3fd00fe5136780af06e0b6d531364baef046028fb68e9af2f985bbdd192451e4

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
Size 243KB
Sample261024-1qdkrafh44
SHA256 3fd00fe5136780af06e0b6d531364baef046028fb68e9af2f985bbdd192451e4
MD5 0e1b981db347614d5a140d1ab4bb91f6
SHA1 62729aa9b483d8e4f78de898aed5bffcd673a444
SHA512 087a31a3e74bbcf815a2d131635653f2b205d6fd0a2423607b8d9ab6b637cbcaa0d06ec6bc1d46b1fae973f886dd0dcd7eacf012930ec01d6edd966b00fdf372
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:GvMsLaOa3lLNngoqRttA7A
TLSH
T1FC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1028	CP.exe
2748	igbvtnlgay.exe
5036	CP.exe
5252	CP.exe
4256	i_igbvtnlgay.exe
1720	lfdxvqnlfd.sys
5440	CP.exe
3100	fdxvsnkifd.exe
2412	CP.exe
2016	CP.exe
1172	i_fdxvsnkifd.exe
1664	qkifausnkf.sys
5132	CP.exe
1232	nhxspkicau.exe
5868	CP.exe
2688	CP.exe
5324	i_nhxspkicau.exe
6004	hfzxspkhcz.sys
1484	CP.exe
2480	caxvpmkhcz.exe
3024	CP.exe
5664	CP.exe
1056	i_caxvpmkhcz.exe
4576	hfcaurmkec.sys
2020	CP.exe
3020	cwupmhfzxr.exe
4264	CP.exe
2196	CP.exe
5764	i_cwupmhfzxr.exe
608	hcwupezwuo.sys
1052	CP.exe
5856	wuomhbztrm.exe
6088	CP.exe
5472	CP.exe
4864	i_wuomhbztrm.exe
684	ecwurljhbz.sys
5268	CP.exe
5332	ebztrojhtr.exe
5344	CP.exe
5916	CP.exe
1108	i_ebztrojhtr.exe
4908	oigbytrljd.sys
3508	CP.exe
3336	olgeywqoig.exe
1236	CP.exe
1720	CP.exe
1688	i_olgeywqoig.exe
2100	qligayvtnl.sys
5864	CP.exe
5764	tnlgdyvqoi.exe
4580	CP.exe
3944	CP.exe
5556	i_tnlgdyvqoi.exe
5364	vqnlfdyvqo.sys
1184	CP.exe
5860	ifaysqkica.exe
4100	CP.exe
5628	CP.exe
5928	i_ifaysqkica.exe
2840	nlfaysqkic.sys
2648	CP.exe
916	faxvsqkica.exe
5984	CP.exe
2232	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_253695557\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_51673236\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3348_573479954\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_253695557\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_253695557\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_2096662054\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1602586170\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_2096662054\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_253695557\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1172608207\_locales\zh_CN\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvpmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrojhtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsnkifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsnkifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvpmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrojhtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhbztrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1140	ipconfig.exe
4164	ipconfig.exe
2952	ipconfig.exe
1716	ipconfig.exe
3856	ipconfig.exe
4924	ipconfig.exe
2100	ipconfig.exe
4784	ipconfig.exe
2184	ipconfig.exe
2912	ipconfig.exe
1044	ipconfig.exe
1500	ipconfig.exe
1044	ipconfig.exe
1916	ipconfig.exe
5724	ipconfig.exe
5508	ipconfig.exe
2880	ipconfig.exe
1824	ipconfig.exe
3656	ipconfig.exe
2912	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{BBCEB201-559F-4209-B048-CF7E18AA14C0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe
3348	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	i_igbvtnlgay.exe
Token: SeDebugPrivilege	1172	i_fdxvsnkifd.exe
Token: SeDebugPrivilege	5324	i_nhxspkicau.exe
Token: SeDebugPrivilege	1056	i_caxvpmkhcz.exe
Token: SeDebugPrivilege	5764	i_cwupmhfzxr.exe
Token: SeDebugPrivilege	4864	i_wuomhbztrm.exe
Token: SeDebugPrivilege	1108	i_ebztrojhtr.exe
Token: SeDebugPrivilege	1688	i_olgeywqoig.exe
Token: SeDebugPrivilege	5556	i_tnlgdyvqoi.exe
Token: SeDebugPrivilege	5928	i_ifaysqkica.exe
Token: SeDebugPrivilege	3432	i_faxvsqkica.exe
Token: SeDebugPrivilege	2628	i_nhfcxvpnhf.exe
Token: SeDebugPrivilege	3628	i_wupmkecxup.exe
Token: SeDebugPrivilege	3544	i_ezwuomjhez.exe
Token: SeDebugPrivilege	1108	i_omjebwuomg.exe
Token: SeDebugPrivilege	3628	i_qomgeywroj.exe
Token: SeDebugPrivilege	4252	i_wtolgeywqo.exe
Token: SeDebugPrivilege	4604	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	2780	i_tnlidbvtnl.exe
Token: SeDebugPrivilege	3760	i_hfaxsqkica.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3348	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 5892	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	89
PID 5892 wrote to memory of 3348	5892	iexplore.exe	90
PID 3348 wrote to memory of 4708	3348	msedge.exe	91
PID 3348 wrote to memory of 3420	3348	msedge.exe	93
PID 3348 wrote to memory of 2928	3348	msedge.exe	94
PID 3348 wrote to memory of 3420	3348	msedge.exe	93
PID 3348 wrote to memory of 3420	3348	msedge.exe	93
PID 3348 wrote to memory of 2584	3348	msedge.exe	95
PID 3348 wrote to memory of 2584	3348	msedge.exe	95
PID 3348 wrote to memory of 1344	3348	msedge.exe	96
PID 3348 wrote to memory of 1344	3348	msedge.exe	96
PID 3348 wrote to memory of 1344	3348	msedge.exe	96
PID 3348 wrote to memory of 4972	3348	msedge.exe	97
PID 3348 wrote to memory of 4972	3348	msedge.exe	97
PID 3348 wrote to memory of 4972	3348	msedge.exe	97
PID 3348 wrote to memory of 252	3348	msedge.exe	98
PID 3348 wrote to memory of 252	3348	msedge.exe	98
PID 3348 wrote to memory of 252	3348	msedge.exe	98
PID 3348 wrote to memory of 244	3348	msedge.exe	99
PID 3348 wrote to memory of 244	3348	msedge.exe	99
PID 3348 wrote to memory of 244	3348	msedge.exe	99
PID 3348 wrote to memory of 3364	3348	msedge.exe	101
PID 3348 wrote to memory of 3364	3348	msedge.exe	101
PID 436 wrote to memory of 1028	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	102
PID 3348 wrote to memory of 4260	3348	msedge.exe	104
PID 3348 wrote to memory of 4260	3348	msedge.exe	104
PID 3348 wrote to memory of 3884	3348	msedge.exe	105
PID 3348 wrote to memory of 3884	3348	msedge.exe	105
PID 2748 wrote to memory of 5036	2748	igbvtnlgay.exe	107
PID 3348 wrote to memory of 1376	3348	msedge.exe	111
PID 3348 wrote to memory of 4988	3348	msedge.exe	112
PID 3348 wrote to memory of 4988	3348	msedge.exe	112
PID 3348 wrote to memory of 1972	3348	msedge.exe	113
PID 3348 wrote to memory of 1972	3348	msedge.exe	113
PID 3348 wrote to memory of 2708	3348	msedge.exe	116
PID 3348 wrote to memory of 2708	3348	msedge.exe	116
PID 3348 wrote to memory of 3284	3348	msedge.exe	117
PID 3348 wrote to memory of 3284	3348	msedge.exe	117
PID 436 wrote to memory of 5252	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	118
PID 436 wrote to memory of 5440	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	122
PID 3100 wrote to memory of 2412	3100	fdxvsnkifd.exe	124
PID 436 wrote to memory of 2016	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	127
PID 436 wrote to memory of 5132	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	131
PID 1232 wrote to memory of 5868	1232	nhxspkicau.exe	133
PID 436 wrote to memory of 2688	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	136
PID 436 wrote to memory of 1484	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	140
PID 2480 wrote to memory of 3024	2480	caxvpmkhcz.exe	142
PID 436 wrote to memory of 5664	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	145
PID 3348 wrote to memory of 2600	3348	msedge.exe	148
PID 3348 wrote to memory of 3284	3348	msedge.exe	149
PID 3348 wrote to memory of 3408	3348	msedge.exe	150
PID 436 wrote to memory of 2020	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	153
PID 3020 wrote to memory of 4264	3020	cwupmhfzxr.exe	155
PID 436 wrote to memory of 2196	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	158
PID 436 wrote to memory of 1052	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	162
PID 5856 wrote to memory of 6088	5856	wuomhbztrm.exe	164
PID 436 wrote to memory of 5472	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	167
PID 436 wrote to memory of 5268	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	171
PID 5332 wrote to memory of 5344	5332	ebztrojhtr.exe	173
PID 436 wrote to memory of 5916	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	176
PID 436 wrote to memory of 3508	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	180
PID 3336 wrote to memory of 1236	3336	olgeywqoig.exe	182
PID 436 wrote to memory of 1720	436	2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe	185
PID 3348 wrote to memory of 2600	3348	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0e1b981db347614d5a140d1ab4bb91f6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x370,0x7ffd0cc3c188,0x7ffd0cc3c194,0x7ffd0cc3c1a0
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13788948659865546522,2313010869432495178,262144 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:2
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,14542428795177957977,3030079367579258378,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:11
      4⤵
      System Time Discovery
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,18389838987884173293,13063131022794102500,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,1060936478573443002,10471366269507672707,2097152 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,2562105947945466259,36076997727605014,2097152 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4380,i,7435061436194723586,897164897711481854,2097152 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4392,i,14358715494277276499,6628353073996542200,2097152 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:9
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,8502877932380197155,14557103370136274394,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=1624 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,7756408481561714172,11399302974097021508,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,9419368239374388790,16696220096559995764,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9313762669337925767,8392280174139962372,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9313762669337925767,8392280174139962372,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,10268926066757953893,11397483642504689373,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,15615877996997386552,6846543654525456716,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,7444812661606422090,9029783045939825674,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,12748226169867955752,14875700747997095399,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5891820041177809979,15932896800643099250,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,5908017442242013341,16102488978021653324,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,2252319655404033645,982421424116278975,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9705161733550023749,13097751934228501062,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,18111728023779578834,18369062750069868223,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,11092471794506105295,1804747580405411775,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,3263550109821712588,17195173443528364882,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,1989983640473904299,4936304835612906239,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3648,i,8753866527521066947,814713008885056818,262144 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11012569788802510138,6509256606803819962,524288 --field-trial-handle=2792,i,1325856109753279321,17367977043636372705,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbvtnlgay.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1028
- - C:\Temp\igbvtnlgay.exe
    C:\Temp\igbvtnlgay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbvtnlgay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5252
- - C:\Temp\i_igbvtnlgay.exe
    C:\Temp\i_igbvtnlgay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvsnkifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5440
- - C:\Temp\fdxvsnkifd.exe
    C:\Temp\fdxvsnkifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvsnkifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2016
- - C:\Temp\i_fdxvsnkifd.exe
    C:\Temp\i_fdxvsnkifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5132
- - C:\Temp\nhxspkicau.exe
    C:\Temp\nhxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Temp\i_nhxspkicau.exe
    C:\Temp\i_nhxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxvpmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1484
- - C:\Temp\caxvpmkhcz.exe
    C:\Temp\caxvpmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxvpmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5664
- - C:\Temp\i_caxvpmkhcz.exe
    C:\Temp\i_caxvpmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Temp\cwupmhfzxr.exe
    C:\Temp\cwupmhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2196
- - C:\Temp\i_cwupmhfzxr.exe
    C:\Temp\i_cwupmhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1052
- - C:\Temp\wuomhbztrm.exe
    C:\Temp\wuomhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5472
- - C:\Temp\i_wuomhbztrm.exe
    C:\Temp\i_wuomhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrojhtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5268
- - C:\Temp\ebztrojhtr.exe
    C:\Temp\ebztrojhtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrojhtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\i_ebztrojhtr.exe
    C:\Temp\i_ebztrojhtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3508
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlgdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Temp\tnlgdyvqoi.exe
    C:\Temp\tnlgdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlgdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3944
- - C:\Temp\i_tnlgdyvqoi.exe
    C:\Temp\i_tnlgdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\ifaysqkica.exe
    C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5628
- - C:\Temp\i_ifaysqkica.exe
    C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxvsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2648
- - C:\Temp\faxvsqkica.exe
    C:\Temp\faxvsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxvsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Temp\i_faxvsqkica.exe
    C:\Temp\i_faxvsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcxvpnhf.exe ups_run
  2⤵
  PID:3980
- - C:\Temp\nhfcxvpnhf.exe
    C:\Temp\nhfcxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcxvpnhf.exe ups_ins
  2⤵
  PID:5920
- - C:\Temp\i_nhfcxvpnhf.exe
    C:\Temp\i_nhfcxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmkecxup.exe ups_run
  2⤵
  PID:5544
- - C:\Temp\wupmkecxup.exe
    C:\Temp\wupmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmkecxup.exe ups_ins
  2⤵
  PID:2788
- - C:\Temp\i_wupmkecxup.exe
    C:\Temp\i_wupmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwuomjhez.exe ups_run
  2⤵
  PID:1712
- - C:\Temp\ezwuomjhez.exe
    C:\Temp\ezwuomjhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwuomjhez.exe ups_ins
  2⤵
  PID:2868
- - C:\Temp\i_ezwuomjhez.exe
    C:\Temp\i_ezwuomjhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omjebwuomg.exe ups_run
  2⤵
  PID:1672
- - C:\Temp\omjebwuomg.exe
    C:\Temp\omjebwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omjebwuomg.exe ups_ins
  2⤵
  PID:5832
- - C:\Temp\i_omjebwuomg.exe
    C:\Temp\i_omjebwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomgeywroj.exe ups_run
  2⤵
  PID:1244
- - C:\Temp\qomgeywroj.exe
    C:\Temp\qomgeywroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomgeywroj.exe ups_ins
  2⤵
  PID:4940
- - C:\Temp\i_qomgeywroj.exe
    C:\Temp\i_qomgeywroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeywqo.exe ups_run
  2⤵
  PID:1332
- - C:\Temp\wtolgeywqo.exe
    C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeywqo.exe ups_ins
  2⤵
  PID:5204
- - C:\Temp\i_wtolgeywqo.exe
    C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run
  2⤵
  PID:1556
- - C:\Temp\qlidbvtnlg.exe
    C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
  2⤵
  PID:3308
- - C:\Temp\i_qlidbvtnlg.exe
    C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidbvtnl.exe ups_run
  2⤵
  PID:908
- - C:\Temp\tnlidbvtnl.exe
    C:\Temp\tnlidbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidbvtnl.exe ups_ins
  2⤵
  PID:1148
- - C:\Temp\i_tnlidbvtnl.exe
    C:\Temp\i_tnlidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxsqkica.exe ups_run
  2⤵
  PID:3728
- - C:\Temp\hfaxsqkica.exe
    C:\Temp\hfaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxsqkica.exe ups_ins
  2⤵
  PID:3008
- - C:\Temp\i_hfaxsqkica.exe
    C:\Temp\i_hfaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2820

C:\Temp\lfdxvqnlfd.sys
C:\Temp\lfdxvqnlfd.sys
1⤵
- Executes dropped EXE
PID:1720

C:\Temp\qkifausnkf.sys
C:\Temp\qkifausnkf.sys
1⤵
- Executes dropped EXE
PID:1664

C:\Temp\hfzxspkhcz.sys
C:\Temp\hfzxspkhcz.sys
1⤵
- Executes dropped EXE
PID:6004

C:\Temp\hfcaurmkec.sys
C:\Temp\hfcaurmkec.sys
1⤵
- Executes dropped EXE
PID:4576

C:\Temp\hcwupezwuo.sys
C:\Temp\hcwupezwuo.sys
1⤵
- Executes dropped EXE
PID:608

C:\Temp\ecwurljhbz.sys
C:\Temp\ecwurljhbz.sys
1⤵
- Executes dropped EXE
PID:684

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:4908

C:\Temp\qligayvtnl.sys
C:\Temp\qligayvtnl.sys
1⤵
- Executes dropped EXE
PID:2100

C:\Temp\vqnlfdyvqo.sys
C:\Temp\vqnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:5364

C:\Temp\nlfaysqkic.sys
C:\Temp\nlfaysqkic.sys
1⤵
- Executes dropped EXE
PID:2840

C:\Temp\ifaxspnkfd.sys
C:\Temp\ifaxspnkfd.sys
1⤵
PID:608

C:\Temp\xupmhfzxrp.sys
C:\Temp\xupmhfzxrp.sys
1⤵
PID:1672

C:\Temp\jhczxrpkhc.sys
C:\Temp\jhczxrpkhc.sys
1⤵
PID:3076

C:\Temp\rmjhezwurm.sys
C:\Temp\rmjhezwurm.sys
1⤵
PID:1088

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
PID:3860

C:\Temp\tqoigebvtq.sys
C:\Temp\tqoigebvtq.sys
1⤵
PID:904

C:\Temp\ywqoigaytq.sys
C:\Temp\ywqoigaytq.sys
1⤵
PID:2644

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
PID:5972

C:\Temp\nlfcaxspni.sys
C:\Temp\nlfcaxspni.sys
1⤵
PID:244

C:\Temp\xspkicsmke.sys
C:\Temp\xspkicsmke.sys
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxvpmkhcz.exe

Path C:\Temp\caxvpmkhcz.exe
Size 243KB
SHA256 ddbe2b1537a337bfe255f6e2b2684c86f32d1538dfaab32d2f7cdbde736b9cec
MD5 904bedbe5933a8ac046c0ef2d96635d9
SHA1 49ec9db3fb22c98371484c6ab8eaf6cf478d1e37
SHA512 e888f62683dbdb2c36e909f7fcf5a0e93b8afb812054805c0412cea67c106331b2c3021ecc41b9f16e83b39a313a0a4c158efa13ff5860a760aed210a1f6361c
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:7vMsLaOa3lLNngoqRttA7j
TLSH
T109345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhfzxr.exe

Path C:\Temp\cwupmhfzxr.exe
Size 243KB
SHA256 04294a60b65e1e7afdd1016c57952495bae6e93edd8fc4d69f56602595eb7d4d
MD5 35ff6f99f2c861fa3ecf672820ce3f56
SHA1 aadcbd125321df33f196ab52b3a72c557e6f7863
SHA512 05d3ca18e7de0ec3d601c72f306c33614ee8d531e9fa907572839e5e648ba90e4ee813665b12019fde25bcb6d2aafec532e6e1906afdcef558e20d01eb20714b
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:QvMsLaOa3lLNngoqRttA7i
TLSH
T1EB345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsnkifd.exe

Path C:\Temp\fdxvsnkifd.exe
Size 243KB
SHA256 3cfd6ac1678bbd9460f6e3e2dd227b1b8c584359402a6f719142bdc111b84c57
MD5 3d4e8adbd8eb87748d663cf9aa812048
SHA1 7c816f66349bb586fd25130869c52da3c2a3bc5e
SHA512 b1b608a018512dcd0d22ccdb51fa8673f70fec52e9da34c6b0e9296a901a32aedb91663382c8b113be6ff20da53ce788946db0e6dca18bdd4005cfbbcd680ba5
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:evMsLaOa3lLNngoqRttA74
TLSH
T1B4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwupezwuo.sys

Path C:\Temp\hcwupezwuo.sys
Size 141KB
SHA256 acdfa11394e99e6220a97915da844ee56b2102083ee15b963ef082bfd70efc00
MD5 ce2f69661fcfcc2c315ce7c027f8f1ab
SHA1 119f82fda9805db4e428904499e89024b557494d
SHA512 43d1c7003d6c1432e2cc81490833a8e4f03ead31ed28b1c726c377692280303f9e1cf0c3f9b062fee31e23c8729ea27cd623b2f0a6f7bb8c9b1c764188169e99
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcaurmkec.sys

Path C:\Temp\hfcaurmkec.sys
Size 141KB
SHA256 5cd02557a56f31c1626a302830c0359235ab32656ccf0c0454d12ca9ef3cfc90
MD5 6c697dc0a2bcee72dc32443bcd4ccb2e
SHA1 90869931eb9452feba4080296100a5f3afe82079
SHA512 949d9c1795cb116f02c718d9a4987af785724632bf693c0956cb7b2142fe42256f8a52b685d3bc662a649b877c8f684cbae7d1ce1b20db5581173f5c21a1d5f8
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T127E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkhcz.sys

Path C:\Temp\hfzxspkhcz.sys
Size 141KB
SHA256 c4a90c49809cdb4f7ea875df06fce7df6a4ccd314f1b9734e45e76e4b2b294b8
MD5 5894dc856a518e22b2cf4bdb616bd7c7
SHA1 f37565e9bdeda9782f724154491a1e5779da7b8c
SHA512 a77f0e2d97332610cbc5cc731f4a28c7e32344e908d04b363b3c0479a2bcdefcbc5e17106e22b0b6d19675b5673b2ca412c603466210c6b0988d9b086360e89a
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caxvpmkhcz.exe

Path C:\Temp\i_caxvpmkhcz.exe
Size 243KB
SHA256 ac647592e133e24f7a92532e6112645459be61ba3c3bf0049b9b095632060eb3
MD5 330b4b96c9d1c622f9ca4906a5a9053f
SHA1 69e48dbfe0337fe926635b16843b9b8c15e0dae0
SHA512 3aa95921761c0f6b00be629b4026aabf2d8075879f2c05e8c583a47da091b072b5e863405c3b0fbe26f9ef40718833e32d9b89d4f5930d464e21e6e20fe4466b
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:cvMsLaOa3lLNngoqRttA7O
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupmhfzxr.exe

Path C:\Temp\i_cwupmhfzxr.exe
Size 243KB
SHA256 facf5b7bd0eea133242186fc9d2338f8206b6c14d4de59601663cb3dcb46dccd
MD5 52e828cb04ead8c7aeff7aa41166853d
SHA1 de30ac6ad1ca725074d35bf09a072a6fb4fd25b8
SHA512 b263653a0726e8c636e1a91b68fef5cad0b031feb5affaf1ea3121585b9102ea75606be7ab29690969b9d412f61032b4fdff2cbfdf6e48aa65af80af5f65aa6e
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:rvMsLaOa3lLNngoqRttA7P
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvsnkifd.exe

Path C:\Temp\i_fdxvsnkifd.exe
Size 243KB
SHA256 a3efec9bf9bf734e47b7e0bd05e53c5740cacfce2585841afe4250553b808ef6
MD5 954c1c6f1c9017fa7edc9356fc457037
SHA1 18619175d0cd540cf33280f1d489f160f1ec591a
SHA512 74d6f471401972fbdb69db67e3c81c9c94bd26602495f6f45519b62ffe4f94a8b140ebfbacd83c09b7a5462868038d80263c740791390781947db6cd869a1058
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:nvMsLaOa3lLNngoqRttA7b
TLSH
T1CD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbvtnlgay.exe

Path C:\Temp\i_igbvtnlgay.exe
Size 243KB
SHA256 b72c26de2a2f8f587a2d263386f094ff9011253f7eb54cd5cb50ef037a4b9dcf
MD5 d6975510bc8f87baa2a400a08264935a
SHA1 2851a2d820c2f7ba3f165827bb88f8ebd555c07b
SHA512 574e1b3356acc819a091fc65b081cf50e7f5f9d6e99e81f07fa84ef19a55a5965f9a97ca0c26892bb241d4e3b55ee79e865cacf75d641925cb97fc21b8956423
SSDEEP 3072:HCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:ivMsLaOa3lLNngoqRttA7Y
TLSH
T1A5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhxspkicau.exe

Path C:\Temp\i_nhxspkicau.exe
Size 243KB
SHA256 57a23e1646a9a4ed24c62f3e8bf8fd1752e84adc537abdcf21aef26afaed5675
MD5 06dcfeff6c584d7ae28739fbb859342c
SHA1 a46c02297e7428bbdfde0c8a3da2558c8a50be1d
SHA512 5e9454e12b1b56467f89442ea8151f09bbfd4560920379f7b5eeb4ce32eb8a40ae60b0dc680609990e48c8fa5a679ba5575fe6f3a8766e6614d3a5dda096f81c
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:OvMsLaOa3lLNngoqRttA7Y
TLSH
T13D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbvtnlgay.exe

Path C:\Temp\igbvtnlgay.exe
Size 243KB
SHA256 5015c45f226e427b9103d58c42995877f1ed1c64ed8c8f8d28b92616023610a6
MD5 c2de25988c14176220d51b078e40a77b
SHA1 7257d49a89c1901a8483685ada3283edd14d942a
SHA512 183b978c8ac41eaa8d91575421bc013836a029a709e58d986a661362d8de3c85dedc322cb2f13c0760d679c0b22de80d3574192fa5c5232e55e73722a7098662
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:7vMsLaOa3lLNngoqRttA7v
TLSH
T19E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqnlfd.sys

Path C:\Temp\lfdxvqnlfd.sys
Size 141KB
SHA256 2bb590e9fb31bb99c32f3b5f8df98c06df05acdfae66e3d42c6c30c2da76740b
MD5 357d0cf3a3c8ac60ff4bacc01d460be0
SHA1 a7b7f15f9b2d0b41fff2221ac3cfd88e15a11865
SHA512 26fedbd7ab978f43d459afcc72f9dfa8b3a4da2ab30388ae70d47b57ab516feb9799dcc61977d7a971e9f7c2966fca8a0207779be38539d5274a405db922f87d
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T161E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhxspkicau.exe

Path C:\Temp\nhxspkicau.exe
Size 243KB
SHA256 13eb25a825e19cd724a85f34db8f508166f262f5e366600eadb44fe57283d0cb
MD5 cf4e8f94788950a8e70c813cb6a4597c
SHA1 c0ef1d82a9d49218ae61e5e3d423834d001371fc
SHA512 3ed75514346276d4e6a60cf65d2987804f6744797524f8034d9301e214aca9158d63237092101632c8cb215d834b67c9d0170a201a76bc79fac88b01e68ff377
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:XvMsLaOa3lLNngoqRttA7b
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifausnkf.sys

Path C:\Temp\qkifausnkf.sys
Size 141KB
SHA256 380074a37ac1ce981a9f3437d180fb639d654bb278cbe2f404bbd25b43471251
MD5 4bfba5ab317c08fb81fe3c987f3f23e8
SHA1 f76d6996cfb0a57f6d1634203e0dc9220ac9fee0
SHA512 bfba7b0427c24fe3d21a17e2fb79a9d8402b5f05266747e03d880022f6c811837b1a8b5c6b326da2ddf8fd12984936c8c7f0f64ab6c8ae18785f82e18e37c401
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhbztrm.exe

Path C:\Temp\wuomhbztrm.exe
Size 243KB
SHA256 ee2d0e101d1e9f01c0c253c98d74ceda83a64b481c456e86b1a9ac4dff634120
MD5 b0bc0c2fe45d43d4b43d54a68660fd63
SHA1 74e926cea9d33ee7d67145470df0ced3ada19731
SHA512 ceea5d94b160c971ddcc665d17f9d1feb8d41e4e5dd96c6a54592a907889b3226f72012164e5144232f2a4b4a42c07b99b23d0be169b378e675fadb6a7bf140a
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:fvMsLaOa3lLNngoqRttA7z
TLSH
T1AE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

162aa127-88c4-4446-a0b7-87f525b3963a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\162aa127-88c4-4446-a0b7-87f525b3963a.tmp
Size 34KB
SHA256 26abb88617eec757f4ee71607f90058462aa802719c5d7916098a12bfaec683f
MD5 9ea8c52becb7b1a3af1710c261f77e9a
SHA1 6020ac05769ff9b965e0481744a83929aef05292
SHA512 7805f41317c4a3dc64bef0f909e50f1dae205a1f5ac391c0214597a1f0bea457079b9208782c4bab5eb06dcf49828eb2378d8c53d9195104d9cfac1101e6e921
SSDEEP 768:Ro3T1GOOCY4O/9OA9at01j0iq00+Iais6JL+:Ro3Tl/CHq00NaHKK
TLSH
T1E0F2A070ECA59E339CE6B644B31A73C79FE41267C5C94F44C5DA2A1D048729E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e788f32-3c29-4825-ade7-43626d5ea06b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2e788f32-3c29-4825-ade7-43626d5ea06b.tmp
Size 38KB
SHA256 628304090ce88d1e0822dd6451ed3760b7df1b7543c4047c543bcff75e4e5380
MD5 cca1b225284d99d589cfa5d023b2d87e
SHA1 d977bee09946b16b38d8efb1761a29e82e24ba01
SHA512 e47df3df6222bfe64db99eed0d95d6f77876b0b5a1ed03080f14e2cc1ff94efc1f89a19621d975140f530061def8cb04bc6d8e4513225ba68c3125c1b2d897c9
SSDEEP 768:s/UxvxjgC+H3eI4OOCY4//9OA9at01j0iq00+IaXsSHxRz:ZZj3+H3eGsCHq00Na8STz
TLSH
T14003CF31ECA59D739CF6B284730AA3C7DFF81563C5C65AA089E9290D04877AD270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36f2934d-0001-4f3b-b61f-2f66a8f85532.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36f2934d-0001-4f3b-b61f-2f66a8f85532.tmp
Size 37KB
SHA256 38ac374eb74be913b0050c35b3689a37ce805499127fd47dfa28e1cd54325e31
MD5 60a9b8834ba4d36787251f74e5639624
SHA1 420c37f61bf5d7185d10cbe026c459f5c6aa0556
SHA512 ef350e2da8d6c7cae802b310eea8b171f039b0b8aa653a67b51f164f51c9d1c51e44e448a19df4b130ca8d4e2d24878f1305a64e29f7edda76192067eab35f5c
SSDEEP 768:X/UxvxjgC+H3LBrOOCh/9OA9at01j0iq00+Ia2bSHxRz:KZj3+H3LuOCHq00NakSTz
TLSH
T13403C031ECA19D779CF7B384730A63879FF44663D6C66A9049ED2A0E01876AD1307C67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67ac4053-4c95-4a97-bd84-096b8201fccb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\67ac4053-4c95-4a97-bd84-096b8201fccb.tmp
Size 40KB
SHA256 55918833c2ff12ff9a40608c8f3199e00b2d709b5de3ac3d3ebcfb2679d1786f
MD5 23ba1268c7ea6816e9940742f1e0a4c6
SHA1 d6187f20e849dd197f4a3b9dcdd89c2e2c6899c2
SHA512 0c25c0c2833f9e0869d5734548076fb51d07fc0f6508c9acf6d66a0cc7280799a9f4a5dfb4b92eb16a45e2ddc94d9222feca1ec47980de8d988e8b351dbf4a07
SSDEEP 768:U/UxvxjgC+E3vqGOOCY4J/9OA9at01j0iq00+Iais6xt:BZj3+E3veaCHq00NaHgt
TLSH
T14B13BF71ECA5AD339CE6F244B30A63C79FF41563D4C99E9489EA2E0D05872AD170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83bb1eea-04eb-4340-911b-1624f4070fbd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\83bb1eea-04eb-4340-911b-1624f4070fbd.tmp
Size 42KB
SHA256 1e24e47ef3cd97be9ebf4139232f8a0c5ae430afa38aad780fad6984530a5696
MD5 88db9ea3f855b42ae786cc891e8aef4d
SHA1 cbd4aba5b703f9d2993c58f7765173c0009429c8
SHA512 9c5d64fe9a3d643d71216e401164d2fd16f1438d84736387307360bf253e8d80c4ea98ee918a712c46eb63df465c31cc24eb2b0f36ebff463d537f985d9ed1ea
SSDEEP 768:IvFdQ39wgN8uIOOCY4m/9OA9at01j0iq00+Iais6JL+:yQ3Z/HCHq00NaHKK
TLSH
T11A1329F198D39A37D8AE5783A33D6E869EBCD153B5888980B7C51D0CCC861BFD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

13832b0c-73e5-4423-81ca-a55a32bcebdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13832b0c-73e5-4423-81ca-a55a32bcebdc.tmp
Size 12KB
SHA256 51ae2d0a94de50db9aeb7a59a763950b3ec676fde81e7db0c261cada9e31951e
MD5 5f491b11f6be42ac6d7abc47162676a9
SHA1 6e45da6da4a90d8f432a708bf7127a2b8c9bb0b4
SHA512 cede55393882d6077bb23970829da4cc099eb3b86f48ee0469578e86e2984992fe2353b2f48595c5f237be322c1f0b49f03141f997b46239212be1c771b6282f
SSDEEP 192:sxRmyRKCv/fAsyw0ZgevzoA8p9d/g6+WNCtS/YouTMGD0IgDyNHJ:sxRmy7v/fAsywKgeGj/5V/U48p
TLSH
T11242C759BA686D3B4CCBE21DFB55BF53D2F8102260951F48AAFC8A1C14E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1daab485-4128-48d8-b256-138e742344e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1daab485-4128-48d8-b256-138e742344e4.tmp
Size 11KB
SHA256 569f70943edb836e2f00c315d37e0a8acd98fcf0673c9d3ee106d21016b6fab5
MD5 f09053c086c610a4ff0d2e9dbd05f50f
SHA1 5110af54fcfcf9f4fec1fc6acfce0ccb95e81da3
SHA512 503de9b18b13f4398dd398a45df0c35c12cf322faa1801764f895601827c785f029f066210d092b5079f32dc91431b4e357f00405b8c4e83312a2b2254cbe531
SSDEEP 192:sxRmlRKCv/fAsDw0ZgevzoA8p9d/g6+WNCtS/Yoe1MGD0IgVNHJ:sxRml7v/fAsDwKgeGj/5V/A4/p
TLSH
T1F842B719BE68A93B4CDBD21DFB55BF53D2F8102260951E48AAFC891C14E66DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20da1e61-0cb9-44c2-89b4-1719de1f0ad0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20da1e61-0cb9-44c2-89b4-1719de1f0ad0.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

88e6d6ed-f25e-44a2-9f55-ff51de1ffedb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88e6d6ed-f25e-44a2-9f55-ff51de1ffedb.tmp
Size 11KB
SHA256 4337bdb5616509598c219c3273afc08b959733900ab9ad9b8f31b2e7a21988b5
MD5 bd4296ed79c9e4e6d1d2dc1da1e1ff99
SHA1 a23df232cb523b5cfe40592c8e5dd65dd4fb7762
SHA512 382a1b94293d2788b088cef4970eae3d3c095238de6b9e6be279640cd76965650b14747bde27b7fcb489885f12d82d881fc9a21a601d2d29b68a3d26a10a652a
SSDEEP 192:sxRmyRKCv/fAs0w0ZgevzoA8p9d/g6+WNCtS/Yoe1MGD0IgDgNHJ:sxRmy7v/fAs0wKgeGj/5V/A4+p
TLSH
T11B42B719BE68AD3B4CDBD21DFB55BF53D2F8102260951F48AAFC891C14E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dc8467e8599afa770bb6197af87aff0c8735a60e508c9b86df2dbb987977593a
MD5 e0a3b32d783e53da041f2eb2d0cf77f4
SHA1 f8a10315b79d1b9c61c01ce30198b732bf16e45e
SHA512 c51e74a0bcd7eb1c97812ba025849724b9b9975a4d4616e2fcb3f497c2effda873e065c77af9c5f029f5308c237487a919546703174cc5fca4a513809f01440a
TLSH
T106E0DFC504D8C33FA208B4870168830CCBA1362FD3C0791E1704CDC5700D848B7E67A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cfc9569988c2a8539b464db840716589248ceacccd19cd8856d9cae49b25499d
MD5 ead86314853119a4aa2e1aad04b3a1cd
SHA1 8c0a0902dccf1e5b2514935dd9563d7b1e092e16
SHA512 af99dc7d562962ddac27ad411f4befcfd0536bec097d6143913680a1acf247354889ec690a353c892e03134e47f16ab952ba55055776526aa9feb420632dc2b6
TLSH
T1B46171846E60424DF76A1CFBD3C14CB7F6366D8B52838D22E494EA78A423F7D7982064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc72755dc462ebf08db0437435c29bae60e38c7dc193ba8061c54d294e141bc4
MD5 d71e2cbb40ee1fee538a6048c888ef4f
SHA1 c126541994698736817fdc7e54baca06f430fbdb
SHA512 afbc71f3a0e8ed976e6710e9cbdcc56702f96a67a18b4332ebdbeab63f1c49dda2bb5e209cac3e1e937f4b778cca7c7cb222d457c20ce1af227ef2565d5d12f0
TLSH
T1806171846E60424DF76A1CFBD3C04CB7F6366D9B95838D23E494EA78A423F7D7982064
MD5 SHA1 SHA512 TLSH

Submit Download

f4b1d931-400c-4385-be90-1b8d6470a74b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f4b1d931-400c-4385-be90-1b8d6470a74b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

0ac80f59-b287-4ec0-ab0b-b2484b3db2ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ac80f59-b287-4ec0-ab0b-b2484b3db2ad.tmp
Size 2KB
SHA256 bfff4b3a6d03645671ef4dbe8ef29d24187e16e0c62a9eae81443a32060ce0bc
MD5 b4b9261bedf243ae862e8c8a6c69c942
SHA1 a91a094f9cdc63ff5193860b4842de5e2ca35e77
SHA512 20f47cbdc43f89646947c7813b765609367ab7ea9cb8341ebd6e9eb610401407b2d18f9dc408cb5bf905062d723600e2a97913e92e0fd51ea70ad4c3a72029da
TLSH
T1F141AEF7C7E8856E890196F0AA18BE2BCE1D0A14432C3D5AC9E4AE6B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

3d71ab9f-b8e7-4ac5-97fa-62b30cf2b3ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3d71ab9f-b8e7-4ac5-97fa-62b30cf2b3ee.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c0a874c6-07aa-4f2d-84c9-ae2617f3beed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c0a874c6-07aa-4f2d-84c9-ae2617f3beed.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82c3146951cc933e4a950c3f935299d08552ccfbc73a0dcfccbbbd662c3b9f21
MD5 6bc1604dd558c05119be1ead45a8bbe9
SHA1 ffb30dd215ba79a9b65c17f6e57b356f6add8c0f
SHA512 e424c62e1b5b6280cc5de5c8544db5fa5cddbf09b50db06e9e25e7fc364f2b023d882567fa8d340c57e7860977e8567161383c15251cda7171daf2840b5904f4
SSDEEP 48:KMb2XbVdtmT9oNIabmKVj9xmRz2oAB73yD5otJLnzUTHKfIaxUKVR9zURJEoKrrQ:KssQKhiiia4KbakniK0YKJ
TLSH
T11C917255313F065178BF750861E6A66F4392326B3228E92B3BAD4063896EE040CFDDDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b18585ea-6397-48a6-a935-8d602ab05bc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b18585ea-6397-48a6-a935-8d602ab05bc9.tmp
Size 29KB
SHA256 cd892b254e2164d66dcc77c12f856b537135a9ed9954dafd98f9a15153a69066
MD5 6744ec504bd0b2500e2f765e873ec531
SHA1 d21ebdc884f1b7cfc1bd29c400d5b567eca6fbbe
SHA512 99d8748182f38f6793b6885c8e6be7e9f152a3e2a9f25219e4919c73e194dbb6b0bda2921dd92dd4fe6962b151bf790cb03d1fd72c18e9f01090f750b385f301
SSDEEP 768:p/wWWG7pLuLjgnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfxXH3Inrox7jo:p/wWWmEjgnWg/Xf1pu1jakxXXI0x7jo
TLSH
T10ED2EA7B740CCA7F4F804ADDDC197E9E6DA802CB9698CD9047FA885C02C67EB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9393b16-4d61-4330-bf87-65e47646be09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9393b16-4d61-4330-bf87-65e47646be09.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

285f8df6-d277-4701-b0d1-6d2c4fd70ced.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\285f8df6-d277-4701-b0d1-6d2c4fd70ced.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20413266-f950-4659-aa02-cf7a27766beb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\20413266-f950-4659-aa02-cf7a27766beb.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

c5105583-d12b-4bc5-9c2e-7d33a1adaf9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c5105583-d12b-4bc5-9c2e-7d33a1adaf9e.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d7bb2ce6-45af-4582-8694-26be69f71f3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d7bb2ce6-45af-4582-8694-26be69f71f3a.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

d7ce5ab0-f7bd-4272-8ecf-debbb8434ce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d7ce5ab0-f7bd-4272-8ecf-debbb8434ce4.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e9fd236c-df8a-44c1-8335-4cd1e8075178.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9fd236c-df8a-44c1-8335-4cd1e8075178.tmp
Size 34KB
SHA256 692d947f684b809f9cda1cc55e6fddea4be09031bb509a565b2d3a4aa8e074ad
MD5 171c5f01dca97fc133f5b81395e3efb3
SHA1 a350802e9c4e9c5518833db5a2ad20230764ac01
SHA512 f7f6768ac70f34f1e1d618fdbe276b10967650e50ce486a299dac9c4909978800fe9a8617f6b289293f737230bc3c35aacfdf332fdd02a1518bf7e1e6aebef61
SSDEEP 768:Zo3W1GOOCY4O/9OA9at01j0iq00+Iais6JL+:Zo3Wl/CHq00NaHKK
TLSH
T1CFF2AF70ECA59E339CE6B644B31A73C79FE41267C5C94F84C9DA291D048729E2B0BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47a8e95b-94bd-44fb-9e52-f4e39beeaa6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47a8e95b-94bd-44fb-9e52-f4e39beeaa6f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

91139d5b-72d8-4e83-93db-409594f833c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91139d5b-72d8-4e83-93db-409594f833c2.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

3aecedb7-1126-45da-b6bf-770e93ee84a0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3aecedb7-1126-45da-b6bf-770e93ee84a0.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d86eacb8-6dea-4fab-a8af-fc18a75051f4.tmp

Path C:\Users\Admin\AppData\Local\Temp\d86eacb8-6dea-4fab-a8af-fc18a75051f4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3348_332702478\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3348_580702836\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_1602586170\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_2096662054\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_253695557\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3348_51673236\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/244-741-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/608-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/608-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/608-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/684-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/684-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/904-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-681-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1664-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1672-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1720-481-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1720-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2100-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2644-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2840-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3076-683-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3076-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-762-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-686-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4908-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5364-581-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-743-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6004-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download