b512d4ea860c7054064444db1351e54ef245f02bab40a2948c4485b26fef7648

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe
Size 243KB
Sample260606-pbvpyadv4s
SHA256 b512d4ea860c7054064444db1351e54ef245f02bab40a2948c4485b26fef7648
MD5 48e7fad080594283c006198eaef62511
SHA1 779e147824f1e7a007a2d2905df9cb7c95d74487
SHA512 793b87fae10579665581caabc4656c27a8b2cf2c0695b28ddaa00390a27a6e62aadf3df9391d5bc275abd72797eccce72e5c35447de2be8058900def305ca59e
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:tvMsLaOa3lLNngoqRttA74
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5032	CP.exe
2968	wrpjhbzurm.exe
2160	CP.exe
6024	CP.exe
6044	i_wrpjhbzurm.exe
652	geztrojhbz.sys
5364	CP.exe
5388	wrojgezwro.exe
5408	CP.exe
5480	CP.exe
5504	i_wrojgezwro.exe
5600	dbvtolgeyw.sys
5624	CP.exe
5640	trojgbvtrl.exe
5664	CP.exe
5800	CP.exe
5820	i_trojgbvtrl.exe
5900	qoigbvtolg.sys
5956	CP.exe
5972	yvqoigaysq.exe
5332	CP.exe
800	CP.exe
6116	i_yvqoigaysq.exe
2080	sqkidavtnl.sys
5212	CP.exe
4048	lidbvqoida.exe
2588	CP.exe
4576	CP.exe
4972	i_lidbvqoida.exe
5412	vsnkfdxvpn.sys
2608	CP.exe
5568	nicavnkfdx.exe
5592	CP.exe
5884	CP.exe
5856	i_nicavnkfdx.exe
5996	usmkfcxusm.sys
6020	CP.exe
6056	kfcxvpnhfa.exe
5320	CP.exe
6044	CP.exe
3196	i_kfcxvpnhfa.exe
6124	ezxrpkhczu.sys
2172	CP.exe
3860	xrpjhczusm.exe
5144	CP.exe
5208	CP.exe
1076	i_xrpjhczusm.exe
5588	wupmhezurm.sys
3760	CP.exe
3032	ezxrojhbzt.exe
2316	CP.exe
5132	CP.exe
5372	i_ezxrojhbzt.exe
3212	gebwuomgez.sys
5768	CP.exe
5780	ztrmjebwuo.exe
5788	CP.exe
5856	CP.exe
5940	i_ztrmjebwuo.exe
5900	omgeywqojg.sys
6136	CP.exe
5312	dbztrljdbw.exe
5328	CP.exe
3196	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_43162165\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_158737189\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1506439335\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1506439335\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1506439335\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_43162165\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_158737189\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1575199164\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvqoida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nicavnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nicavnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvqoida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupmkfz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2944	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1192	ipconfig.exe
5428	ipconfig.exe
3980	ipconfig.exe
5984	ipconfig.exe
5796	ipconfig.exe
3824	ipconfig.exe
5260	ipconfig.exe
5836	ipconfig.exe
3360	ipconfig.exe
3040	ipconfig.exe
5680	ipconfig.exe
3428	ipconfig.exe
5828	ipconfig.exe
6048	ipconfig.exe
5328	ipconfig.exe
5552	ipconfig.exe
3220	ipconfig.exe
6016	ipconfig.exe
4280	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2037386070"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31258121"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252213958856705"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{B2214BC7-7746-4A80-A4AF-391801B6BFC9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6044	i_wrpjhbzurm.exe
Token: SeDebugPrivilege	5504	i_wrojgezwro.exe
Token: SeDebugPrivilege	5820	i_trojgbvtrl.exe
Token: SeDebugPrivilege	6116	i_yvqoigaysq.exe
Token: SeDebugPrivilege	4972	i_lidbvqoida.exe
Token: SeDebugPrivilege	5856	i_nicavnkfdx.exe
Token: SeDebugPrivilege	3196	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	1076	i_xrpjhczusm.exe
Token: SeDebugPrivilege	5372	i_ezxrojhbzt.exe
Token: SeDebugPrivilege	5940	i_ztrmjebwuo.exe
Token: SeDebugPrivilege	3428	i_dbztrljdbw.exe
Token: SeDebugPrivilege	6084	i_oigaytqlid.exe
Token: SeDebugPrivilege	5528	i_sqkidavtnk.exe
Token: SeDebugPrivilege	5948	i_vqkicavsnl.exe
Token: SeDebugPrivilege	4624	i_faxspkicau.exe
Token: SeDebugPrivilege	5184	i_hecxupmkfz.exe
Token: SeDebugPrivilege	5004	i_omhezwrpjh.exe
Token: SeDebugPrivilege	5872	i_jecwuomgez.exe
Token: SeDebugPrivilege	6112	i_zwqojdbwto.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 2308	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	84
PID 2308 wrote to memory of 2372	2308	iexplore.exe	85
PID 2372 wrote to memory of 1352	2372	msedge.exe	86
PID 2372 wrote to memory of 1664	2372	msedge.exe	88
PID 2372 wrote to memory of 2944	2372	msedge.exe	87
PID 2372 wrote to memory of 1664	2372	msedge.exe	88
PID 2372 wrote to memory of 1664	2372	msedge.exe	88
PID 2372 wrote to memory of 2376	2372	msedge.exe	89
PID 2372 wrote to memory of 2376	2372	msedge.exe	89
PID 2372 wrote to memory of 2412	2372	msedge.exe	92
PID 2372 wrote to memory of 2412	2372	msedge.exe	92
PID 2372 wrote to memory of 2412	2372	msedge.exe	92
PID 2372 wrote to memory of 1832	2372	msedge.exe	104
PID 2372 wrote to memory of 1832	2372	msedge.exe	104
PID 2372 wrote to memory of 1832	2372	msedge.exe	104
PID 2372 wrote to memory of 2172	2372	msedge.exe	93
PID 2372 wrote to memory of 3212	2372	msedge.exe	94
PID 2372 wrote to memory of 924	2372	msedge.exe	95
PID 2372 wrote to memory of 2172	2372	msedge.exe	93
PID 2372 wrote to memory of 2172	2372	msedge.exe	93
PID 2372 wrote to memory of 3212	2372	msedge.exe	94
PID 2372 wrote to memory of 3212	2372	msedge.exe	94
PID 2372 wrote to memory of 924	2372	msedge.exe	95
PID 2372 wrote to memory of 924	2372	msedge.exe	95
PID 2372 wrote to memory of 2268	2372	msedge.exe	96
PID 2372 wrote to memory of 2268	2372	msedge.exe	96
PID 2372 wrote to memory of 2268	2372	msedge.exe	96
PID 2372 wrote to memory of 2400	2372	msedge.exe	98
PID 2372 wrote to memory of 2400	2372	msedge.exe	98
PID 2372 wrote to memory of 2152	2372	msedge.exe	100
PID 2372 wrote to memory of 2152	2372	msedge.exe	100
PID 2372 wrote to memory of 1660	2372	msedge.exe	101
PID 2372 wrote to memory of 1660	2372	msedge.exe	101
PID 2372 wrote to memory of 696	2372	msedge.exe	102
PID 2372 wrote to memory of 696	2372	msedge.exe	102
PID 3312 wrote to memory of 5032	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	103
PID 2968 wrote to memory of 2160	2968	wrpjhbzurm.exe	106
PID 2372 wrote to memory of 1856	2372	msedge.exe	110
PID 2372 wrote to memory of 1480	2372	msedge.exe	111
PID 1480 wrote to memory of 1088	1480	msedge.exe	122
PID 2372 wrote to memory of 4932	2372	msedge.exe	113
PID 2372 wrote to memory of 4932	2372	msedge.exe	113
PID 2372 wrote to memory of 2540	2372	msedge.exe	114
PID 2372 wrote to memory of 2540	2372	msedge.exe	114
PID 2372 wrote to memory of 2432	2372	msedge.exe	115
PID 2372 wrote to memory of 2432	2372	msedge.exe	115
PID 2372 wrote to memory of 4944	2372	msedge.exe	116
PID 2372 wrote to memory of 4944	2372	msedge.exe	116
PID 2372 wrote to memory of 5280	2372	msedge.exe	117
PID 2372 wrote to memory of 5280	2372	msedge.exe	117
PID 3312 wrote to memory of 6024	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	118
PID 3312 wrote to memory of 5364	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	125
PID 5388 wrote to memory of 5408	5388	wrojgezwro.exe	127
PID 3312 wrote to memory of 5480	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	130
PID 3312 wrote to memory of 5624	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	134
PID 5640 wrote to memory of 5664	5640	trojgbvtrl.exe	136
PID 3312 wrote to memory of 5800	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	139
PID 3312 wrote to memory of 5956	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	143
PID 5972 wrote to memory of 5332	5972	yvqoigaysq.exe	145
PID 3312 wrote to memory of 800	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	148
PID 2372 wrote to memory of 1172	2372	msedge.exe	150
PID 2372 wrote to memory of 5160	2372	msedge.exe	151
PID 2372 wrote to memory of 2540	2372	msedge.exe	152
PID 3312 wrote to memory of 5212	3312	2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_48e7fad080594283c006198eaef62511_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffafedbc188,0x7ffafedbc194,0x7ffafedbc1a0
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1652,i,16159178412468547593,3015802624789361637,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
      4⤵
      System Time Discovery
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,13238883199944159346,17520748203706513219,262144 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,196401787197794993,1361007175697041823,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:13
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,5032641240148480788,14396969420185248738,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,5441619792381603250,11467840959779420863,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,13595507463477694088,12761778702550687829,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,983577376337342827,15654854340068784529,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4304,i,649213020980941853,4942680702535036580,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,15440997945837823289,6983918540447328903,2097152 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,10209623969160569541,3802643335062238334,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,11130802500385791183,5343936073627980229,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,4530243555894906593,4576961567032185393,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,2442335314441770248,2987295990107336784,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6330855980570612003,1176841418877604940,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6330855980570612003,1176841418877604940,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3229136223298465270,11660195768296194471,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,538317402851865549,199762363010332121,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12658553506216845010,11012068403775735378,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,11944011085609258062,17703715877003376821,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,120378893817084969,10408650512582801813,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,14275319539280454799,11402867712006433205,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:5280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,11477610444675553280,14617828474208667630,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10373485475061663674,2231188931839629925,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,17880278718665795278,15308097750803457178,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10652687117407559701,4160549314149038916,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,3072648260964374440,16125654293601031673,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=872,i,14045401988723550447,8019467518995343431,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6133150887866182469,5188295126385548478,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6896,i,2481121856675720000,430236670895431890,262144 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,16064099697271862028,11407943486340889579,524288 --field-trial-handle=2152,i,12655217609750785558,17245816440779749731,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
      4⤵
      PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5032
- - C:\Temp\wrpjhbzurm.exe
    C:\Temp\wrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6024
- - C:\Temp\i_wrpjhbzurm.exe
    C:\Temp\i_wrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Temp\wrojgezwro.exe
    C:\Temp\wrojgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Temp\i_wrojgezwro.exe
    C:\Temp\i_wrojgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgbvtrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\trojgbvtrl.exe
    C:\Temp\trojgbvtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgbvtrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5800
- - C:\Temp\i_trojgbvtrl.exe
    C:\Temp\i_trojgbvtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5956
- - C:\Temp\yvqoigaysq.exe
    C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Temp\i_yvqoigaysq.exe
    C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvqoida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5212
- - C:\Temp\lidbvqoida.exe
    C:\Temp\lidbvqoida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvqoida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\i_lidbvqoida.exe
    C:\Temp\i_lidbvqoida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nicavnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\nicavnkfdx.exe
    C:\Temp\nicavnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nicavnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\i_nicavnkfdx.exe
    C:\Temp\i_nicavnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6020
- - C:\Temp\kfcxvpnhfa.exe
    C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6044
- - C:\Temp\i_kfcxvpnhfa.exe
    C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5208
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3760
- - C:\Temp\ezxrojhbzt.exe
    C:\Temp\ezxrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5132
- - C:\Temp\i_ezxrojhbzt.exe
    C:\Temp\i_ezxrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5768
- - C:\Temp\ztrmjebwuo.exe
    C:\Temp\ztrmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5856
- - C:\Temp\i_ztrmjebwuo.exe
    C:\Temp\i_ztrmjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6136
- - C:\Temp\dbztrljdbw.exe
    C:\Temp\dbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_dbztrljdbw.exe
    C:\Temp\i_dbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlid.exe ups_run
  2⤵
  PID:2080
- - C:\Temp\oigaytqlid.exe
    C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlid.exe ups_ins
  2⤵
  PID:3872
- - C:\Temp\i_oigaytqlid.exe
    C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnk.exe ups_run
  2⤵
  PID:2120
- - C:\Temp\sqkidavtnk.exe
    C:\Temp\sqkidavtnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnk.exe ups_ins
  2⤵
  PID:5484
- - C:\Temp\i_sqkidavtnk.exe
    C:\Temp\i_sqkidavtnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkicavsnl.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\vqkicavsnl.exe
    C:\Temp\vqkicavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkicavsnl.exe ups_ins
  2⤵
  PID:5932
- - C:\Temp\i_vqkicavsnl.exe
    C:\Temp\i_vqkicavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxspkicau.exe ups_run
  2⤵
  PID:6120
- - C:\Temp\faxspkicau.exe
    C:\Temp\faxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxspkicau.exe ups_ins
  2⤵
  PID:1312
- - C:\Temp\i_faxspkicau.exe
    C:\Temp\i_faxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecxupmkfz.exe ups_run
  2⤵
  PID:3640
- - C:\Temp\hecxupmkfz.exe
    C:\Temp\hecxupmkfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecxupmkfz.exe ups_ins
  2⤵
  PID:5348
- - C:\Temp\i_hecxupmkfz.exe
    C:\Temp\i_hecxupmkfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezwrpjh.exe ups_run
  2⤵
  PID:5440
- - C:\Temp\omhezwrpjh.exe
    C:\Temp\omhezwrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezwrpjh.exe ups_ins
  2⤵
  PID:2368
- - C:\Temp\i_omhezwrpjh.exe
    C:\Temp\i_omhezwrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run
  2⤵
  PID:5700
- - C:\Temp\jecwuomgez.exe
    C:\Temp\jecwuomgez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins
  2⤵
  PID:5928
- - C:\Temp\i_jecwuomgez.exe
    C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwqojdbwto.exe ups_run
  2⤵
  PID:4120
- - C:\Temp\zwqojdbwto.exe
    C:\Temp\zwqojdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwqojdbwto.exe ups_ins
  2⤵
  PID:5160
- - C:\Temp\i_zwqojdbwto.exe
    C:\Temp\i_zwqojdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
PID:1832

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1088

C:\Temp\geztrojhbz.sys
C:\Temp\geztrojhbz.sys
1⤵
- Executes dropped EXE
PID:652

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:5600

C:\Temp\qoigbvtolg.sys
C:\Temp\qoigbvtolg.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:2080

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\usmkfcxusm.sys
C:\Temp\usmkfcxusm.sys
1⤵
- Executes dropped EXE
PID:5996

C:\Temp\ezxrpkhczu.sys
C:\Temp\ezxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:6124

C:\Temp\wupmhezurm.sys
C:\Temp\wupmhezurm.sys
1⤵
- Executes dropped EXE
PID:5588

C:\Temp\gebwuomgez.sys
C:\Temp\gebwuomgez.sys
1⤵
- Executes dropped EXE
PID:3212

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\bvtnigdytq.sys
C:\Temp\bvtnigdytq.sys
1⤵
PID:2876

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
PID:3912

C:\Temp\aysqkigays.sys
C:\Temp\aysqkigays.sys
1⤵
PID:5760

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
PID:652

C:\Temp\upmhfzxrpk.sys
C:\Temp\upmhfzxrpk.sys
1⤵
PID:5096

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
PID:5252

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
PID:5628

C:\Temp\jhbztomjeb.sys
C:\Temp\jhbztomjeb.sys
1⤵
PID:2568

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.sys

Path C:\Temp\dbvtolgeyw.sys
Size 141KB
SHA256 89e7feb86e3a470d4dc46400041af97d4c57cd3cf7e504edd716649ae9e2de97
MD5 17878dcf5a7c78c0395088ecbfe9d5ea
SHA1 987ad4af47a0f5c6e5a780366ac39107905263f5
SHA512 349970c89a5ffedc269fecbf604397c355d2251c7517e95e9417fd29e4e6c8725caf9e8461b1d5ab9fb6a0c5d9a1155fd1a4bb88861976c86c9272b8242b44d8
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geztrojhbz.sys

Path C:\Temp\geztrojhbz.sys
Size 141KB
SHA256 e520f481252779cd12021ca6fa70da3cf60895b2c371755c68baad0c0705b76b
MD5 639568de2121596b24f38e20d9c2f9b1
SHA1 ab6e1509c082eff8a6969d5c9d5fe1eb6441e105
SHA512 ad020caa1fd066528b978259d76fbb0a641e8fd411c23f46dc9d8e59a0d4a03432d4afb3cf9a33fbca32f807350fbbd5e673d3ad09db73f3609d046cb1883a99
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvqoida.exe

Path C:\Temp\i_lidbvqoida.exe
Size 243KB
SHA256 bcfa678bf30314bc2adf91205a77cbfe1305a2b7cad89ed0d2d6e5b77f04112b
MD5 3f850dd55b284e808f782d92ed0018b9
SHA1 e7eafdf0b0c14eb5be25d0f96ae94e2d8ec53042
SHA512 5c252f7f3dd8ceb3267582069e9978a1463fb5e051c071d5098e56153eeae71486b7ee214493ce13b4115e69b012aba1ca722f512bd70de5de95cdac774f295c
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:YvMsLaOa3lLNngoqRttA7D
TLSH
T178345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trojgbvtrl.exe

Path C:\Temp\i_trojgbvtrl.exe
Size 243KB
SHA256 bf72fb4af903ad07a38486d47039f3189df8e4f7c563fa7d957421cdf0780074
MD5 2e9a2f70d40caf8095fdd15bb02fadd8
SHA1 2709e956c11c36d7659ccda6a8d294beecfaa063
SHA512 04bd3c628881affc0e5e8919f6acc57a9efa42c5716afdd2fabffc46a1c912fdefa34d1a7ba49bbe35219265348bf5d5993814d891b7f0547b53084abf29b043
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:kvMsLaOa3lLNngoqRttA7P
TLSH
T1EF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgezwro.exe

Path C:\Temp\i_wrojgezwro.exe
Size 243KB
SHA256 5c3747b19c9deab3d21fb3b15e442d6a9a6b768bdf0d0beb1d9d6b93da0e612f
MD5 9178baa2ddee52e24925f352ede0962a
SHA1 485b27883d892b44792287a108621623039beb17
SHA512 2941842011ca6a5ff774576432a39b4685e483fe6e40800fe6b8269c8f06c865ceaac8989603741d232c4f7a0ff21dbfa3e09c48071deb5564a2483ef22c6b3b
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:MvMsLaOa3lLNngoqRttA7z
TLSH
T1F7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbzurm.exe

Path C:\Temp\i_wrpjhbzurm.exe
Size 243KB
SHA256 607ecbbe1a74a6af5bc1cf6c4e9c7ade3e26a891621ab23ce54b3338242b9666
MD5 d9202808a42c51722a4a863cd4ee50b5
SHA1 3216ee75e81c669e16abda9f0923fa3870abd5bc
SHA512 8598b5d9b7ef6d9f26a0300205ba28514e6a88cf1025409c9b9507353a8e7d01b1dbda9a0a0d7984ffc4e6c5bff110faefabc52d41fa5185a1ce818fa6878dee
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:IvMsLaOa3lLNngoqRttA7L
TLSH
T1DD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaysq.exe

Path C:\Temp\i_yvqoigaysq.exe
Size 243KB
SHA256 c8b7bd3ba374742ff0d93250ffc76ebd55d0bec43f8e786d83905f7dc2d3bfc2
MD5 7b9a14ff50b3a95b104ecaa0cd339e2e
SHA1 0630c817e31988920e6d34ff4d452c5e1d2841fe
SHA512 a83d13cec39c384d2a70427c463287132aa3616daaabfdd17bd181b9d907d940f14bb452b13439f8cb4eebaf94ea0fb36261da135d510874373a0659c7a9e9a4
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:dvMsLaOa3lLNngoqRttA7w
TLSH
T11C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvqoida.exe

Path C:\Temp\lidbvqoida.exe
Size 243KB
SHA256 9e811001417480f3d813d5d1900aa1a318a5c89bae0ec4d0093b62c62e8a2a3a
MD5 aa8be40d97c87724e4c940ba69eff9a9
SHA1 11b53e161a161d7787cdcf7a940d239e40bb793b
SHA512 424d0dc4c2a38c8722475df669e0ef994287c92a4aea938208eba18f6a3f1d37dafd699de47f3c63ae977ed6f5b1d4010bd120cb97d94fa0badaf6621a09d96a
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:FvMsLaOa3lLNngoqRttA7A
TLSH
T170345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nicavnkfdx.exe

Path C:\Temp\nicavnkfdx.exe
Size 243KB
SHA256 1736e563f723fadd025de32bc62e46200810f9230cde2428c176de448a57eb76
MD5 eb24e500ac015205ade79bb2d69554d7
SHA1 95db2cd2391ed7045ca2596c173d624099694118
SHA512 fce1ba9c30b820c2094b34b11287c813448c24e0ebad0ff2944c55ec34a5e8f4f6755a9b1c1dafb2bd027f1057e33367bab400f881268ded4c3e7743dfa6f86c
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:TvMsLaOa3lLNngoqRttA7S
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbvtolg.sys

Path C:\Temp\qoigbvtolg.sys
Size 141KB
SHA256 f058bd6a87f69c261e8a80facaf4ee15ff80bfa301e07d1d7d7ef6db79437915
MD5 8ddb864b002a89140a2a1622b6fd756d
SHA1 387e2b5eeb564f38896ee307dcb9dc0870706ce3
SHA512 793d6d65410463352596264b0f7026f6665391c5529f30bc9c4c17dbe5657e0e835187e9f06871ecf355e6e873249928d715f0273b19017bf35f62002f625c0b
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.sys

Path C:\Temp\sqkidavtnl.sys
Size 141KB
SHA256 121a259cab949ba3c58238121187cc55dc27dfdc9eaeb4c8df5def067e1b9368
MD5 ec6a5b117a2db99b59cd144d75f203ce
SHA1 6c6238bdd1d998c5f29ab54662620057c376ffc4
SHA512 a3abb92b6b6c412ca3131f592ff93b6651ff017fd253a9c61db06ad11b0a9043c5538fae78f88b042b13fcea09cf8e3a9864a5d26b4ddb23cad010362541a16d
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E7E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojgbvtrl.exe

Path C:\Temp\trojgbvtrl.exe
Size 243KB
SHA256 85853fd659500f4f9300a2948501c33eb7da4eed52df0bb7e8e97c094b69f355
MD5 f51e76710254ae5147505f0d583d00d9
SHA1 73b9182b92f2cf10471321630e4270fbf2dda6d0
SHA512 92cd7351944cee9837a06098c72ec1017ce94383c008abdae523e7cec11653cb92ec0c4fdbe8160867202f555ae111199672b117c6153dad59b9fbe0f44de99a
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:QvMsLaOa3lLNngoqRttA77
TLSH
T1EE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.sys

Path C:\Temp\vsnkfdxvpn.sys
Size 141KB
SHA256 665813679255802525c8ed0fefb3770be0bbd11d505e6f28d39818f9dd68516b
MD5 3aa2cab2566617a5c1548598606bbb6f
SHA1 e39ddf1c18455660020e3c2b6aceba65f35bba4a
SHA512 7c4d42d2ce43a6e47966ee4c387188e9fc77c04be1295ac348c06cb556fd8e21947428b7cc2e72e31eff44727aed204822c0e4174455950f1fbf55a51ae26b7c
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgezwro.exe

Path C:\Temp\wrojgezwro.exe
Size 243KB
SHA256 e40ea87158041b8df8c063ec50256f3a21153e0deb628613a2e767acdc1f64ea
MD5 bd61efe985471af55b130170053f736d
SHA1 3fe630aa30ebe8d499021f8a91c2937f13a21e98
SHA512 580de6d07f32e762c8aca7640f9fae6dd92221b735aa0124b26b25b7a7252c5015f5bc016c6c94326ff7d991251911fc9137f5e88d5d4a6dce9826f3e792c79b
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:SvMsLaOa3lLNngoqRttA7h
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzurm.exe

Path C:\Temp\wrpjhbzurm.exe
Size 243KB
SHA256 5e510e9678b3631e62e6e6354ec48fc905e8724ca2b751f536c543f077e07ace
MD5 3c25d10bd94ad59bf7543aeb1e3ca078
SHA1 268fd80f9618442aa358c6a8dc00ea1328c42e34
SHA512 c77e445f02148cd35708c848d1127ca11a46b2b808111d5d3d15a0ecb9959c5ebe377232fa580112b644a4985f61ce34b2ac09f751133290b344c6ed763d6cd7
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:uvMsLaOa3lLNngoqRttA7V
TLSH
T156345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.exe

Path C:\Temp\yvqoigaysq.exe
Size 243KB
SHA256 3ec665cbfbf01c1a7555dc41420e376677249f123903e35ed74de760af9ebcbc
MD5 081680dad9d74f800980e3a402ea0720
SHA1 124a2a0f79080fd310d59e17559c82322c45a033
SHA512 7e66a5275a2afe18318595b35e04a10abadcb029038adc37db056e35295789706d7c162fc611970d8c279db6ba18b13e73d009bff4da9d298c9f79d6baf952af
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:kvMsLaOa3lLNngoqRttA7v
TLSH
T1CE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0181141062da123c48165df0d093a0e55afca3eea8ad027fb9481928caca78a0
MD5 7f70ecf3403463cf7c2454474fd1c5d7
SHA1 685610646b0cc829a4afa1a27aeea2d7570f020b
SHA512 463f9dce8208a06625744baca2901f95c2cc5b3660de1e9403e02c31d9dfd4907be356493577fa99579f2df1107603dca61930833d91b8dec3af77fdbf2b29c9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T167B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 13b0d75fe732c257205006067796b1968c9ca0c1f640b81a0c1895fdb31c6384
MD5 7054029344fe1931cfbd73e8ac00de0c
SHA1 bfc6af32073d0cd89fb86e5d55b5aea766e38cde
SHA512 d5d3d13a929ad47cdd128be33c5b5567c48d55845812ec85dd81654c1be6e7455f953e1e1bab679ed0bcbd52e9703279f1f16561b6bddc0e4bb35689c1236f48
TLSH
T1F171D837FE510462E370C13078DEE107757EB19BEA976F17538468BB74367A142A6388
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588587.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588587.TMP
Size 3KB
SHA256 3b8fa2ea4b5e88702fa2a5eb14eebca964824c40609ed56223f72f061e466828
MD5 6ea46afe99eb045c9541cb2d21ac69b8
SHA1 0e7413e24d86366a4ac52bbcfa245f93e04b5925
SHA512 b49dafed033765ca8276fc1620f9c098c1a89874334830d8ca4b143e79770030b5c4b08a7059dc92ff7869f11f339931ffba261b80a615438a65d927e4851f48
TLSH
T1C871E837FE510462E370C13078DEE107357EB19BEA976F17538468BB34367A142A6388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 96c60a7ff354b9aec91b0c41ed8d8761af616b857c507eb6dac6834e891304c6
MD5 5235f224f1bfd4c04cabf30f824d037b
SHA1 8969326c112bcd1983671e40861669fa752a6f02
SHA512 f522fb88a69bf875dbe03378daf611c815cd8399eca40862e5b35b22b6716f0ffe6dc6587c1a33014750ffa1cbc36a6a5701bea107d02570babb804e27b59098
TLSH
T1F531AFF3C2E886AD894156F0BB287E2BCE2E0954832C3D5AC4E4EF5F93E2471D14155E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 eda42c82802e9e764c6a3d1bee68f656e605e97ea0c2a9ca4b86303ca3a9cd93
MD5 3ef0090801d9afad2ba07b5045a570fd
SHA1 24404d004be05518ae3a94d9fd7b4c3f7419e952
SHA512 2a6dd5b98ceb13b7b83adecd12da716ca469019313dbe86b870a29cf5769b0aab616edba7f2d7374e983190cc1b154bf4f0b4f5524d8fedd4c0b116ad80ea168
SSDEEP 192:sxZeR8yM/jK1Ml8Mc7/fSs2rqBPZZThIdp/A/W6+WNs7Y/Y05RiTIg4J:sxZei07/fSs2rq0o/bX/5gc
TLSH
T17A52F906AA349977CCDBD209BA51BF53D6F5157292900E48AAFCDE0C04E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f6d93ec66a60ebd0bc74fb5d593e867969ef74edaafbbf1a9dc767303ebdf62d
MD5 7e70de863cacf5d8d23b27e3e04ecb96
SHA1 519102f00e4508be365fb4358e4ea58cec2cd2ca
SHA512 76255356b6e1da8bf02009b7a0dc3fd05db29107f92128d2b562cdf01ab0ed58a435b98c1ed78aec7eab76a5164580cd877fdaf86208de58029cc41c8b232041
SSDEEP 192:sxZeR8yM/jK1Ml8UQac7/fSsMrFBPZZThIdpZA/W6+WNs7Y/Y052iTIg5XJ:sxZeiqp7/fSsMrF0+/bX/5nH
TLSH
T15C62F916AA345977CCDBD219BA51BF53D6F5157292900E48AAFCDE0C00E6BDD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f2c49f0153122b63b3c4ab238870511652c5ac50e2b269ca9543eb9aeed9de3d
MD5 4dd7508a06a383ce42ec21548e268771
SHA1 84d04f164774f507f8535610bdf10004ca48d54a
SHA512 bf8ff5b5bf8fffa2ac0ed5faa0fb100f376f82de230ce0f6493060ddef0562d8721c4bcffcbd6ac18b850d785fb7884f808836f31f5e1fc96d582485f5a3d91b
SSDEEP 768:8jzXl8pZ2yq7pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3wV1/LlO:8jzXl8pZ2yCEXJ1WRmsYQL0u1jaKwV10
TLSH
T110032C7F284CCB7E4F844E9CEC267F9A6EE8018B9698899447FA480C03C66DF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e1059aeb5367cb6db8112feb8eec37cc79733b71a5106739c2ec319415ec190c
MD5 8c1ea37ba47a0e1e8b3188bc318229cc
SHA1 da0dd0e96b03fc7b85dbf3c8e396ae441d2d3142
SHA512 822b033752b03b698d280d11dbbfb85fc8586cece31aef09d203e603d8a5fb5086d68558568ad434784bf2a903af6b8cee4d21132b62d8d5cbc46868e6747b12
SSDEEP 96:K+98hdDbb+drKlz9+K7Lzn+v19yXNfqyoKTC48gKdu2V:Ob3MvV
TLSH
T1B691F91272FB16513C3D270DC2968B1B8A8171673028A53B3BEA10F66E66E911FFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59264b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59264b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 de6c91b53fbca52643ab844efb7468af6548ce9344238d8fca7087574b180541
MD5 6e20d05c33774493a1a93f08c4058143
SHA1 67473f0bf59bca16d77052a89e981ff3aa41a9c9
SHA512 43bf20211297ee2545b1307b3125cf7723c2dd79269d640ea4c50dfe98bb21bda2f4e3c106ba787e99ab835f885e500d3312de40b64a85b584a3bfb97a736acc
SSDEEP 384:nburQXin91fery8Napt9ivxEpL4hK/HiBtMVIrKQp6Sjc0mitHA:burh9Qry19mPc/8tMVIrKT0mB
TLSH
T13B927E35E8B96C375AAB9155F54335476F7410EB8AC01F88EAE95F0C04D92E8231BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 81363786f9742c32fac604f4405fa28135ecbabab3f1c675c8f52c30ff84db33
MD5 ec136a17e818c1efb22b03db277001ce
SHA1 d4daaec8ea0435a336752d737692f481087acd55
SHA512 0e7ff301b767e8f0ef26604a74d4aadb54ba2a3dd40aac07a435e51367bbd0ba89df4b99c118e14a85d5d40b7af556cc1e5a6a0a6b4f4916594fd8223ad24c65
SSDEEP 384:nnurQXin91ferb8Na1t9ivxEpL4hK/HiBtMVIrKQp6Sjc0mitHA:nurh9QrbV9mPc/8tMVIrKT0mB
TLSH
T1F0927E36E8B9AC375AAB9155F54335476FB410E78AC01F88DAE96F0C04D92E8231BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 3f5bdd3646ed32eea217ce2c946986f0f6bc462e3e7d0f05a0bac04c3bd20894
MD5 a2264340047d036ddb3e6d7ababaccc7
SHA1 d14875995215f028d0de059847b217db889d358b
SHA512 3471070fe89abd45a5eedecd9b1ad44de8a64ab6e48c3d41f65ee56c0e1e77fe45e9b36923048bb841eec1627eb9fb7b2fbac97814420ca78136c46afc673c10
SSDEEP 384:nRiFFurQXin91ferl8Ni8TUNTUlIlit9ivxE/Q4hjDfxc/HiAeMVIrKQp6Sjc0mB:4FFurh9QrlXwg69mU7c/7eMVIrKT0mB
TLSH
T109D2B3F598D7993AE9AE4383A73E7D469EBCC09375844984BBC45E0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f793a1cf7583159061dd796fad6ea3f8181ef5d5ed2191eaddbb10a884980ed
MD5 a7e6d90645fda73ac39deb64fc121ac3
SHA1 dd3007a25ed29fc8a412e3e52f696fbd95207e34
SHA512 f93275555646b3e09f475e54560c24cdc0ea6c609e7012307884f60f53fe37c681ba27e0a7e6732b44ee6031fbb1793609dc2dcfc76aa81dd1af2932f935ae2a
SSDEEP 192:7GNb6fNNQmiUyGzHsPL/GPTFXRrV7qkBU6:7GNb61LVzMPL/IUYU6
TLSH
T103020A35BCA8687B8EE3AE59F58377175FA4206B9A951F44C6E82F0C40D769C1303C32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9912510441d0b12200247e8d5250eadb3a11203b732276f58d2a8d224221de0e
MD5 7893cad790785199fec27c1553c18078
SHA1 5575604bb7afe7411db8f4fd319b9d42aaa380d1
SHA512 013a5a2276f566768824e270806504cadbb3497eea152a391425d13c5dedf28d136c9306d53381a3cefb313493c2aed02e47e89908ab0e4508020f3c095dc32a
SSDEEP 384:nfurQXin91ferl8Nait9ivxEUL4hK/HiktMVIrKQp6Sjc0mitHA:furh9Qrli9mqc/1tMVIrKT0mB
TLSH
T191927E36E8BD6C375AAB9145F54335476F7410EB8AC41F88DAE99F0C04C92E8231BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 d8c9a8b500bf1996b10dd3f79a5eac36c209a5b5d1d5e0ef6726d047a418a02e
MD5 44b400a7e2f57194bfcafa728908d0e7
SHA1 2a13e784317a66da7e1fb5ef0486e78ff7a28ee4
SHA512 68b3f3c1a66c461a4738bf299a35d0835531ac951b45eb17e5314593a62e57b3ea82e1dfb2674bed3e6265508713ff313be0fe5b97b25312b78dbd31ed2f0490
SSDEEP 384:nRiFburQXin91ferf8Ni8TUNTUlIlit9ivxEUQ4hjDfwc/HiCZMVIrKQp6Sjc0mB:4Fburh9QrfXwg69mvSc/ZZMVIrKT0mB
TLSH
T11FD2B4F598D7993AE9AE4387A73E7D469EBCC09375844984BBC45E0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9570148a12936ee82e70d22b31497761b5a7d0fe2d85d75fa8f92083d3463d1a
MD5 de5f4c2a666cfbfe00bb77156a2285fe
SHA1 235317b87a005b2e96f7200bb13c998b3149fffa
SHA512 de11bfe601d815a271285d209547babde6fa24a70366eca7824abcd1e43ee3d9c1d1e08a42a6cf90789ae851b0d4eefa4435ae0ade36311b1720cfc7ffd16288
SSDEEP 384:nAurQXin91fer48Nait9ivxEUL4hK/HiktMVIrKQp6Sjc0mitHA:Aurh9Qr4i9mqc/1tMVIrKT0mB
TLSH
T151927E36E8BD6C375AAB9149F54335476FB410EB8AC41F88DAE95F0C04D92E8231BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 596b9bc31fef4f2d5a3f73d3e42cea19346236baae9deeffed3a660998fcdfc7
MD5 925f67a0eefb48225efc040a132787e6
SHA1 a41f3df2f8e2133584d455cedbe1469a5927b4aa
SHA512 3fd5ba071541ffb66cfd27f8e10ee24032d0c305d9fbbd0a49d84af6f9a3a8963ef81cff7909ddce58050d96dfe811a6a7420ddd575c20102e19b14af91583d2
SSDEEP 384:nRiFIurQXin91ferh8Nt8TUNTUlIlit9ivxEJQ4hjxfxc/Hi3eMVIrKQp6Sjc0mB:4FIurh9QrhKwg69meRc/ceMVIrKT0mB
TLSH
T109D2B3F598D79936E9AE4387A73E7D469EBCC09375884984BBC45E0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 67cfc6403c58f1d453fb959e66e291f873ba7be5575422941474804ed8801f87
MD5 4566d68031394b43246d4a012478ede2
SHA1 3b1bf54bfbc25ffa19ebc01e6d630e6d8dccee3a
SHA512 706ee74fd9f9857dfe47cf349bf1263092317067c7c1e01b94c3609dd400ddc7afda38e07d6e07af5dcab91b65c5572ebc04b60c95b4ffc134be7e4352664d96
SSDEEP 192:7GNr6fN4QmiUySSskGL/GPTFXR8irYVV3ZOq2dU6:7GNr61YD5TL/Hi+LMU6
TLSH
T12E120A35E8ACAC3B4EE6A524F58336975E7410B79E855F58E6E82F0C04D76D8270B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 305b14e8288bc1e64fce45cff7e15988c5af7d254e6f350c1de89e8b98e31624
MD5 773fd08eccf29c18dcdaa805d0d6bbfc
SHA1 243cdcd80e58d2f11e11acb11ea7fa4064683eb3
SHA512 ad2928c740337df5d143edf4b41242799ad96cf74a76ca22c96ea372b8bd73821868c967b267be1deae99c524e62926826fbc52d46eb44f020ddf8511b9fbf8b
SSDEEP 384:nRiF9urQXin91ferO8Nt8TUNTUlIlit9ivxELQ4hjxfxc/HiveMVIrKQp6Sjc0mB:4F9urh9QrOKwg69mgRc/QeMVIrKT0mB
TLSH
T16AD2B3F598D79936E9AE4383A73E7D469EBCC09375844984BBC45E0CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

83dd0e5a-7cc4-44ee-a8a9-40cbac020ae0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83dd0e5a-7cc4-44ee-a8a9-40cbac020ae0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

04366f55-e9ae-4254-9c86-2cc97f01af31.tmp

Path C:\Users\Admin\AppData\Local\Temp\04366f55-e9ae-4254-9c86-2cc97f01af31.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8ce2bd6f-0b60-49c8-b076-69e270aef6ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ce2bd6f-0b60-49c8-b076-69e270aef6ca.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_1483775529\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89e58318-8e4f-441d-898d-7954bb23cf67.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2372_406425214\89e58318-8e4f-441d-898d-7954bb23cf67.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1506439335\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_1575199164\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_158737189\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2372_43162165\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/652-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/652-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/652-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2080-545-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2568-806-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3212-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3212-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3912-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-826-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-753-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5252-768-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5588-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5628-788-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5760-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-525-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-583-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download