208dd5514ca03c5daed59336d4e2b009b66e07d3db75f8ae45a857e7d8d82b80

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
Size 243KB
Sample261023-vs87jscy4s
SHA256 208dd5514ca03c5daed59336d4e2b009b66e07d3db75f8ae45a857e7d8d82b80
MD5 dc3ddb893bad4b27a8dcd475329ae6fa
SHA1 cf86f3199ce54a8096f4e78ae6e01d31a55880b0
SHA512 acb4a78284b845c6166c9dfd9d83cfd79038d635cd64343a68668ae38331d07faf4a980a3a7641ccb20fca9e326de232de09c427fb5547a919162b0831318ccb
SSDEEP 3072:zX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:bLhhLkQa3lLNngoqRttA7d
TLSH
T145345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4464	CP.exe
3356	wuomgezwrp.exe
5552	CP.exe
6060	CP.exe
6032	i_wuomgezwrp.exe
4300	eywqojgbzw.sys
4036	CP.exe
6084	ytrljdbwto.exe
5708	CP.exe
1716	CP.exe
6072	i_ytrljdbwto.exe
1108	wtomgdywtr.sys
4852	CP.exe
2116	oigdyvtnlg.exe
5440	CP.exe
5880	CP.exe
1312	i_oigdyvtnlg.exe
2968	vtnlfdyvqo.sys
2764	CP.exe
5740	oigdywqoig.exe
1644	CP.exe
2640	CP.exe
1456	i_oigdywqoig.exe
5148	sqkidavsnl.sys
4552	CP.exe
2188	kicavsnlfd.exe
3704	CP.exe
4100	CP.exe
2568	i_kicavsnlfd.exe
3040	nkfcxvpnhf.sys
2352	CP.exe
4548	pkicausnkf.exe
5288	CP.exe
5772	CP.exe
5376	i_pkicausnkf.exe
5520	zusmkfcxup.sys
1424	CP.exe
3488	mkecaxupmk.exe
4528	CP.exe
3172	CP.exe
2608	i_mkecaxupmk.exe
864	cxuspjhecw.sys
764	CP.exe
2436	fzxusmkecw.exe
5172	CP.exe
5528	CP.exe
4332	i_fzxusmkecw.exe
3708	omhezwrpjh.sys
3848	CP.exe
3196	rmkecwuomh.exe
460	CP.exe
2848	CP.exe
1452	i_rmkecwuomh.exe
6032	tjebwuomge.sys
2364	CP.exe
1584	hbztrljebw.exe
3484	CP.exe
1640	CP.exe
5048	i_hbztrljebw.exe
3324	trojgbywtr.sys
3504	CP.exe
5204	trombvtolg.exe
5104	CP.exe
4520	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2260_594804145\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_739357887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_352860480\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_1887323774\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_79059756\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_1887323774\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_848173970\_locales\ne\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trombvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdyvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecaxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecaxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trombvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztromgey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5680	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3872	ipconfig.exe
2376	ipconfig.exe
932	ipconfig.exe
4512	ipconfig.exe
4724	ipconfig.exe
5588	ipconfig.exe
1468	ipconfig.exe
4596	ipconfig.exe
1704	ipconfig.exe
1932	ipconfig.exe
5924	ipconfig.exe
964	ipconfig.exe
200	ipconfig.exe
5304	ipconfig.exe
3184	ipconfig.exe
4576	ipconfig.exe
4336	ipconfig.exe
2888	ipconfig.exe
1456	ipconfig.exe
5448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{1CC53897-70F0-4DC3-9328-B9F73CCA1AA2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6032	i_wuomgezwrp.exe
Token: SeDebugPrivilege	6072	i_ytrljdbwto.exe
Token: SeDebugPrivilege	1312	i_oigdyvtnlg.exe
Token: SeDebugPrivilege	1456	i_oigdywqoig.exe
Token: SeDebugPrivilege	2568	i_kicavsnlfd.exe
Token: SeDebugPrivilege	5376	i_pkicausnkf.exe
Token: SeDebugPrivilege	2608	i_mkecaxupmk.exe
Token: SeDebugPrivilege	4332	i_fzxusmkecw.exe
Token: SeDebugPrivilege	1452	i_rmkecwuomh.exe
Token: SeDebugPrivilege	5048	i_hbztrljebw.exe
Token: SeDebugPrivilege	1936	i_trombvtolg.exe
Token: SeDebugPrivilege	5000	i_dyvqoigayw.exe
Token: SeDebugPrivilege	3112	i_fdxvqnigay.exe
Token: SeDebugPrivilege	5956	i_cxvpnhfaxs.exe
Token: SeDebugPrivilege	5684	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	5692	i_kecxupmhfz.exe
Token: SeDebugPrivilege	4708	i_mkecwupmhf.exe
Token: SeDebugPrivilege	1220	i_omgezwrpjh.exe
Token: SeDebugPrivilege	2408	i_ebztromgey.exe
Token: SeDebugPrivilege	5632	i_gbytqljdby.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4636	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	90
PID 4636 wrote to memory of 2260	4636	iexplore.exe	91
PID 2260 wrote to memory of 3496	2260	msedge.exe	92
PID 2260 wrote to memory of 4940	2260	msedge.exe	93
PID 2260 wrote to memory of 5680	2260	msedge.exe	95
PID 2260 wrote to memory of 4940	2260	msedge.exe	93
PID 2260 wrote to memory of 4940	2260	msedge.exe	93
PID 2260 wrote to memory of 5944	2260	msedge.exe	96
PID 2260 wrote to memory of 5944	2260	msedge.exe	96
PID 2260 wrote to memory of 1496	2260	msedge.exe	97
PID 2260 wrote to memory of 1496	2260	msedge.exe	97
PID 2260 wrote to memory of 1496	2260	msedge.exe	97
PID 2260 wrote to memory of 3920	2260	msedge.exe	98
PID 2260 wrote to memory of 3920	2260	msedge.exe	98
PID 2260 wrote to memory of 3920	2260	msedge.exe	98
PID 2260 wrote to memory of 4468	2260	msedge.exe	99
PID 2260 wrote to memory of 4468	2260	msedge.exe	99
PID 2260 wrote to memory of 4468	2260	msedge.exe	99
PID 2260 wrote to memory of 3944	2260	msedge.exe	100
PID 2260 wrote to memory of 3944	2260	msedge.exe	100
PID 2260 wrote to memory of 3944	2260	msedge.exe	100
PID 2260 wrote to memory of 5416	2260	msedge.exe	102
PID 2260 wrote to memory of 5416	2260	msedge.exe	102
PID 3000 wrote to memory of 4464	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	103
PID 2260 wrote to memory of 2336	2260	msedge.exe	107
PID 2260 wrote to memory of 4148	2260	msedge.exe	108
PID 2260 wrote to memory of 2336	2260	msedge.exe	107
PID 2260 wrote to memory of 4148	2260	msedge.exe	108
PID 3356 wrote to memory of 5552	3356	wuomgezwrp.exe	106
PID 2260 wrote to memory of 3688	2260	msedge.exe	112
PID 2260 wrote to memory of 4864	2260	msedge.exe	113
PID 2260 wrote to memory of 4864	2260	msedge.exe	113
PID 2260 wrote to memory of 4308	2260	msedge.exe	114
PID 2260 wrote to memory of 4308	2260	msedge.exe	114
PID 2260 wrote to memory of 1716	2260	msedge.exe	115
PID 2260 wrote to memory of 1716	2260	msedge.exe	115
PID 2260 wrote to memory of 3800	2260	msedge.exe	116
PID 2260 wrote to memory of 3800	2260	msedge.exe	116
PID 3000 wrote to memory of 6060	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	119
PID 3000 wrote to memory of 4036	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	123
PID 6084 wrote to memory of 5708	6084	ytrljdbwto.exe	125
PID 3000 wrote to memory of 1716	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	128
PID 3000 wrote to memory of 4852	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	132
PID 2116 wrote to memory of 5440	2116	oigdyvtnlg.exe	134
PID 3000 wrote to memory of 5880	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	137
PID 3000 wrote to memory of 2764	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	141
PID 5740 wrote to memory of 1644	5740	oigdywqoig.exe	143
PID 3000 wrote to memory of 2640	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	146
PID 2260 wrote to memory of 4484	2260	msedge.exe	149
PID 2260 wrote to memory of 4504	2260	msedge.exe	150
PID 2260 wrote to memory of 4176	2260	msedge.exe	151
PID 3000 wrote to memory of 4552	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	154
PID 2188 wrote to memory of 3704	2188	kicavsnlfd.exe	156
PID 3000 wrote to memory of 4100	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	159
PID 3000 wrote to memory of 2352	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	163
PID 4548 wrote to memory of 5288	4548	pkicausnkf.exe	165
PID 3000 wrote to memory of 5772	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	168
PID 3000 wrote to memory of 1424	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	172
PID 3488 wrote to memory of 4528	3488	mkecaxupmk.exe	174
PID 3000 wrote to memory of 3172	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	177
PID 3000 wrote to memory of 764	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	181
PID 2436 wrote to memory of 5172	2436	fzxusmkecw.exe	183
PID 3000 wrote to memory of 5528	3000	2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe	186
PID 2260 wrote to memory of 4920	2260	msedge.exe	190

C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_dc3ddb893bad4b27a8dcd475329ae6fa_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x354,0x7ffd4f53c188,0x7ffd4f53c194,0x7ffd4f53c1a0
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,1010166265114843458,8968756547437937942,262144 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,4759931506722058042,6010380687471035313,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:11
      4⤵
      System Time Discovery
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,9203905584171957702,16663424366806453642,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,10349849167769104141,12777434944041695807,2097152 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17318486398038753788,8056852385982881908,2097152 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=1580 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,15219849380525167842,13758852133691660368,2097152 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,9155452395196062924,11668915001254313933,2097152 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10838647772317993314,7849680522203327011,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,18160896364797363706,7502784804281175200,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,95673787748260197,7785178047612974135,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,2719444151427089813,18196088970842180778,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,2719444151427089813,18196088970842180778,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6105009670932153269,6484557228175661087,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,17360214460108871044,5338627535382086144,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,3948569920023018677,8186183050871864383,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,5340183182230894287,17727292609712160633,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,2180389435540572746,11257530133058289159,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10306426340457780385,11090822747111970425,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13671987702318541667,13962011454489971763,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,437145266502055985,12346265594005900935,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,5588608518273768362,3805336434032138072,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,6754358377922750911,17779837321119005586,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,4940017821061418710,7352182968830278397,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,11999769904924452655,362954110317765689,262144 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18401263039301295764,9530801432753110672,524288 --field-trial-handle=2304,i,1014280978038961995,2517964106090305572,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:14
      4⤵
      PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4464
- - C:\Temp\wuomgezwrp.exe
    C:\Temp\wuomgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6060
- - C:\Temp\i_wuomgezwrp.exe
    C:\Temp\i_wuomgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4036
- - C:\Temp\ytrljdbwto.exe
    C:\Temp\ytrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\i_ytrljdbwto.exe
    C:\Temp\i_ytrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdyvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Temp\oigdyvtnlg.exe
    C:\Temp\oigdyvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdyvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5880
- - C:\Temp\i_oigdyvtnlg.exe
    C:\Temp\i_oigdyvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\oigdywqoig.exe
    C:\Temp\oigdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2640
- - C:\Temp\i_oigdywqoig.exe
    C:\Temp\i_oigdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\kicavsnlfd.exe
    C:\Temp\kicavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\i_kicavsnlfd.exe
    C:\Temp\i_kicavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5772
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecaxupmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1424
- - C:\Temp\mkecaxupmk.exe
    C:\Temp\mkecaxupmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecaxupmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3172
- - C:\Temp\i_mkecaxupmk.exe
    C:\Temp\i_mkecaxupmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:764
- - C:\Temp\fzxusmkecw.exe
    C:\Temp\fzxusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5528
- - C:\Temp\i_fzxusmkecw.exe
    C:\Temp\i_fzxusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3848
- - C:\Temp\rmkecwuomh.exe
    C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2848
- - C:\Temp\i_rmkecwuomh.exe
    C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2364
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1640
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trombvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3504
- - C:\Temp\trombvtolg.exe
    C:\Temp\trombvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trombvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Temp\i_trombvtolg.exe
    C:\Temp\i_trombvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayw.exe ups_run
  2⤵
  PID:5296
- - C:\Temp\dyvqoigayw.exe
    C:\Temp\dyvqoigayw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayw.exe ups_ins
  2⤵
  PID:5736
- - C:\Temp\i_dyvqoigayw.exe
    C:\Temp\i_dyvqoigayw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  PID:5532
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  PID:4540
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfaxs.exe ups_run
  2⤵
  PID:4576
- - C:\Temp\cxvpnhfaxs.exe
    C:\Temp\cxvpnhfaxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfaxs.exe ups_ins
  2⤵
  PID:1608
- - C:\Temp\i_cxvpnhfaxs.exe
    C:\Temp\i_cxvpnhfaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhfzxs.exe ups_run
  2⤵
  PID:1452
- - C:\Temp\cxvpnhfzxs.exe
    C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
  2⤵
  PID:932
- - C:\Temp\i_cxvpnhfzxs.exe
    C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxupmhfz.exe ups_run
  2⤵
  PID:2212
- - C:\Temp\kecxupmhfz.exe
    C:\Temp\kecxupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxupmhfz.exe ups_ins
  2⤵
  PID:2744
- - C:\Temp\i_kecxupmhfz.exe
    C:\Temp\i_kecxupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  PID:4992
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  PID:4680
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  PID:4092
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  PID:5956
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztromgey.exe ups_run
  2⤵
  PID:3720
- - C:\Temp\ebztromgey.exe
    C:\Temp\ebztromgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztromgey.exe ups_ins
  2⤵
  PID:1612
- - C:\Temp\i_ebztromgey.exe
    C:\Temp\i_ebztromgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqljdby.exe ups_run
  2⤵
  PID:1476
- - C:\Temp\gbytqljdby.exe
    C:\Temp\gbytqljdby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqljdby.exe ups_ins
  2⤵
  PID:4780
- - C:\Temp\i_gbytqljdby.exe
    C:\Temp\i_gbytqljdby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5348

C:\Temp\eywqojgbzw.sys
C:\Temp\eywqojgbzw.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\wtomgdywtr.sys
C:\Temp\wtomgdywtr.sys
1⤵
- Executes dropped EXE
PID:1108

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:2968

C:\Temp\sqkidavsnl.sys
C:\Temp\sqkidavsnl.sys
1⤵
- Executes dropped EXE
PID:5148

C:\Temp\nkfcxvpnhf.sys
C:\Temp\nkfcxvpnhf.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\zusmkfcxup.sys
C:\Temp\zusmkfcxup.sys
1⤵
- Executes dropped EXE
PID:5520

C:\Temp\cxuspjhecw.sys
C:\Temp\cxuspjhecw.sys
1⤵
- Executes dropped EXE
PID:864

C:\Temp\omhezwrpjh.sys
C:\Temp\omhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:3708

C:\Temp\tjebwuomge.sys
C:\Temp\tjebwuomge.sys
1⤵
- Executes dropped EXE
PID:6032

C:\Temp\trojgbywtr.sys
C:\Temp\trojgbywtr.sys
1⤵
- Executes dropped EXE
PID:3324

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:1520

C:\Temp\lfdyvqoigd.sys
C:\Temp\lfdyvqoigd.sys
1⤵
PID:2888

C:\Temp\nlfdxvsqki.sys
C:\Temp\nlfdxvsqki.sys
1⤵
PID:3372

C:\Temp\nlfdxvpnhf.sys
C:\Temp\nlfdxvpnhf.sys
1⤵
PID:4900

C:\Temp\hfzxspnhec.sys
C:\Temp\hfzxspnhec.sys
1⤵
PID:2684

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:2616

C:\Temp\wrpjhbzurp.sys
C:\Temp\wrpjhbzurp.sys
1⤵
PID:4376

C:\Temp\bzwromjebz.sys
C:\Temp\bzwromjebz.sys
1⤵
PID:4668

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
PID:4632

C:\Temp\lgdbvqoigd.sys
C:\Temp\lgdbvqoigd.sys
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbzw.sys

Path C:\Temp\eywqojgbzw.sys
Size 141KB
SHA256 810dbe4fd389b29d81b0a2b31c932bb2d9d883aa2511e423c3f14d313ce3981f
MD5 69b6959b087f8f415aeb9c870e95598b
SHA1 3b06383de9a5efcc24974d56eae2d617bd95c786
SHA512 72a85fe3043b7f9ee1643130216269ea78a1450ba9cac777e0eb9331f999aafd6a587796a690f6f9c712dc997981f1097a05dd42d3fdbfb8209f929eb09bb69a
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavsnlfd.exe

Path C:\Temp\i_kicavsnlfd.exe
Size 243KB
SHA256 255a3ef4475d23e839535eeec1d5544b4f2cb21a9710dc206750b8c023acee9e
MD5 3f3a52987239e9531ee4f9b1c8ba0cba
SHA1 bf4cd95ca19c5fdd6db3e1b65f785cccbd7d1f5b
SHA512 dc7640e2e9edc0e9dc131bf345bb696d360f6f73262da43b69809d9563e99f1b824707b455d119ee684d8c21ba22f5fb9db1186cb2765c4158ba1a4cda38c43a
SSDEEP 3072:EX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:iLhhLkQa3lLNngoqRttA7O
TLSH
T132345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigdyvtnlg.exe

Path C:\Temp\i_oigdyvtnlg.exe
Size 243KB
SHA256 b6dbc1d9a693ce1148bf59ff0e7a320a95d664a04b49b0534b9d1341946c67b6
MD5 97d51caedc8f3002c4856002c67ae0c6
SHA1 4ec58678048461f0f05702c471cd5ea86957d1ba
SHA512 f720abf49827c440df69e3783202f9d94a6f447a92d86378e123cf284878cf1c439ad4b7514d6e91bade5eb2daf5071121738348abfb35ca57f61f892dea5ff9
SSDEEP 3072:AX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:GLhhLkQa3lLNngoqRttA7a
TLSH
T187345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigdywqoig.exe

Path C:\Temp\i_oigdywqoig.exe
Size 243KB
SHA256 1d0851716f23ae5552e0a4bea847bbcca72badd6a19172faea869fcb6c39b928
MD5 6b1ca9d4cda8e272a06c725824b5b4dd
SHA1 7370b5e53fe41013ba1e54dc88e29d2c4ba5592e
SHA512 df855ccfb6b7c1dd8935c244e7e4853aab24d6090275f931147f3592feec840e1876a6ed3ec875b54284bf4ef8a8d8a7824955f51848c6ffe097af448ce3b8be
SSDEEP 3072:0X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:yLhhLkQa3lLNngoqRttA7S
TLSH
T118345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgezwrp.exe

Path C:\Temp\i_wuomgezwrp.exe
Size 243KB
SHA256 485056c1db860db1c1883dd083e5ba18957433bb5c9d43029272fc35e855b2b0
MD5 fa880b348ff2fd5eceda28fb4155dc3f
SHA1 8f79590a0514f7a0b3a002190e2a8edf33db6b9a
SHA512 8f7e96501b9c36a41e2631e19a26301bade85d36580987f9aec7e5818d8098a5cf6eb83282f80174ee3982f9b508f383c0f45389f5900d5700007e929c7e0e4d
SSDEEP 3072:NX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:9LhhLkQa3lLNngoqRttA7j
TLSH
T1D8345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljdbwto.exe

Path C:\Temp\i_ytrljdbwto.exe
Size 243KB
SHA256 763c2b3e93c3038196a8c064739f484b765cc790adda0e64f5329a6807a96830
MD5 c72d9ac1c09741cde42196b8e9f2d95e
SHA1 761fa22af01560ddb9e0acbb13d2e42dd8392f58
SHA512 2ac3545961a6e7c516a83c0cd6abbbcbe0219994aad94a4685f2f89d884c0c6146f070662ee266c21777afd7568064931edd882e2c9c926f9938843b89a403b5
SSDEEP 3072:+X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:kLhhLkQa3lLNngoqRttA7I
TLSH
T1F7345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfd.exe

Path C:\Temp\kicavsnlfd.exe
Size 243KB
SHA256 4a844edd158410eb3d511c505d5ca65cbd38cc4aa2eb8e3f51decd0d20a33cb3
MD5 3f44bc09a8f085db18cab3e819ebf7ab
SHA1 418f0ea697337a6f295ec2d9e7184e7956eaddb6
SHA512 1a7e11e8931b489026e50cd4efee96ef54c185edeb53f84b29890d44297d61dc6a458b5167ffd2bd8af90127e6bac0cce6b187b824f5a86077a43840b6a20da1
SSDEEP 3072:6X1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:oLhhLkQa3lLNngoqRttA70
TLSH
T194345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.sys

Path C:\Temp\nkfcxvpnhf.sys
Size 141KB
SHA256 e21ddcddc6e42c2f079fa14dd54ac9699e3c27ae76bf355b21164947bcd38d44
MD5 b9d31e2cc49bf4480c0b9530a4a60285
SHA1 ed1ff6bfe748c3f930f4831152a17ee178db1191
SHA512 50b1a16f29e6672fa0412910bd7799cf6241ff975bf7560cb4896221a3b067556d2a54970fc13931e788612a4a4646aa61f1d9e445c9b1f863eef84d53948b60
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdyvtnlg.exe

Path C:\Temp\oigdyvtnlg.exe
Size 243KB
SHA256 4a4821d51c90ebe3cf85ce961b8cbd0a865101c67a96b5d5bd5ec59e126ecbf6
MD5 2e5270d5fe9503a7fb5f05751fc56681
SHA1 d0134aadc5485e1257f4669ce84695c5fb64d2e2
SHA512 41536ddb8bb92befb0b9d9ecd685f60e779584b85f48078810e165d3e19dbbb8e06ec652167432e7d3be1618d105c573aac5d59d0fcdc56e0c2ce93f417c3e97
SSDEEP 3072:oX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:OLhhLkQa3lLNngoqRttA7+
TLSH
T11E345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdywqoig.exe

Path C:\Temp\oigdywqoig.exe
Size 243KB
SHA256 587aa86cf8ff73ce0146146e63f62f6469c610c5472095b015dafbeac9c0c6cf
MD5 f9e6f0706c2a4c67aa9c5b41413433b6
SHA1 99b4dbc7a2b6ebe8f421aff699b76c68db864dd8
SHA512 7b7c6ebd4618bcd52933736bd6a44f4cb82782d03b203e7504fe8b42e1d86a90a6057a1252a25b6046d3d6dff2186a33d3570d7754025f87c2d4a465835cc239
SSDEEP 3072:yX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:ALhhLkQa3lLNngoqRttA7w
TLSH
T1DE345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.exe

Path C:\Temp\pkicausnkf.exe
Size 243KB
SHA256 bbb0fe31e36f14130c251f7f6824bfa3fb329136645c315ec2d8c3d822e15cfd
MD5 40995a663684660d7605d0b86dd650fc
SHA1 521dc3bc00da4a59001fd47db9fb083058d2bd2d
SHA512 1cc7ba670db2f3f24c770f0c61885ab352050648efbeb0d84fa65eb4ffea130ab8ee64a07e1f0fb140dfba5b313eb6efbe9d6b404e01f77a76a1d661b7d5d254
SSDEEP 3072:cX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:aLhhLkQa3lLNngoqRttA7S
TLSH
T1CA345A0172818032E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavsnl.sys

Path C:\Temp\sqkidavsnl.sys
Size 141KB
SHA256 f9699a9f824c735b64508b1b36aa957897d155f72f40d436ff5152c51bab51a9
MD5 377dfb3a29df37950a056544e365dd1b
SHA1 4c4a619c01676053ab5154f6b20a4ba8898b6b4d
SHA512 321fe90e0930d64699dfe6569ebf483438eba0ffb616509444fa1dd19ffc36a030a9c1f6b962618bb3f1bddefd58815bb9758b2b2951b146cd8be27a68fa3e62
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.sys

Path C:\Temp\vtnlfdyvqo.sys
Size 141KB
SHA256 1d1292294ba433e5f88d577ad14b0d0cbf64bd9eebbaf6441e2a137a8552e362
MD5 17b460854d2d653be71cc3cae24d8c8a
SHA1 5aa52401c7d0b0d2fd3ccc29035332a74eb054b9
SHA512 9adee1fe502e52d239f44ebe8c243cfa303bdf1fa63a5e6b4a69d68a049379448abb93683ce471eac2d8ad3444db4e154106380fb9ca9d64d3a67c0963c0c1ed
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgdywtr.sys

Path C:\Temp\wtomgdywtr.sys
Size 141KB
SHA256 945d79d80b174b541e7d6d8c3b788eea642080881fc565ea1636d7b30f9f3aa8
MD5 577b084040654cee19768b0b8aa7b40d
SHA1 ab31944f043dcf47ae04cef6a809938a80090cf2
SHA512 be717bdfb9f695e4d7a9180a69e220156fd0e2c0a557a41064e9c1e5197f22f9dc3198f5970d795b5bf8f0584b32157cef96c86320cf1109d5645b7620bd2514
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwrp.exe

Path C:\Temp\wuomgezwrp.exe
Size 243KB
SHA256 599dc37915b1a80241d37314d8b7ba1e3ca43ea98b9fc4975d24cbdae54bfa85
MD5 7cc3340401bc42e207fcee65b1f38afa
SHA1 4a304c4750e1058f28164a1fd6a0d773eae2ea8f
SHA512 5197fea9f40b49899c5977d697fde01ec6c5c7206b350d4631519f4fded70e236564a7bdaf2dec4d7489ca2e9d130aa773fc7b81e80e395580e691b229d40319
SSDEEP 3072:EX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:iLhhLkQa3lLNngoqRttA7O
TLSH
T12F345A0272818031E75A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbwto.exe

Path C:\Temp\ytrljdbwto.exe
Size 243KB
SHA256 84675e4456bebf60b8e56c0c097a91f0d2b2ecca4606e6286862dcc107804f69
MD5 ce51cdf179a4a1313ce1c6678c006bda
SHA1 21c61af4b1b2a9aa3a5d1458946f69d936cdf89e
SHA512 083a36bf15642b561adf278591bcc3114d16c8744128036d105bb6c988017567870b70ffe4674b3e03d3ccb207ea700b3dfdf89e75a0ad560f6e90518faef311
SSDEEP 3072:qX1JhhLJ+BJhf7y3a3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:4LhhLkQa3lLNngoqRttA7o
TLSH
T171345A0272818031E71A0B78046AE7A1467E7C394BA5D5CFF7A83B791E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d062449-3ee9-4653-8c40-7b6ddff9d524.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d062449-3ee9-4653-8c40-7b6ddff9d524.tmp
Size 38KB
SHA256 f536349d4a8aae149f71271907fea0b384e04044dda00c6e8df93ca62782c6b0
MD5 10456c7d2256125bba59183612e051c9
SHA1 aee324f5446f299ddc328b503cf81195f4fb416e
SHA512 c7da4a7c81b5e21e96fe2423d29bc9728a900cb26644374f1cf397fbd30a22939d42ba88f2f5f7528dc9e9551a33d23420c726dbb2db429f18fa68c60e97e89e
SSDEEP 768:r/UxvxjgC+I32BQKtEtyE57Y0GZxJsXBdK8EPSHUPpMs:eZj3+I3Gm70/JsXf7uSfs
TLSH
T10303C030E8A19D6359FBE3A0360A73C7EEF415F3C9C14D688AE99B0D018779D134791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b031eed-ff72-408a-b475-ca97c24f2ab9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6b031eed-ff72-408a-b475-ca97c24f2ab9.tmp
Size 42KB
SHA256 d804515e07c921064fb20282c44b645494a781fd59f536c98ff74e9716ecdf52
MD5 af3bd9ba10c256b9f6d3b1c95706355c
SHA1 99868a6c118e3b14f7c1811bf00d2619d6fe6036
SHA512 5a5a968cfc03d88f072681d998abfc6f556917a6dbc26e972c4b6060d156ad26621c4c52b3236250bfa1e01cd1056e6957ddf6319190d27302feabe8abc816fc
SSDEEP 768:AFdr3IwgEz+9QEtDqE57Y0GZxJsXBdK8ZP6hulLk:Er3rm70/JsXf7hSQA
TLSH
T1C81317F098D39A37D9AE8783673D2D8299BCC1A3B5884984F7C95E4CCC821BFC346805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bbd9de5-d1f5-4cbe-b2e5-b040200c9533.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bbd9de5-d1f5-4cbe-b2e5-b040200c9533.tmp
Size 34KB
SHA256 3c2774dc8af57fe3149e9421518ae8d18ecb46ed13058b78391555353b8621d2
MD5 e9f8456822eb0236f7da7479f9ec84ec
SHA1 f87741b061063ccb6eb2da00309bbf6c5347722c
SHA512 f3829bffdf4c7d638e4a108fbdd33577d64f123013150cd177862f1ba6abe80627f897e3a420d8335e5575321166116beff78e939da31ebec7111a078937abd0
SSDEEP 768:8g3/O+mKtEtIeE57Y0GZxJsXBdK8ZP6hulLk:8g3BP70/JsXf7hSQA
TLSH
T1E4F2B030A8E19E638DFBD791760A32C3EEA451B3C9C44E58DAD99B4C008769E274791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8484bbc9-666b-449d-8c06-3d4a0fe4e030.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\8484bbc9-666b-449d-8c06-3d4a0fe4e030.tmp
Size 105KB
SHA256 9260436c94a1833abca9dcb8131c4cccc5ad060d971912bea100bd9a1f921659
MD5 af61b6d65ba3a3316e74e463b5701b5a
SHA1 6eb4c6b1f52ab93bd585b83e03db2052e8d9313d
SHA512 eb387117515b996bd2a3e1182f8a70e62ac5ce6630decd079365c2ee3e53d58b3e9e3b2cb9655230ce60582101fdeae974849f5c45568c2a24be3d96cdd59fea
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T1E1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

090d17da-4b00-4ff6-aa9e-a6d5d1b536d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\090d17da-4b00-4ff6-aa9e-a6d5d1b536d3.tmp
Size 29KB
SHA256 3ef932076214886633a5134a6f1931fecae9dc4055eaec78cdc7b4322b750b26
MD5 d646ecf9c745b92646f6a374f11c2c93
SHA1 53eb92020435734f4631591b323498d5d8811bd3
SHA512 8913c6272945c9eb7daa588210c3f4da24a4acf54f479f8f4a304ee7ca2a624c2e49e3b637def0f1e96a80132d432a073e1454658fa8091f0a93050dc07dff64
SSDEEP 768:6Jaj3yv7pLuLjFKWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OV40TomBAro5O:6Jaj3ypEjFKWgm0fbbu1jaX0ThBLdS
TLSH
T19DD2DA7B640CCB7F4F904ADD98197E9B6DA802CB9698CD8047FE941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6023e0b5-77bb-43fa-8cf5-ec10f391d38e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6023e0b5-77bb-43fa-8cf5-ec10f391d38e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8af3e53f-503d-4b0d-9471-1cac1dca2998.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8af3e53f-503d-4b0d-9471-1cac1dca2998.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8e3eb1b5-1750-446d-97ec-8928ee437dc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e3eb1b5-1750-446d-97ec-8928ee437dc4.tmp
Size 12KB
SHA256 2eba6684e3729cc2c20c4cd7eadc7f8b7822c1ecfaa272fb6925dd6908bb0cd7
MD5 4a26d658b818b21c4e3ba8d0e1516db6
SHA1 2b3d5c66d5ed161fa5c3c9da4cf353d54b7bff82
SHA512 d27e3b6270e776c03ea37656a36932b8d284d5a6d22579e808cafc4dbbeddd3bee4adbff3bf9a09987d7a8001ba3d1f8811652b0eb6c47e04408f4cee34aec8f
SSDEEP 192:sxRoRICT/f1s7qZoxPDdzoA8p9k/g6+WNCiZWa/YU2ZNfng5GNIgD7JHJ:sxRoFT/f1s78oRDQ2/5J/AJp
TLSH
T1C442B815AD68A93B4CCBD31ABB55BF53D6F91032A0E11E48B6FC891C04EA7DD621780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3640bc12dc7bfed80fd1c3088db10eea1d9546852c7fb2b009a994c05c001abe
MD5 ab22b7fc96d06b2107c998d2c68785ec
SHA1 bd0bec1880a408d9139dacea155de5c085d14b28
SHA512 9f14ff9eb5cdcc0c7decce7a18e8df4ec065b47f415fe80841b2183f6e28ee36c6f68d6f85e007959dd098e8bf311dccafbe2f810f2332288a4fd2e6ec9b0ed3
TLSH
T1B951B8E865A085E2F7D48230B3C22CA7B53CC5B854432EB25757FEBF7906B19E26021C
MD5 SHA1 SHA512 TLSH

Submit Download

0db579f9-4207-46af-83cd-c09d4b773ba7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0db579f9-4207-46af-83cd-c09d4b773ba7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

1e396fcc-48ce-4e01-abea-cd31c8d68424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e396fcc-48ce-4e01-abea-cd31c8d68424.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

27f328d0-43f4-43bb-ae22-502ba6c662ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27f328d0-43f4-43bb-ae22-502ba6c662ff.tmp
Size 2KB
SHA256 1d2e9b0d2c7f3e6633e7ccc4a3659749ad89aeb800d7b3d9057e5f0a8044a7b9
MD5 4694cd5586ef933f56dfca605b881a06
SHA1 63ba0f276cdd7c3bfa064d676a1731dc66f052a0
SHA512 7f7ac5e501688887db51c414de965e30003641d110646ccb8671d9c2f2b87f9e73db89002543d9281748b941f9a340f6f1eb88409a1cf24723362f70285d4f49
TLSH
T11A51CEF7C3E8852E8A0196F0AA146E2BDE1D0925432C7D5AC4E49F2B93F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

86251c59-9ab0-4eac-9a9d-6fd33777958c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86251c59-9ab0-4eac-9a9d-6fd33777958c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f6208cd1f348dc81e5aad709d76033237f663ab151566dd5b701415755f9ce22
MD5 a8325740f96b7cc026939b9eac1a03a2
SHA1 99eb77935003f8014b1fb7b4aa85c22da57752b2
SHA512 8b4957a916820ae852084b40e19fcabb31b6d4d75b251d57810e571a580baf601ef35f7bc1d5239f4c3b0975d4428e534f19c208a37880219ca7707b299fabcb
SSDEEP 48:K0yI/KPqUHy5UIDKVicalI5KuMMDyXgtuiomm:K0y4KPq+6UgKVihlGKuMqQ
TLSH
T1C1918050313B0600397D3A4991D6E65E838331A37069AA3B7BEF81A65E6FE015DFC9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a658ca64-e3ab-44a9-9b3a-130545b794a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a658ca64-e3ab-44a9-9b3a-130545b794a8.tmp
Size 12KB
SHA256 597302fe1bafe331daf51bf73b2bd282d0074671d2fc08c7b04160307dbd10c2
MD5 ecefc3a40a8f94b23a5a10b1e1228f18
SHA1 99a8698f3dde83bf0073105fa251e347b99a69d8
SHA512 5f3822febcb50b14c61830aed13c5f1a483ff2ac40177e90a80285e1fd2b40ed7fa32c3c94d2c61b6aedb03d8738143b0a82f32c8f8e34f7e2c9fda4bd7445db
SSDEEP 192:sxRoRICT/f1sjqZoxPDdzoA8p9k/g6+WNCiZWa/YU2ZN5Rg5GNIgDJJHJ:sxRoFT/f1sj8oRDQ2/5J/IHp
TLSH
T12242B815AD68A93B8CCBD319BB55BF53D6F91032A0D11E48B6FC8A1C04EB7DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e297473c-8117-40b2-b81c-492904ccb9bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e297473c-8117-40b2-b81c-492904ccb9bc.tmp
Size 11KB
SHA256 050da4d7f286b5495d1d0b9e9d6af210fffff01e1506c874242ffb2962ddf198
MD5 bd687d617de8eb0f6167f470e54c4cc3
SHA1 2861a020219a19b97cde51d0a2abfaac4b506759
SHA512 032b2ba33e94b6637d4c048a39d8d9dd43cb4098a72dcd1ee4298da40b836fbcf6867c53b1b20fa98af501726c24f0923f3941a8ac5a85177615cbfebbfdee65
SSDEEP 192:sxRvRICT/f1shqZoxPDdzoA8p9k/g6+WNCiZWa/YU2ZNfng5GNIgVJHJ:sxRvFT/f1sh8oRDQ2/5J/AXp
TLSH
T17642B815AD68A93B8CCBD319BB55BF53D6F91032A0D11E48B6FC891C04EA7DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746139d4-4104-4b79-9822-a25bdbed9144.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\746139d4-4104-4b79-9822-a25bdbed9144.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8f2df1b-cb4d-4d49-a03b-51eab90efe32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8f2df1b-cb4d-4d49-a03b-51eab90efe32.tmp
Size 34KB
SHA256 cbef72976510601f1fa6d502dd24ce7ef1c6374a5706ddba638084974a754e02
MD5 85f85155c54d467b70b4e98d716c89ac
SHA1 92e676545a22251f78b7412a16edec3f776c69c2
SHA512 e6d5a34f5fdd66fb059320b22876d9518d3a7adfb97b6ffdaeff5daaf23e03af4eb15946f9d487815c579213fefd8dfac9030aad7afdf63a7388faff4e099aa2
SSDEEP 768:Rg36n+mKtEtyE57Y0GZxJsXBdK8ZP6hulLk:Rg3tm70/JsXf7hSQA
TLSH
T16FF2B030E8E19E638DFBD791760A32C3EEE451B3C9C44E58DAD99B4C008769E274751B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

271e6d0e-dda0-45e3-bb00-39e4d4a1c772.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\271e6d0e-dda0-45e3-bb00-39e4d4a1c772.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

b9d196fc-69ad-4b1b-b9ed-c1bcc4d00bce.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b9d196fc-69ad-4b1b-b9ed-c1bcc4d00bce.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

c9b24e08-c95c-4260-ab61-692d3ea22590.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c9b24e08-c95c-4260-ab61-692d3ea22590.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

f4b25b89-04f0-44fc-b13e-3406c41a0bec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f4b25b89-04f0-44fc-b13e-3406c41a0bec.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e809dabf-3b2a-46d5-880b-1d1b6d7800b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e809dabf-3b2a-46d5-880b-1d1b6d7800b9.tmp
Size 37KB
SHA256 8973a34795eef20a7842f932bb603c90187450eaf67dda813672a7b80a5ed045
MD5 6933829175950424849e0b54262b25f9
SHA1 e7f8d667cac4231994cae41726b6767eb9eb32fc
SHA512 f50db39a9ebd87a7aff682f0947cb01ca71935a4d095f5c44e9b4965ad02d0ba2be517df997ef90feb5abfadb8f4806261016ff3bec81323542ae310aa50380d
SSDEEP 768:A/UxvxjgC+I3EQKttE57Y0GZxJsXBdK8lzSHUPpMs:tZj3+I3kU70/JsXf7RSfs
TLSH
T11103C034E8909D739DFBA394360E7287EEF446B3D5C10DA48AED9B0D028B26D034391A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7635560-f9cc-4a30-ac8d-9de65e50c06b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7635560-f9cc-4a30-ac8d-9de65e50c06b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bb0d4c22-7152-4980-a568-8fc68bb40aac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb0d4c22-7152-4980-a568-8fc68bb40aac.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

36a1ca3e-f2ae-410f-a82e-0520582c3058.tmp

Path C:\Users\Admin\AppData\Local\Temp\36a1ca3e-f2ae-410f-a82e-0520582c3058.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd27aa42-edf3-4172-b44b-97e01c59f76a.tmp

Path C:\Users\Admin\AppData\Local\Temp\dd27aa42-edf3-4172-b44b-97e01c59f76a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2260_1539990585\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2260_1737248289\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_1887323774\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_352860480\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_739357887\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2260_79059756\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/864-572-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1108-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1520-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1520-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2616-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2684-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2888-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2888-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2968-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3324-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3708-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-704-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-724-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4508-747-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4632-727-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-708-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5148-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5520-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5520-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-575-0x0000000000010000-0x0000000000083000-memory.dmp

Download