalzXX8Azv:CF/cpDT4wgJRQb7Ew4vSMAzsI8p0h
TLSH
T166D281F598D78937E8AE5387A73E6D428DBCD06375889994B7984D0CCC861BFC70AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

8947bd45-dfdd-4b14-b198-9b4af9545340.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8947bd45-dfdd-4b14-b198-9b4af9545340.tmp
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

32d92255-89a6-433c-8f58-2e815b013965.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32d92255-89a6-433c-8f58-2e815b013965.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

22cb718b-fd76-496f-9412-f628c1bbf50d.tmp

Path C:\Users\Admin\AppData\Local\Temp\22cb718b-fd76-496f-9412-f628c1bbf50d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

dbdfe8f3-b208-4a19-b840-4c5d8b05ef7b.tmp

Path C:\Users\Admin\AppData\Local\Temp\dbdfe8f3-b208-4a19-b840-4c5d8b05ef7b.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

480e9847-a183-4557-92ef-1ad4cf9035fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4720_1321070184\480e9847-a183-4557-92ef-1ad4cf9035fe.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4720_1321070184\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1743087150\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_1752306688\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_631821571\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4720_991320798\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-788-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/564-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-841-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1260-530-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1416-811-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1432-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1780-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1864-774-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2492-612-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-853-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2940-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3108-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-742-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3212-578-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3848-754-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3932-527-0x0000020DCF0A0000-0x0000020DCF1BE000-memory.dmp

Download

memory/4424-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-823-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-706-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-728-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4820-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download