93bcf630dd52ca1ac09f4dff3373ebc0821b36571060f48cef8b574a3fa15d6d

Analysis

max time kernel
149s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe
Size 243KB
Sample260604-tnelpsbt2n
SHA256 93bcf630dd52ca1ac09f4dff3373ebc0821b36571060f48cef8b574a3fa15d6d
MD5 f7cc6e5d05be4bb83ba47d361fb67221
SHA1 d0a13de428d12c9e9e429a8ce9c397cf4dd65beb
SHA512 9791111fe6b874ca4c8b6a10937cf566e663416038048e598cc0ef9b1b07af59db686380577dac90d92b49a003af0802ac3fde39a72c5545e3c1149fca4551b2
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:/vMsLaOa3lLNngoqRttA7G
TLSH
T141345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2888	CP.exe
912	vtolgeytog.exe
4428	CP.exe
4756	CP.exe
2036	i_vtolgeytog.exe
2500	ytnljdbvto.sys
3384	CP.exe
4336	lidavtnlfd.exe
1184	CP.exe
3656	CP.exe
4684	i_lidavtnlfd.exe
3200	lidavtnlfd.sys
3452	CP.exe
4284	aysqkicavs.exe
2468	CP.exe
3248	CP.exe
2496	i_aysqkicavs.exe
2612	icausnkfdx.sys
540	CP.exe
4896	mkfcxvpnhf.exe
5040	CP.exe
644	CP.exe
4248	i_mkfcxvpnhf.exe
1232	zxvpnhfzxs.sys
2512	CP.exe
2724	mkhcausmke.exe
4412	CP.exe
2464	CP.exe
1564	i_mkhcausmke.exe
4556	smhfzxrpjh.sys
2296	CP.exe
840	ecwuomhezu.exe
3648	CP.exe
1100	CP.exe
4696	i_ecwuomhezu.exe
3588	mzwrpjhbzu.sys
2416	CP.exe
4072	uomhezwrmj.exe
3344	CP.exe
688	CP.exe
488	i_uomhezwrmj.exe
4128	cwuomgeywr.sys
2812	CP.exe
4700	mgeywrojhb.exe
2500	CP.exe
4612	CP.exe
4920	i_mgeywrojhb.exe
2244	wrljdbwtrl.sys
2344	CP.exe
2588	lgbywrojdb.exe
1952	CP.exe
3036	CP.exe
3044	i_lgbywrojdb.exe
3316	igdywqoigb.sys
4840	CP.exe
3296	ywqoigaytq.exe
868	CP.exe
2756	CP.exe
1172	i_ywqoigaytq.exe
4064	ysqkidavtn.sys
2212	CP.exe
3188	nlfdxvqnic.exe
3020	CP.exe
4532	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_544814285\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_141952438\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_141952438\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_1544517091\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_1544517091\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_297862834\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_297862834\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_297862834\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgbywrojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifausqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgeytog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgeytog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgbywrojdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrmj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1536	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2036	ipconfig.exe
1760	ipconfig.exe
3400	ipconfig.exe
1760	ipconfig.exe
3772	ipconfig.exe
3652	ipconfig.exe
3200	ipconfig.exe
4992	ipconfig.exe
2956	ipconfig.exe
3940	ipconfig.exe
3960	ipconfig.exe
3120	ipconfig.exe
3428	ipconfig.exe
3316	ipconfig.exe
3236	ipconfig.exe
2340	ipconfig.exe
1600	ipconfig.exe
3228	ipconfig.exe
908	ipconfig.exe
4252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257687"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4000122258"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250631216431432"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{0DA58B6E-6E87-4D92-93BB-6FB52DB8B32E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2036	i_vtolgeytog.exe
Token: SeDebugPrivilege	4684	i_lidavtnlfd.exe
Token: SeDebugPrivilege	2496	i_aysqkicavs.exe
Token: SeDebugPrivilege	4248	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	1564	i_mkhcausmke.exe
Token: SeDebugPrivilege	4696	i_ecwuomhezu.exe
Token: SeDebugPrivilege	488	i_uomhezwrmj.exe
Token: SeDebugPrivilege	4920	i_mgeywrojhb.exe
Token: SeDebugPrivilege	3044	i_lgbywrojdb.exe
Token: SeDebugPrivilege	1172	i_ywqoigaytq.exe
Token: SeDebugPrivilege	3272	i_nlfdxvqnic.exe
Token: SeDebugPrivilege	2108	i_ifausqkica.exe
Token: SeDebugPrivilege	600	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	4176	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	1172	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	2196	i_bztrljdbwt.exe
Token: SeDebugPrivilege	3104	i_bztrljdbwt.exe
Token: SeDebugPrivilege	1332	i_qoigaytqlj.exe
Token: SeDebugPrivilege	3940	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	1388	i_nkicavsnhf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
864	msedge.exe
864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3884	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	80
PID 3884 wrote to memory of 864	3884	iexplore.exe	81
PID 864 wrote to memory of 2580	864	msedge.exe	82
PID 864 wrote to memory of 1536	864	msedge.exe	84
PID 864 wrote to memory of 3912	864	msedge.exe	85
PID 864 wrote to memory of 3912	864	msedge.exe	85
PID 864 wrote to memory of 3912	864	msedge.exe	85
PID 864 wrote to memory of 1716	864	msedge.exe	86
PID 864 wrote to memory of 1716	864	msedge.exe	86
PID 864 wrote to memory of 1776	864	msedge.exe	87
PID 864 wrote to memory of 2656	864	msedge.exe	88
PID 864 wrote to memory of 1776	864	msedge.exe	87
PID 864 wrote to memory of 1776	864	msedge.exe	87
PID 864 wrote to memory of 2656	864	msedge.exe	88
PID 864 wrote to memory of 2656	864	msedge.exe	88
PID 864 wrote to memory of 3148	864	msedge.exe	90
PID 864 wrote to memory of 3148	864	msedge.exe	90
PID 864 wrote to memory of 3148	864	msedge.exe	90
PID 864 wrote to memory of 240	864	msedge.exe	91
PID 864 wrote to memory of 228	864	msedge.exe	92
PID 864 wrote to memory of 240	864	msedge.exe	91
PID 864 wrote to memory of 240	864	msedge.exe	91
PID 864 wrote to memory of 220	864	msedge.exe	93
PID 864 wrote to memory of 228	864	msedge.exe	92
PID 864 wrote to memory of 228	864	msedge.exe	92
PID 864 wrote to memory of 220	864	msedge.exe	93
PID 864 wrote to memory of 220	864	msedge.exe	93
PID 864 wrote to memory of 3792	864	msedge.exe	94
PID 864 wrote to memory of 3792	864	msedge.exe	94
PID 864 wrote to memory of 764	864	msedge.exe	96
PID 864 wrote to memory of 764	864	msedge.exe	96
PID 864 wrote to memory of 5100	864	msedge.exe	97
PID 864 wrote to memory of 3440	864	msedge.exe	98
PID 864 wrote to memory of 5100	864	msedge.exe	97
PID 864 wrote to memory of 3440	864	msedge.exe	98
PID 864 wrote to memory of 2532	864	msedge.exe	99
PID 864 wrote to memory of 4844	864	msedge.exe	101
PID 2532 wrote to memory of 1672	2532	msedge.exe	102
PID 864 wrote to memory of 2576	864	msedge.exe	103
PID 864 wrote to memory of 2576	864	msedge.exe	103
PID 864 wrote to memory of 3940	864	msedge.exe	104
PID 864 wrote to memory of 3940	864	msedge.exe	104
PID 4660 wrote to memory of 2888	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	105
PID 864 wrote to memory of 4688	864	msedge.exe	108
PID 864 wrote to memory of 4688	864	msedge.exe	108
PID 912 wrote to memory of 4428	912	vtolgeytog.exe	109
PID 864 wrote to memory of 3340	864	msedge.exe	112
PID 864 wrote to memory of 3340	864	msedge.exe	112
PID 864 wrote to memory of 3344	864	msedge.exe	113
PID 864 wrote to memory of 3344	864	msedge.exe	113
PID 4660 wrote to memory of 4756	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	114
PID 4660 wrote to memory of 3384	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	118
PID 4336 wrote to memory of 1184	4336	lidavtnlfd.exe	120
PID 4660 wrote to memory of 3656	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	123
PID 4660 wrote to memory of 3452	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	127
PID 4284 wrote to memory of 2468	4284	aysqkicavs.exe	129
PID 4660 wrote to memory of 3248	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	132
PID 4660 wrote to memory of 540	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	136
PID 4896 wrote to memory of 5040	4896	mkfcxvpnhf.exe	138
PID 4660 wrote to memory of 644	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	141
PID 864 wrote to memory of 2416	864	msedge.exe	143
PID 864 wrote to memory of 2596	864	msedge.exe	144
PID 864 wrote to memory of 3320	864	msedge.exe	145
PID 4660 wrote to memory of 2512	4660	2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe	148

C:\Users\Admin\AppData\Local\Temp\2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_f7cc6e5d05be4bb83ba47d361fb67221_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7fff1a3bc188,0x7fff1a3bc194,0x7fff1a3bc1a0
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,9406624865928853020,1949710478435505636,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:11
      4⤵
      System Time Discovery
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,5426321411206038913,11617188029026287824,262144 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,5540762533153786265,16423681637795943630,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1095020696431271416,8125229111043750939,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2268077486048080855,16696864736056957003,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,6284685648593781128,7274144411845211664,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4892711935578736795,3114062119542555702,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:9
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4288,i,7391609080237405314,7046945314285406042,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4412,i,10176945182899334742,4170004191532741280,2097152 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7690243715423812690,16972196927962105387,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,7028656227271948826,11179445388949501065,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,2150306643209403727,14198275583657986029,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,11998467526452859616,4486202098511753293,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,9717588081269356224,9534512379430517242,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,6494502748795131899,11408452821850380451,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,6494502748795131899,11408452821850380451,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,14154917081300844601,4211264340750368884,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,16626310517156010262,2521356688965579566,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7833665148471648831,912963704104120919,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,14157760070863282882,8716254283657969027,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,2228902168612983115,14170852608298811112,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,17485762345362742336,13982426928544135532,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,17566613945875523757,7124032163422446716,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4520,i,3736963261448998204,4146348820214244150,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,16374302863448875223,5388923764956539331,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,9822893485955361011,947745677946684891,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3970965151427531995,1021080347567612572,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,15123340426122542555,3556790473805433652,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4672,i,12649339020689143970,4426458438672120419,262144 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,11263014736208294966,13127586477246267358,524288 --field-trial-handle=2824,i,5383194488130324193,16183462588618052237,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
      4⤵
      PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtolgeytog.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Temp\vtolgeytog.exe
    C:\Temp\vtolgeytog.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtolgeytog.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\i_vtolgeytog.exe
    C:\Temp\i_vtolgeytog.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Temp\lidavtnlfd.exe
    C:\Temp\lidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_lidavtnlfd.exe
    C:\Temp\i_lidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3248
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:540
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:644
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcausmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2512
- - C:\Temp\mkhcausmke.exe
    C:\Temp\mkhcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcausmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2464
- - C:\Temp\i_mkhcausmke.exe
    C:\Temp\i_mkhcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2296
- - C:\Temp\ecwuomhezu.exe
    C:\Temp\ecwuomhezu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\i_ecwuomhezu.exe
    C:\Temp\i_ecwuomhezu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezwrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2416
- - C:\Temp\uomhezwrmj.exe
    C:\Temp\uomhezwrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezwrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:688
- - C:\Temp\i_uomhezwrmj.exe
    C:\Temp\i_uomhezwrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2812
- - C:\Temp\mgeywrojhb.exe
    C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\i_mgeywrojhb.exe
    C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgbywrojdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\lgbywrojdb.exe
    C:\Temp\lgbywrojdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgbywrojdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\i_lgbywrojdb.exe
    C:\Temp\i_lgbywrojdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2756
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2212
- - C:\Temp\nlfdxvqnic.exe
    C:\Temp\nlfdxvqnic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\i_nlfdxvqnic.exe
    C:\Temp\i_nlfdxvqnic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifausqkica.exe ups_run
  2⤵
  PID:3128
- - C:\Temp\ifausqkica.exe
    C:\Temp\ifausqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifausqkica.exe ups_ins
  2⤵
  PID:2496
- - C:\Temp\i_ifausqkica.exe
    C:\Temp\i_ifausqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfzx.exe ups_run
  2⤵
  PID:2432
- - C:\Temp\fcxvpnhfzx.exe
    C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
  2⤵
  PID:3604
- - C:\Temp\i_fcxvpnhfzx.exe
    C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run
  2⤵
  PID:5092
- - C:\Temp\upmhfzxrpj.exe
    C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
  2⤵
  PID:1684
- - C:\Temp\i_upmhfzxrpj.exe
    C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezwrpjhb.exe ups_run
  2⤵
  PID:648
- - C:\Temp\mhezwrpjhb.exe
    C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
  2⤵
  PID:1732
- - C:\Temp\i_mhezwrpjhb.exe
    C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  PID:2104
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  PID:652
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  PID:2128
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  PID:4884
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqlj.exe ups_run
  2⤵
  PID:1396
- - C:\Temp\qoigaytqlj.exe
    C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqlj.exe ups_ins
  2⤵
  PID:3520
- - C:\Temp\i_qoigaytqlj.exe
    C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  PID:1340
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  PID:4476
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicavsnhf.exe ups_run
  2⤵
  PID:2604
- - C:\Temp\nkicavsnhf.exe
    C:\Temp\nkicavsnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicavsnhf.exe ups_ins
  2⤵
  PID:4248
- - C:\Temp\i_nkicavsnhf.exe
    C:\Temp\i_nkicavsnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

C:\Temp\ytnljdbvto.sys
C:\Temp\ytnljdbvto.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
- Executes dropped EXE
PID:3200

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
- Executes dropped EXE
PID:2612

C:\Temp\zxvpnhfzxs.sys
C:\Temp\zxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:1232

C:\Temp\smhfzxrpjh.sys
C:\Temp\smhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4556

C:\Temp\mzwrpjhbzu.sys
C:\Temp\mzwrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:3588

C:\Temp\cwuomgeywr.sys
C:\Temp\cwuomgeywr.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\wrljdbwtrl.sys
C:\Temp\wrljdbwtrl.sys
1⤵
- Executes dropped EXE
PID:2244

C:\Temp\igdywqoigb.sys
C:\Temp\igdywqoigb.sys
1⤵
- Executes dropped EXE
PID:3316

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
- Executes dropped EXE
PID:4064

C:\Temp\aysqkidxvp.sys
C:\Temp\aysqkidxvp.sys
1⤵
PID:236

C:\Temp\qkfcausnkf.sys
C:\Temp\qkfcausnkf.sys
1⤵
PID:4836

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:192

C:\Temp\euomhbzurm.sys
C:\Temp\euomhbzurm.sys
1⤵
PID:4640

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
PID:944

C:\Temp\ljebwtomge.sys
C:\Temp\ljebwtomge.sys
1⤵
PID:1232

C:\Temp\aywqoigbyt.sys
C:\Temp\aywqoigbyt.sys
1⤵
PID:468

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:2556

C:\Temp\daysqkidav.sys
C:\Temp\daysqkidav.sys
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkicavs.exe

Path C:\Temp\aysqkicavs.exe
Size 243KB
SHA256 b7975ed442d681e8daca4fb9d8fbbf2b2ea4f39c2389d6a5a0efa27db7407801
MD5 49806f83f1c4aabfea0a01ad41214fff
SHA1 7c88a1cabc31a2aa00af568c47f9df624cd60cb9
SHA512 815c2ff9b80f80d690523a2372b024f3f7c1ed6dbc708239578da657b7929cf266ea60ee3e5646e73713799f0065bf61c3749c369208e1c50631c9286a403784
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:avMsLaOa3lLNngoqRttA7p
TLSH
T16A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezu.exe

Path C:\Temp\ecwuomhezu.exe
Size 243KB
SHA256 5d4c0a1efa846651db84fbb61f0ccef81ae5912124a626e02e86d8ce5c9ea465
MD5 600b6c2b0e1e9b32fad40f15f6c55aee
SHA1 8077757365c8fba6a1c64fcbf6fe1caa6667eab3
SHA512 57f5a02fe34520c6b0d2ae0270431f6e5dcd4c12f0cfccc196dcf62c52fe427e0dddba5193bfd9feb07c9d8ef1171c976f7612a3778eadfe0e40d831dc9c5a02
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:ZvMsLaOa3lLNngoqRttA78
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkicavs.exe

Path C:\Temp\i_aysqkicavs.exe
Size 243KB
SHA256 0535d5e1d2e7e255444bff44cf32b67ebff9f59a8044b8f316b4045441e17eb1
MD5 4e44eb9d08c8caf81e4caa997518b24a
SHA1 c42ccc41162e2ef760a022a30d47458940ecac96
SHA512 f15012af0697b8f1a16bcb9dfb80e8ca512c6fc36fcb31f7a7160616bc5533b748a443180ea550ac706e1eced9a5ea30ea366a5d7e9d6d6d6281316ac8cf60b3
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:VvMsLaOa3lLNngoqRttA7Y
TLSH
T118345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidavtnlfd.exe

Path C:\Temp\i_lidavtnlfd.exe
Size 243KB
SHA256 8ea237720c735fe76efa7e0759fffe4b06bb56566bf9f68163899e85c732536c
MD5 0837e74ddea9edd4f1cf8da1f10306dc
SHA1 c1a47d98b4513ef3585c91198d131fcad8d8fd63
SHA512 fa4a1f1568d6f1395d589883f2f4e51a3fa4c2b90d6fd78adf5011da4e95b601240241a7e53a193fc16a0a586ba1d2fde6ecc0984fe26337c6125bccc1464e88
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:YvMsLaOa3lLNngoqRttA7r
TLSH
T194345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxvpnhf.exe

Path C:\Temp\i_mkfcxvpnhf.exe
Size 243KB
SHA256 6c163a3a73b3aa920b61d1379e28f9443ea5aacc5756184ba0a5d469b997e8e8
MD5 22660f6eae8c29064d389bb1fe1118b3
SHA1 3febb7a2703be846bf54464d8c0a18974f5a01f1
SHA512 21cec7364a5111137d42f38a6afc448791640207dab0086efae00212a904b1bf16bede297f25fcfab3046eefb9e955579b4d1473df149e37ef683e63fc638d7e
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:CvMsLaOa3lLNngoqRttA79
TLSH
T124345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhcausmke.exe

Path C:\Temp\i_mkhcausmke.exe
Size 243KB
SHA256 44ac5d8fa880f43a2dc0f054f66eca084474cf50028a43ad0447ed39a16ba749
MD5 66f0ae4431ac47cb32d45cc635e846ef
SHA1 275c7637328180ff06680051d7508466955d052f
SHA512 1f85f7f6b335f6e0f0a05eb6d821bd175c9582d61480764e528a49944c2307ea4d63b05e090cd9cbe7560393a0b89cbf825b9b76cc64e2fdc7243e671376fedf
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:XvMsLaOa3lLNngoqRttA76
TLSH
T174345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtolgeytog.exe

Path C:\Temp\i_vtolgeytog.exe
Size 243KB
SHA256 7f09531a95542938aa28c5ce0bd7c2d23e827143d4eebb65946d2beb71cf9a95
MD5 452cac804a206535c1ddbaa0efc0e576
SHA1 4e8eff7502bc6bc044b8dc341c83af9da1f8ead3
SHA512 ee1d37606a65bab08c701d2f032654962a5fdf78f56ce0cbec7a59f4454df2b6b46a9f1d50891d22b7b844173431e156f707b1651cb7123eb983f3322b30e483
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:gvMsLaOa3lLNngoqRttA7z
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausnkfdx.sys

Path C:\Temp\icausnkfdx.sys
Size 141KB
SHA256 c1950363f023fc7e409a4335e8fbac0912f03d5834e5d0d76c5e87f7345bcf4d
MD5 f547210bf4457605bf7ec4e9be6a10ab
SHA1 ef320530da7398690f01af04ca15a684507e69d0
SHA512 63d63644799ac9a0cc9ab55fa1b6e77f4286a3926855cff84e3ce83b72c78a80c2fb18bd9d01d8e78322ec1f167d59213fc821ed5ca6e89c59adef8e619b46c6
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T146E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.exe

Path C:\Temp\lidavtnlfd.exe
Size 243KB
SHA256 7fa51a6cc83585813ccee6d4c4acd8a86a42d3ed7db7203593aeaddcacf98fe0
MD5 ae0f18099bb148b658a8678db4c53239
SHA1 d70e82accf4f85e6c5767b3da4a33b6d0f8177b4
SHA512 6c7743ed83139eab46165be3f0bad9b5083fb157c05e570d77de8de374ea1934afdfa0fc57cdca0674f4c1e022d0cfd69ff356b1652109619b3feb4c5cda7abd
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:vvMsLaOa3lLNngoqRttA7u
TLSH
T18F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.sys

Path C:\Temp\lidavtnlfd.sys
Size 141KB
SHA256 18125cd1b2e3d5b126d1cdb40be89227a2ea4e414273d6a34b8e9a978a7ec41c
MD5 d48a2c0560cbfc274df0fd0ff9d7c329
SHA1 21299cb8b2f81ee48924b420932829e5c0265d72
SHA512 b043cc117d468f9e1f9f72dc6513468f662cf2fd292643503df36c36b53001297331bc2886c10327a01374e2253b83f7bd02af706bafe3f2bbc7a8b043bb6920
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvpnhf.exe

Path C:\Temp\mkfcxvpnhf.exe
Size 243KB
SHA256 f08784b831d9c3774177e2a053d40929a58dc9a34fdf09d23ee6092c53219550
MD5 1725ac6b1f469b4c647daff4e222c2e2
SHA1 dab40c4fbfab38360f45b7126761fb55cb08ed97
SHA512 578d19aa753f45318e83ee47255ade159387bd0b2a4e401dbdde9e0b73dea11d30ef22fe38ee395adc3bce4cb73f58c1f883edfdd621f66c2ce64afc512ecd5d
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:zvMsLaOa3lLNngoqRttA72
TLSH
T161345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcausmke.exe

Path C:\Temp\mkhcausmke.exe
Size 243KB
SHA256 f4b056df29569bdc8ebfdcfe7e020cfd604c10e3685be3b5a6202818464f97c7
MD5 b47dc3e0e5eb1c0175970847a2b6003f
SHA1 8d94e1f566df7b39ebdd7263ef553b783d65d0d9
SHA512 a495700dfcc5e0575a63fbe0b68b68d6075ca5894c94b5d3a28f9b0ddec76e348b9c5d4b72694eea42e66d2326cf3255b002ac9486964ac3f15b305d7188dc70
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:gvMsLaOa3lLNngoqRttA7j
TLSH
T1A6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smhfzxrpjh.sys

Path C:\Temp\smhfzxrpjh.sys
Size 141KB
SHA256 cac41e238785bca10d07a78806964258e7848869393712109a0d0527ac41b1f6
MD5 18e88c33a1cd8ab078c7885930f84fa7
SHA1 71392f34559c0cf9f16eaa1f71129fe89eda13d4
SHA512 cf6ced110759c4077d65ed8032701b5a578770facd408689bd2f45af0f51c466df0a60e8c147b1c113439041f8f232cb833bf4bed8a667d5f5ada62e9450b652
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtolgeytog.exe

Path C:\Temp\vtolgeytog.exe
Size 243KB
SHA256 8957c0443ff43eee98165815ee4e74e37e74e4c80c328ac1894a01e5f5e6ce67
MD5 381b00e477b5d948fe0af3e755469b5d
SHA1 c1e3166c946f4c0c9970c9c7c39bfafb7e923cf2
SHA512 c832f44e26399f6fe9af39532887390aa009f4a011dc0b3e8f4e49803bd74cbb40e8411a19321cc1cdeabfb73b26a3c8a3cbc048bb6e1c78ea699bf6108f3539
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:ovMsLaOa3lLNngoqRttA7P
TLSH
T185345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytnljdbvto.sys

Path C:\Temp\ytnljdbvto.sys
Size 141KB
SHA256 f4df006cd17a53d19da071cd9114ad3398c7b0ec3e85ad6b7c0ba5fac4f3eb1c
MD5 80eb93734b58b8b47e3af096cb064318
SHA1 5eda9e8791c02234ece9b3df7bf1dfaa10630516
SHA512 7d4780c9157c3f83beaa3b546b98d957441e3290e351c94e00236fd9fb462bf80d31a98fa68747bcb41f29a3bfb3adb68e20d6c63f72353ff3cb3aa9c3324f3b
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpnhfzxs.sys

Path C:\Temp\zxvpnhfzxs.sys
Size 141KB
SHA256 756db10efc818af868d975141106de7954f260243e09577416e846944ab6c39f
MD5 50ba3bcbb2cc998222017d6e4549d87b
SHA1 0658d37cfce9033a96bfe5652f3356e8a2ebb4de
SHA512 8ef74ce5da11be2c332357c0ebd7cded89790b6d6133ec4d07b8f2db94099aec84a86283a93616b994c5d6a8d812af12798eabe917c3161cc061afc3ed06021f
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T193E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b34bcfa9e1082136ad99bd0a56f84a4433b645fdc1ebad16fa2fa22dc5a35387
MD5 5e8bd6af3f0ced8518a0e951e87d806e
SHA1 432fe213e8d0f01ca1da597c7596ee9588294959
SHA512 f7acffe7a2183c84180f29731eeb75ee0826520f33ab81e197f2a12ceac6c341d80237df7a1ddb5c23fa5a64f3a1897494956284e66d234b0f7f224f05223ac1
TLSH
T1CB61E6387A1ED993E3430671A1EC3210BD778BAA7AF70E5E21F0AC7F562976DC595008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d25e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d25e.TMP
Size 3KB
SHA256 81efb2f3437786a0581d7e986110b12c4268504f543f4a844832f91fa9203e5e
MD5 9b8683099df50ca35c6d961f566ab1c2
SHA1 3733ba60cb6644439fbff430ae31da7bb6bfe782
SHA512 68f0ce520aa37178f32a1ed91e8820915dbc9191adc8164460b3848b111624501011e922d2a0d108a6fb5aaab9b6eb4b1554336f0c4e805f9e69c73440f1c0b6
TLSH
T16461E6387A1ED993E3430671A1EC3210BD778BA67AF70E5E21F06C7F661976DC595008
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 752adb1e8460fbe8c2a7e527b4bc9a50e046b570316487d0a334d19724d36485
MD5 7da7fc89758acfee7727ea93a0b22e36
SHA1 c97180b071371b242791488b970d2f191ee98949
SHA512 5117b01200931115306f01922a6af6b5eefd64fff69eb65b4e6d18ebe37636dbcdff855887e84e368103408082762d380b52d67af2bdec3de355f449133ae0b2
TLSH
T1D341AFF3C3E8866E890156F0BA28AE2BCE2D0A14932C3D5AC4E4EF5B93E3471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 49adaa21d2f48a1397104d9602f2e2e19c4a03c1562de240c48be114a44a14c8
MD5 86d5ec98caadf57075e9856dcfd8de8d
SHA1 ab88046a5e06a6b9a25f9baef3d72f3ae238701b
SHA512 8d4ef3d320c08bbad1ef35c3b2834c3b2336b8e4c761c7d339e2f49bae41c74fd298028dc669e63b6bcaf12751e4808b806e24c83c1fc2eba0c5754492ba03c7
SSDEEP 192:sxZPRnyM/jK1Ml8McC/fEsdVgX80k/IIdp/M/W6+WNs1x/Y0oBriIg4J:sxZPp0C/fEsPgAk/bQ/5jc
TLSH
T101520806AB3459B7CCDBD209BA55BF53D6F9057292904D48A9FCDB1C00E6BED220386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 481e72640fd9421caf8b7b1b61a62030a134931aeefedb1abeda4d67bb80c17b
MD5 8f127ddd711e3de767fa017e8a538236
SHA1 66f210eaed49f9ec21c05679c1bd8c6d2b093011
SHA512 fb408b9dbd64f45ad2ce66a2e19588456bbb59f1c2370be68ccfb325f4d67c199c889808d2cddfc3570ee7717d3f7c81bf03c75c61bf5ba67e616f939e4a42e4
SSDEEP 192:sxZPRnyM/jK1Ml8UQmcC/fEsEVBX80k/IIdpZM/W6+WNs1x/Y0om3riIg5kJ:sxZPpqFC/fEsEBAO/bQ/56y
TLSH
T120620906AB345977CCDBD209BA51BF53D6F9157292900D48AAFCDB1C01E6BED220386F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b7777ff4eb2577f0d6c43256e06901f8c3094c714274a2835771d7b0eb09e677
MD5 bff71e5616aae9aa81ee888d12f0f8e9
SHA1 2bb721ecba8e45005f15141ea0c1773ab5220a91
SHA512 c445e45f344c8e22849b2780faa4434d660f7ed2e6736f7ad99f402ab95bd1292d50573e2ebe8257ad46f5ad664a8a833c8e4791bc23146660343df75b5abea9
SSDEEP 768:mac0s8Ww2Ke7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3iM6OLl9:mac0s8Ww2KeEX/fWRm/JQg1u1jaKiM6M
TLSH
T1ED030B3B2C0CCB7E4F844E9CED26BE8A6DE8018B6698895447FE444C03C66EB551B5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 629ca2c2566195d2c661cf2cee8be89a4f780239f9a5bc4cbaaa45c43ed33a6c
MD5 a2edafc54d218b5165fa074e7f4caeea
SHA1 f853bac7267ab893909e39a00c9a95f71d357994
SHA512 7c50d40fc801801e6ee1500b5e23ea5beb63a458b4409fc325f3cb7e23994e477f508b7af12fa091bcff2877ded20cdbca925591ef6b8ce9863b9c77acdef1ae
SSDEEP 96:KMkAKVCGYiduCM0k2q039kC2KcTko246ivYiny8gKQ8M:qTqBGt
TLSH
T1C791099231BA03023C7F291992D4BF169A42B1A37128743B7FE801B65D67E506EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c78f135e-67f1-4ba0-8547-ff0a7df0bb34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c78f135e-67f1-4ba0-8547-ff0a7df0bb34.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6d3ccb8c8f57828bb4ecafdd6e8992452c101525ce703997d5de74ef23e7c53c
MD5 639cf55944e7f878b54422c5cf4bd2a7
SHA1 6c48cf1e625cff76252aed8ca2c36e81644f2402
SHA512 1fc212cef502b7b9e8828999a91518b6ba192e396fe7b45119effa5fca88253fdb4f8e176c98ce9ea3c5ab7d4086d686d5fd2eef106ea0efe531185e80771d17
SSDEEP 384:nXtNnNnb9S8NzfCk0bP/Uu8YHusTuEaKEQYELU58TLj:XjZbgfcCH1TXaHQYES8TLj
TLSH
T17E927B324878AC67ADA36654B24B3A975FB4257B9DC03F88C9ED5F1E009724C3306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 879820eab49d6250381ad31bf4e6056fb2e1ee7475087bf8a90ae4ec3b3a20c5
MD5 b4b4177e9cd41d35894e134c1db8de0a
SHA1 734e74affd160f2f1c24abb406af7209e8b3fa41
SHA512 46bfc83eafa09a43ff7569886dfa6b8a2022319c049b9f0d11d71bdc0e9a9146a05fe861176269b322a51807a90c94c09c06eba5043e992096a3b0f2b9d6e39f
SSDEEP 384:nBtNnNnb9o8Nz4CkDbP/Uu8YHusTuCaKEQYELU58TLj:BjZbaVcCH1TtaHQYES8TLj
TLSH
T1AD927B325879EC67ADA7A654B2473A975FB4247B9DC43F88CAED5F1E008624C3306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b420014daa3f7a28a9b73689fc73b924218378071eb5dedbaed7e442ad1288c9
MD5 88347f44eb4fca46b19effc365f5b584
SHA1 e81efedf6828d9834ebd3cb5453f55ac3f1f61d2
SHA512 69d5ab0c881fd12c9578d0fcddd92d8af3e7886aa7b7c5e396f63d38f795f6bb658b4d9e3aab22555a62a4e755ff43c5d9235f7c0c9b0948cdfe138ec7942676
SSDEEP 192:XGN16jCQmiUy/I6f4SufoPxzYcSus6RR+GNSnwFOU6:XGN16qQlfju8YHusl8OU6
TLSH
T10402C935AC6C787B9EA36E45FA473B135FA4202BA9956F44DAF81F1C00D724C2346936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 29ae5e646312dbf0bcaff838b9cabc5a47e7e4ff60c98ea35cb09f64ba749ab2
MD5 bad7c1829efeca52a20d2f91e89057aa
SHA1 a0b283489e6cb39a2046cbad575ae2dc42a1752f
SHA512 b7643e3713bb215da96588da6998207695b3b03b396fc6f6335947413eb74297540c9a160a42721c696b6dc06667a2bb1d88c251e9105ea482cc64d2b6368fc5
SSDEEP 384:n7tNnNnb9y8Nz4CkvbP/Uu8YHusTu4aKEQYELU58TLj:7jZb4lcCH1T3aHQYES8TLj
TLSH
T126927B325879EC67ADA7A654B2473A975FB4247B9DC43F88CAED5F1E008724C3306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 60199856fffeb7f4e6a69db5a65a0d10ac50d6f91aa08b86c1e232c9d4e9b6b9
MD5 2e1560b7bf79d41d322ad00e04f1dd9c
SHA1 f8d1be022460f460388205bfc93beb3c8995d64f
SHA512 6c4b6826e779e03ad12bfcb30f397aea7d4f156b6e09f47f19a3707c3d68387005374fdb6a4ecad185122a85dd1e881b597e0fcdd6c581330cf6cde64eebd8c5
SSDEEP 384:nEiFbtNnNnb9p8Nq8TUNTUlIl4CkJE/qifh/u8YHusTuEaKEQYELU58TLj:fFbjZb/1wg/7/CH1TTaHQYES8TLj
TLSH
T1ABD2B5F288E78937E99E5783A33E6E465EBCD16378845984BBD91D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 ba5ec9c595ae071013d3f8b51643b186447af2a2ee3e7876c832f847ba7543fd
MD5 0fa1f2ecaf37ce630555e537b53b3462
SHA1 50e4d085d2f37641b761d888eac617f11f1106a6
SHA512 57d76e0a9dee8e876d96b2d0f83574658ab75ad41d1c64bd7b0cdd41a7e201382bd148dba0739279dfa730044aa937abc7a3b9637ef5419f9108547a0be4b4dc
SSDEEP 384:nEiFltNnNnb9L8Nq8TUNTUlIl4CkIE/qxfh/u8YHusTuCaKEQYELU58TLj:fFljZbF1wg0w/CH1T5aHQYES8TLj
TLSH
T137D2B5F288E78977E99E5783A33E6E464ABCD16378845984FBD81D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6660e3c9a5b5967cc17834478e060f70b028883df65b7ab76a722ea3b4caed2a
MD5 5ad10e9e5a18c32f50bba1cbc2ec99ec
SHA1 bac42656466773142d3ad188f1385fceb2813bf2
SHA512 df382726d2198c96f01cc6380304fc45b838117ab4a231ea22f6854dc809edd521b8bd53a35dade5705c2261bf92dea2acc77f5e0bda4695e1ef9921573ab472
SSDEEP 384:nctNnNnb9S8NzDCkvbP/Uu8YHusTu4aKEQYELU58TLj:cjZbYUcCH1T3aHQYES8TLj
TLSH
T12E927B325C79AC67ADA76654B2473A975FB4247B9DC03F88C9ED5F1E008624C3306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 59d4a6f68b55653544c9ce382a87217bd7b4358b084061b0c1f528a2f0ca18a7
MD5 d8aa58df632d102388822d6001ed38b1
SHA1 f00bae6a6ad0385352ec86d5120432c52131d8e0
SHA512 7af26110219094835b7af45932595ff536100ce9f9243dd198723303f4d651b43495c2e94101f355a88eb119c71fe5532fed0a22fe924c19d4a10e05f98d670d
SSDEEP 384:nEiFitNnNnb9+8NN8TUNTUlIl4CkXE/qDfh/u8YHusTuUaKEQYELU58TLj:fFijZbMowgZU/CH1TLaHQYES8TLj
TLSH
T173D2B5F288E79937E99E5783A33E6E464EBCD16778845984BBD81D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 55293eb46c4f40724edaee2d094f43fd132d97ef8d5f7884f1abd96305652f43
MD5 35afa17502913e8cd1e13f594b9b0af5
SHA1 99b63f7a0c5970f7e4c53e7d091ccdf76728f11d
SHA512 ece8a7efbf0cae1ea48a503a742ea9c262dd68fbeef45d5dfeb850566bde16d0f7664adf6b1edd398f8b510154fbcaebdf131e563fb63ed647a316fd3f3a299c
SSDEEP 384:nEiFKtNnNnb9+8NN8TUNTUlIl4CkXE/qDf4/u8YHusTumaKEQYELU58TLj:fFKjZbMowgZR/CH1TzaHQYES8TLj
TLSH
T13DD2C5F188E79937E8AE5783A33E6E464EBCD16778845984BBD81D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5be0becd4a6ec5e10ff5dc39fd63c7fff353d2f5dc51d09d4afa6168e2e9c70b
MD5 aa668ed03ddd27eb6299524decb533da
SHA1 f69ce6ca020cf8b09ed0a42bec5e69702233db0a
SHA512 2245672993a8c6be78c0da227c42946286736f6e690e91fb306637eaccf461ed1c997dd4264e94d7e68a80169f44bd89842c18b82e5937a5c1cd8629b2befb07
SSDEEP 192:XGNe6jcQmiUyb6d4SufoPxzYcSus6RR+GdSuDOMdq19U6:XGNe6Qtdju8YHusTubaU6
TLSH
T12C120871A86DEC27ADA37558FA8736539FA0203BDD856F48D6E81F1C00D728C370A836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

72a8c62a-fa67-48b2-93dc-ec8edf42444f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\72a8c62a-fa67-48b2-93dc-ec8edf42444f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8186701f-0cd5-4dc8-b252-92ae86482bbb.tmp

Path C:\Users\Admin\AppData\Local\Temp\8186701f-0cd5-4dc8-b252-92ae86482bbb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b30f1869-3b15-4950-9919-62fd8a1837c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\b30f1869-3b15-4950-9919-62fd8a1837c5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2974c182-d750-437c-85eb-2203340a41fd.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir864_246966103\2974c182-d750-437c-85eb-2203340a41fd.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir864_363993276\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_141952438\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_1544517091\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_297862834\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping864_544814285\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/192-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/236-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/468-783-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/944-748-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1232-779-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1232-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2244-621-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-809-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3316-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3588-586-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3972-813-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4064-667-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4128-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4128-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-734-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4836-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download