285e44f2d22a99de655ef959b185090dd1b0e2925ad5c999038046e8bab2fd4a

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
Size 243KB
Sample261024-sr5fvsaw7y
SHA256 285e44f2d22a99de655ef959b185090dd1b0e2925ad5c999038046e8bab2fd4a
MD5 4127ff7d3633d6cfdb25870c156320da
SHA1 4be1843c8307789357500faa85978163f8e93b3b
SHA512 4d6f9756d9226005b511fdab2628de9c4ee16cf1654bc9dde8c91950e930c8f2683d0a0a216123e1105b29f3fbe9b324e16297523ac9f1f60fcf6323c0717d8d
SSDEEP 3072:MjF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7ux:MB3frLQsa3lLNngoqRttA7ux
TLSH
T1F3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
436	CP.exe
3852	tgdyvqoigb.exe
5756	CP.exe
4080	CP.exe
992	i_tgdyvqoigb.exe
3940	gdywtnlfdb.sys
792	CP.exe
5920	aysqlfdbvt.exe
2356	CP.exe
4232	CP.exe
5988	i_aysqlfdbvt.exe
1164	nlfdavsnki.sys
6120	CP.exe
3900	lfdxvpnifa.exe
5796	CP.exe
4640	CP.exe
1336	i_lfdxvpnifa.exe
2676	fcxvpnhfdx.sys
4140	CP.exe
3908	axsqkicaus.exe
4672	CP.exe
408	CP.exe
5332	i_axsqkicaus.exe
3240	kfcxusmkic.sys
2880	CP.exe
4872	xupnhfcxrp.exe
5032	CP.exe
2504	CP.exe
5532	i_xupnhfcxrp.exe
4776	kecxupnhfz.sys
256	CP.exe
2536	hfzxrpkhfz.exe
2820	CP.exe
3760	CP.exe
2676	i_hfzxrpkhfz.exe
2712	hbzxuomgec.sys
1348	CP.exe
5152	ebzwrpjhbz.exe
3940	CP.exe
1992	CP.exe
4596	i_ebzwrpjhbz.exe
5848	mjdbwtomge.sys
5364	CP.exe
1672	mgeywrojhb.exe
2768	CP.exe
764	CP.exe
5732	i_mgeywrojhb.exe
1652	ztrljdbwto.sys
6052	CP.exe
4792	rljdbywqol.exe
5408	CP.exe
4588	CP.exe
3736	i_rljdbywqol.exe
5496	vtolgdbvtq.sys
1000	CP.exe
5216	tqligdywto.exe
4680	CP.exe
4844	CP.exe
3516	i_tqligdywto.exe
5908	aysqkidavt.sys
5732	CP.exe
3424	xvqnigaysq.exe
3200	CP.exe
3376	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1560399944\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_567700413\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1177141346\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_567700413\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1621750487\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_8_870512945\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1560399944\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_720734280\offscreendocument_main.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlfdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlfdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkifdaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tgdyvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkifdaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tgdyvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzwrpjhbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5996	ipconfig.exe
4732	ipconfig.exe
1096	ipconfig.exe
5544	ipconfig.exe
5380	ipconfig.exe
1904	ipconfig.exe
2480	ipconfig.exe
4452	ipconfig.exe
5772	ipconfig.exe
3724	ipconfig.exe
1796	ipconfig.exe
252	ipconfig.exe
5268	ipconfig.exe
4352	ipconfig.exe
5508	ipconfig.exe
3604	ipconfig.exe
3536	ipconfig.exe
3724	ipconfig.exe
5476	ipconfig.exe
2216	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{14F460CD-1BA5-4119-8D51-7E4073F31A3D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	i_tgdyvqoigb.exe
Token: SeDebugPrivilege	5988	i_aysqlfdbvt.exe
Token: SeDebugPrivilege	1336	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	5332	i_axsqkicaus.exe
Token: SeDebugPrivilege	5532	i_xupnhfcxrp.exe
Token: SeDebugPrivilege	2676	i_hfzxrpkhfz.exe
Token: SeDebugPrivilege	4596	i_ebzwrpjhbz.exe
Token: SeDebugPrivilege	5732	i_mgeywrojhb.exe
Token: SeDebugPrivilege	3736	i_rljdbywqol.exe
Token: SeDebugPrivilege	3516	i_tqligdywto.exe
Token: SeDebugPrivilege	5772	i_xvqnigaysq.exe
Token: SeDebugPrivilege	5840	i_vsqkifdaus.exe
Token: SeDebugPrivilege	4480	i_kicausnkfv.exe
Token: SeDebugPrivilege	5900	i_hfzxspkhca.exe
Token: SeDebugPrivilege	4228	i_hfzxromhez.exe
Token: SeDebugPrivilege	1544	i_jhezwrpjhb.exe
Token: SeDebugPrivilege	6028	i_rljebwtomg.exe
Token: SeDebugPrivilege	4748	i_gdbvtolgay.exe
Token: SeDebugPrivilege	2848	i_dyvtnligay.exe
Token: SeDebugPrivilege	2452	i_caysqkidav.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 1820	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	90
PID 1820 wrote to memory of 8	1820	iexplore.exe	91
PID 8 wrote to memory of 2296	8	msedge.exe	92
PID 8 wrote to memory of 3172	8	msedge.exe	93
PID 8 wrote to memory of 3068	8	msedge.exe	95
PID 8 wrote to memory of 3172	8	msedge.exe	93
PID 8 wrote to memory of 3172	8	msedge.exe	93
PID 8 wrote to memory of 2272	8	msedge.exe	96
PID 8 wrote to memory of 2272	8	msedge.exe	96
PID 8 wrote to memory of 4636	8	msedge.exe	98
PID 8 wrote to memory of 4828	8	msedge.exe	97
PID 8 wrote to memory of 4636	8	msedge.exe	98
PID 8 wrote to memory of 4636	8	msedge.exe	98
PID 8 wrote to memory of 4828	8	msedge.exe	97
PID 8 wrote to memory of 4828	8	msedge.exe	97
PID 8 wrote to memory of 2776	8	msedge.exe	99
PID 8 wrote to memory of 2232	8	msedge.exe	100
PID 8 wrote to memory of 2776	8	msedge.exe	99
PID 8 wrote to memory of 2776	8	msedge.exe	99
PID 8 wrote to memory of 2232	8	msedge.exe	100
PID 8 wrote to memory of 2232	8	msedge.exe	100
PID 8 wrote to memory of 5432	8	msedge.exe	101
PID 8 wrote to memory of 5432	8	msedge.exe	101
PID 3324 wrote to memory of 436	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	103
PID 3852 wrote to memory of 5756	3852	tgdyvqoigb.exe	106
PID 8 wrote to memory of 4852	8	msedge.exe	109
PID 8 wrote to memory of 6028	8	msedge.exe	110
PID 8 wrote to memory of 4852	8	msedge.exe	109
PID 8 wrote to memory of 6028	8	msedge.exe	110
PID 8 wrote to memory of 1052	8	msedge.exe	112
PID 8 wrote to memory of 3536	8	msedge.exe	114
PID 8 wrote to memory of 1080	8	msedge.exe	113
PID 8 wrote to memory of 1080	8	msedge.exe	113
PID 8 wrote to memory of 3536	8	msedge.exe	114
PID 8 wrote to memory of 3576	8	msedge.exe	117
PID 8 wrote to memory of 3576	8	msedge.exe	117
PID 8 wrote to memory of 6052	8	msedge.exe	118
PID 8 wrote to memory of 6052	8	msedge.exe	118
PID 3324 wrote to memory of 4080	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	119
PID 3324 wrote to memory of 792	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	123
PID 5920 wrote to memory of 2356	5920	aysqlfdbvt.exe	125
PID 3324 wrote to memory of 4232	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	128
PID 3324 wrote to memory of 6120	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	132
PID 3900 wrote to memory of 5796	3900	lfdxvpnifa.exe	134
PID 3324 wrote to memory of 4640	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	137
PID 3324 wrote to memory of 4140	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	141
PID 3908 wrote to memory of 4672	3908	axsqkicaus.exe	143
PID 3324 wrote to memory of 408	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	146
PID 8 wrote to memory of 5380	8	msedge.exe	149
PID 8 wrote to memory of 2060	8	msedge.exe	150
PID 8 wrote to memory of 2768	8	msedge.exe	151
PID 3324 wrote to memory of 2880	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	154
PID 4872 wrote to memory of 5032	4872	xupnhfcxrp.exe	156
PID 3324 wrote to memory of 2504	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	159
PID 3324 wrote to memory of 256	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	163
PID 2536 wrote to memory of 2820	2536	hfzxrpkhfz.exe	165
PID 3324 wrote to memory of 3760	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	168
PID 3324 wrote to memory of 1348	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	172
PID 5152 wrote to memory of 3940	5152	ebzwrpjhbz.exe	174
PID 3324 wrote to memory of 1992	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	177
PID 3324 wrote to memory of 5364	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	181
PID 1672 wrote to memory of 2768	1672	mgeywrojhb.exe	183
PID 3324 wrote to memory of 764	3324	2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe	186
PID 8 wrote to memory of 804	8	msedge.exe	189

C:\Users\Admin\AppData\Local\Temp\2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_4127ff7d3633d6cfdb25870c156320da_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x334,0x7fff64cfc188,0x7fff64cfc194,0x7fff64cfc1a0
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4823475927310845753,495452657593943455,262144 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,6558772947884328981,11573364744118440184,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
      4⤵
      System Time Discovery
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,7133129005011062496,5874120642418622039,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:13
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9675345299129399657,6816191992868169487,2097152 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3917733221232798946,4275306988851205186,2097152 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8237770315124454535,4682390035505973303,2097152 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,513113578977068773,4291641605877789348,2097152 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,14015394504387468731,17453035947326337741,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,2206894531574701015,1113868915349512806,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,2203814676454858443,12445376222359375296,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6659266242974138386,7228530364329740885,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,6659266242974138386,7228530364329740885,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3700691051484171113,7594947709283428814,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7754477555901540757,16585398722264307288,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9057231362317522611,16043033978961450769,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10933143258612028267,12461526956173542425,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,10790364556732615050,11694518051261613331,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,4763912155278658358,8410788290284949895,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,13854099736337688144,15034785207689617437,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,344884648188113187,6804818233354028522,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,3614055037873851838,6512859676377988380,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,3578741378300998782,15023234742544769640,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,15857559423502002134,9878907240427537643,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4724,i,12576164715648290291,5606068165589685408,262144 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,10741971776022790816,11958643970775568265,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14726936906743233615,17272947023440019124,524288 --field-trial-handle=2604,i,3443467723896069093,3058036593506007508,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:3236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tgdyvqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:436
- - C:\Temp\tgdyvqoigb.exe
    C:\Temp\tgdyvqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tgdyvqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\i_tgdyvqoigb.exe
    C:\Temp\i_tgdyvqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlfdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:792
- - C:\Temp\aysqlfdbvt.exe
    C:\Temp\aysqlfdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlfdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4232
- - C:\Temp\i_aysqlfdbvt.exe
    C:\Temp\i_aysqlfdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\lfdxvpnifa.exe
    C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\i_lfdxvpnifa.exe
    C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:408
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfcxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Temp\xupnhfcxrp.exe
    C:\Temp\xupnhfcxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfcxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2504
- - C:\Temp\i_xupnhfcxrp.exe
    C:\Temp\i_xupnhfcxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:256
- - C:\Temp\hfzxrpkhfz.exe
    C:\Temp\hfzxrpkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3760
- - C:\Temp\i_hfzxrpkhfz.exe
    C:\Temp\i_hfzxrpkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebzwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1348
- - C:\Temp\ebzwrpjhbz.exe
    C:\Temp\ebzwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebzwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\i_ebzwrpjhbz.exe
    C:\Temp\i_ebzwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Temp\mgeywrojhb.exe
    C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:764
- - C:\Temp\i_mgeywrojhb.exe
    C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbywqol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\rljdbywqol.exe
    C:\Temp\rljdbywqol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbywqol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_rljdbywqol.exe
    C:\Temp\i_rljdbywqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqligdywto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1000
- - C:\Temp\tqligdywto.exe
    C:\Temp\tqligdywto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqligdywto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4844
- - C:\Temp\i_tqligdywto.exe
    C:\Temp\i_tqligdywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5732
- - C:\Temp\xvqnigaysq.exe
    C:\Temp\xvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\i_xvqnigaysq.exe
    C:\Temp\i_xvqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkifdaus.exe ups_run
  2⤵
  PID:4800
- - C:\Temp\vsqkifdaus.exe
    C:\Temp\vsqkifdaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkifdaus.exe ups_ins
  2⤵
  PID:4072
- - C:\Temp\i_vsqkifdaus.exe
    C:\Temp\i_vsqkifdaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfv.exe ups_run
  2⤵
  PID:4940
- - C:\Temp\kicausnkfv.exe
    C:\Temp\kicausnkfv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfv.exe ups_ins
  2⤵
  PID:2228
- - C:\Temp\i_kicausnkfv.exe
    C:\Temp\i_kicausnkfv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  PID:5644
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  PID:1336
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxromhez.exe ups_run
  2⤵
  PID:5088
- - C:\Temp\hfzxromhez.exe
    C:\Temp\hfzxromhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxromhez.exe ups_ins
  2⤵
  PID:1656
- - C:\Temp\i_hfzxromhez.exe
    C:\Temp\i_hfzxromhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwrpjhb.exe ups_run
  2⤵
  PID:4752
- - C:\Temp\jhezwrpjhb.exe
    C:\Temp\jhezwrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwrpjhb.exe ups_ins
  2⤵
  PID:1540
- - C:\Temp\i_jhezwrpjhb.exe
    C:\Temp\i_jhezwrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtomg.exe ups_run
  2⤵
  PID:4160
- - C:\Temp\rljebwtomg.exe
    C:\Temp\rljebwtomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtomg.exe ups_ins
  2⤵
  PID:5748
- - C:\Temp\i_rljebwtomg.exe
    C:\Temp\i_rljebwtomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbvtolgay.exe ups_run
  2⤵
  PID:2112
- - C:\Temp\gdbvtolgay.exe
    C:\Temp\gdbvtolgay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbvtolgay.exe ups_ins
  2⤵
  PID:3396
- - C:\Temp\i_gdbvtolgay.exe
    C:\Temp\i_gdbvtolgay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvtnligay.exe ups_run
  2⤵
  PID:2284
- - C:\Temp\dyvtnligay.exe
    C:\Temp\dyvtnligay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvtnligay.exe ups_ins
  2⤵
  PID:4996
- - C:\Temp\i_dyvtnligay.exe
    C:\Temp\i_dyvtnligay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caysqkidav.exe ups_run
  2⤵
  PID:4708
- - C:\Temp\caysqkidav.exe
    C:\Temp\caysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caysqkidav.exe ups_ins
  2⤵
  PID:5352
- - C:\Temp\i_caysqkidav.exe
    C:\Temp\i_caysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:284

C:\Temp\gdywtnlfdb.sys
C:\Temp\gdywtnlfdb.sys
1⤵
- Executes dropped EXE
PID:3940

C:\Temp\nlfdavsnki.sys
C:\Temp\nlfdavsnki.sys
1⤵
- Executes dropped EXE
PID:1164

C:\Temp\fcxvpnhfdx.sys
C:\Temp\fcxvpnhfdx.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\kfcxusmkic.sys
C:\Temp\kfcxusmkic.sys
1⤵
- Executes dropped EXE
PID:3240

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:4776

C:\Temp\hbzxuomgec.sys
C:\Temp\hbzxuomgec.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\mjdbwtomge.sys
C:\Temp\mjdbwtomge.sys
1⤵
- Executes dropped EXE
PID:5848

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:1652

C:\Temp\vtolgdbvtq.sys
C:\Temp\vtolgdbvtq.sys
1⤵
- Executes dropped EXE
PID:5496

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
- Executes dropped EXE
PID:5908

C:\Temp\igaysqdavs.sys
C:\Temp\igaysqdavs.sys
1⤵
PID:2336

C:\Temp\nkicausnkf.sys
C:\Temp\nkicausnkf.sys
1⤵
PID:3888

C:\Temp\khcausmkfc.sys
C:\Temp\khcausmkfc.sys
1⤵
PID:5904

C:\Temp\hecwurpjhc.sys
C:\Temp\hecwurpjhc.sys
1⤵
PID:2824

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:5556

C:\Temp\uomgebwtro.sys
C:\Temp\uomgebwtro.sys
1⤵
PID:3728

C:\Temp\ljgeywqojg.sys
C:\Temp\ljgeywqojg.sys
1⤵
PID:4876

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
PID:2608

C:\Temp\nlfdaysqli.sys
C:\Temp\nlfdaysqli.sys
1⤵
PID:5680

C:\Temp\pnlfdxvqni.sys
C:\Temp\pnlfdxvqni.sys
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicaus.exe

Path C:\Temp\axsqkicaus.exe
Size 243KB
SHA256 115851151cf6a56b357059f00fa411b288f2d269991a3c1ec2b4d9870f72a94e
MD5 ff7e16ce799a787bbc4a394f37d9aacb
SHA1 37df4be91bd33efef1d3eae55940a2d4bbb1306c
SHA512 c9edb9764f450219b289a972959a9b804a3f0a185f9cfd16ac685f146dfd288d673892a9e42c53dfc6035b582bdf9c18cc892b28f12161f3c34fdeefce8aa37c
SSDEEP 3072:DF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:h3frLQsa3lLNngoqRttA7z
TLSH
T1F3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlfdbvt.exe

Path C:\Temp\aysqlfdbvt.exe
Size 243KB
SHA256 b37e6ce1ead772aae6b9927b22be0b4e618dc5798aa93335a584aa2820cc0f15
MD5 ec178ea8372da32aad9185a3f56bbbbf
SHA1 45ec98ff505f8d93840ad0d367719118b468d202
SHA512 46ee89f5b65fca79dd0eeeb108e548a9e5e627d750f951cc598325bd385b99745e6315da2f30c0ee485de23f1b42d97868ba7791fa3fd3b6a432bb5f4430188a
SSDEEP 3072:fF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:93frLQsa3lLNngoqRttA77
TLSH
T17F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfdx.sys

Path C:\Temp\fcxvpnhfdx.sys
Size 141KB
SHA256 135f73a1a30cfd90a87068fc281e4a9ec76f102835abea9e147657a0719406b8
MD5 bb47c5bac4a9b893aa4213e3f27e7899
SHA1 bb75460f95917b71cc620ff1ff16904572a29681
SHA512 bbb7b8e8154946808b7d9eca42ed81368bdb22ea0a0756a11e811d776e189c5cc95ccdf4d9256e68961dcc976e08a7479dff1531a197eccd31aec908f20da168
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywtnlfdb.sys

Path C:\Temp\gdywtnlfdb.sys
Size 141KB
SHA256 105be47c9b06fc43767358dd02a310e4b522d2e35458a4b53f9dfdc43511254e
MD5 92656f61de717789cc310f46c20a96be
SHA1 a7c43131b8d541c9f8f8e297753a7917b5554b13
SHA512 e0ac3767f88c3398756da40ddd015dce21d4b0289c31ccc489bce048259420c5d16653975ef0de83b175c8e9e454d05fc96005adf45ebf32989cef31b9994863
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltF:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhfz.exe

Path C:\Temp\hfzxrpkhfz.exe
Size 243KB
SHA256 2513023af6fe21bf0deef7a3d2cbf5911835fa5820065782fa5993101d378f7d
MD5 9a31d3f4fb026a6f9aefaf7955b1eb61
SHA1 73c4444eda0af065de9037674c10871da3f64d81
SHA512 4403d61d883ee2b24ad28ab3ecbcf9f69c113bb61266551e8215f980e99deba1b86635a07008e88b349bd8fc33c59a8a54b44c60b3e6b5fa9f130991434c2889
SSDEEP 3072:aF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:K3frLQsa3lLNngoqRttA7q
TLSH
T15A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axsqkicaus.exe

Path C:\Temp\i_axsqkicaus.exe
Size 243KB
SHA256 e841ab653bb861d83b90aa5ec6a94b8822a61a7152cf0ad231e18b1d12378906
MD5 026d6e759c36b486e8daa6477e91974b
SHA1 2d411b312ec20cbfb8e98de544c8c41642919f8c
SHA512 d01b416934307682264880e7a1f59c788ac4d4b42ca5e706bae80ca5039d62678e788afda321112fa08591ab71faca7fb31961104a926acd18aeb7d0b839b6e2
SSDEEP 3072:4F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:03frLQsa3lLNngoqRttA7Q
TLSH
T194345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqlfdbvt.exe

Path C:\Temp\i_aysqlfdbvt.exe
Size 243KB
SHA256 8b4f7ddfc6bdd1bfe6390aa7f73a41c937d9006866274349a9fcf9ee079ef2a3
MD5 7c3234070420c9e2212ef7ea35fbc97d
SHA1 7d5eea18af77dfa2ce795c23c8e6b8d7ed6df63c
SHA512 85db2dafc7400ee97b88684a5c697f864165b4621df8a2292be115075690f384dab5a177204414fe6e2182628de6ac885c1c6d0b7f74786566427e2866de338e
SSDEEP 3072:jF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:B3frLQsa3lLNngoqRttA7z
TLSH
T174345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifa.exe

Path C:\Temp\i_lfdxvpnifa.exe
Size 243KB
SHA256 e9d933683edc75639f43b48ef5eab9e8cb5fd80230356296c7295535f7600e85
MD5 ba9db4efdf2e3c9fb08a8551119be709
SHA1 a67a26caba57bd636b721ee9be93a093605885d2
SHA512 baa7bc77b47f37929ca4ad004dab9a2861fc2fb02fe02c20abe602648616ace292a839dbce56e6bf455df4933a18e889474a10033b26fa51a2dc75b6d66ab4b4
SSDEEP 3072:PF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:N3frLQsa3lLNngoqRttA7H
TLSH
T10D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tgdyvqoigb.exe

Path C:\Temp\i_tgdyvqoigb.exe
Size 243KB
SHA256 e035c6039512600052742894fef469f55f46cb8d70425726eeea0576978e16ec
MD5 29be806e50ac8bac9df604db9b161832
SHA1 4523b6848feefd2ef0b147528a736863c524ffe5
SHA512 5b3d8308c0f467932151b4fd9bead42f8e30cb34705bd975e9cdfa337b15a1337abee074a58d63a21420bc2fdbda2efd1f8d8aebcdab7cea1f3d7ae019ce4979
SSDEEP 3072:5F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:73frLQsa3lLNngoqRttA7h
TLSH
T1BE345A0172818032E7150B78045AE7A1867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupnhfcxrp.exe

Path C:\Temp\i_xupnhfcxrp.exe
Size 243KB
SHA256 5824884ef4cc23dcbfd170162a6a1691d927531ceb402e3fe88ae72a316e4aea
MD5 11f1ffe2a5eecaf5f6180154a6edcb29
SHA1 fcb0e221e79875d0d3479ef012d96322a556d2c0
SHA512 7101c20bc465ed6548d4fe9e48c59eff8179d547ca2e65ec83f1155de2e4759e41fc7bd2cb09a208a319f8ceef9739e5e8cd62543d5817fa288e34d3c681c94b
SSDEEP 3072:HF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:l3frLQsa3lLNngoqRttA7j
TLSH
T1B8345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnhfz.sys

Path C:\Temp\kecxupnhfz.sys
Size 141KB
SHA256 e10a781220a0209cab0c6d08f3c7deced38244f8b3e60b7d7dfcd4b7cc714fb0
MD5 39b21726172a98a0c03f8dd2046c2025
SHA1 65b994f23aadfb9951a634660a5fbcb0e94313b3
SHA512 7f0c1f2d37bb8e76218f99cb3a224d5b69a5bfa6f560d69928d6481d1dcc7c751c184bc3432c37e00dfa8965913c495b460c34b358a4f64d5a3bd95e862cbafd
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxusmkic.sys

Path C:\Temp\kfcxusmkic.sys
Size 141KB
SHA256 f019f38f53ea1f4ca43db212f05e431b5510793cd16343ef7523dc483f95ec03
MD5 3f3c1b847409ce111d6aa38f9e99d237
SHA1 77ec5cd22b71aa50c93bfb830bc2fe264c3b69d5
SHA512 c66d1d6746fb292e046821de48271fce6eff8c32550a2453692987072a07b971c3916050b887c60dd83d20936d5a18f640d6b875a62b014d37593e64c3a5db7a
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifa.exe

Path C:\Temp\lfdxvpnifa.exe
Size 243KB
SHA256 052403c9cf1faf0b44d432d918c0013ed77adeedd301f350b485acedbdf94406
MD5 279a936e879379759a60d039855e56cf
SHA1 1617068e3f83fcbb981dbfdfbcf6f700abd641c7
SHA512 338ee4f639b7d0677a11b00c2f83e76caebbac732a2ecbe28cc0a54d9ee02b9eb004f6b4cbde5a36d9f247af0ac5169d22d7156f1766ecb191f27f401fce1692
SSDEEP 3072:OF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:O3frLQsa3lLNngoqRttA76
TLSH
T16E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavsnki.sys

Path C:\Temp\nlfdavsnki.sys
Size 141KB
SHA256 801af898289aedd7327164ba2ed9e0c1e70e95a06d8e29cdad7bf76ae9d9d18a
MD5 3308b7879e93a2c83af2ecf63d5ff0ee
SHA1 dc8f4631a703b72a75c10c0ef441adc73ecaf790
SHA512 a27056fdac21ce34e24aac380e13a57bf2b718e7521202d1451c167cd9226bf79fc9977338c413cf309d01015fb93ba42ef4d670440aed5deea76f5f6307e17b
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tgdyvqoigb.exe

Path C:\Temp\tgdyvqoigb.exe
Size 243KB
SHA256 b79331f6d66e7b8c37f5071810de849a6fd143f4ebd5d5bba92e8420aae61d7f
MD5 1e608d3431d64376224256d11d6c0fea
SHA1 40e85664538531d05394650f2c3a440acc94330d
SHA512 bfe167b78b2759625be0d0a46a9a1c9d793c8205c4191ba9b38fb2d427154c7384c976313cd22b642377affb74bc15193ccabc59ef3a862ce44e2c5fd8ece429
SSDEEP 3072:CF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:S3frLQsa3lLNngoqRttA7m
TLSH
T14A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfcxrp.exe

Path C:\Temp\xupnhfcxrp.exe
Size 243KB
SHA256 f6888b253287d5f0f39be320a35de85f287c7e9f2b0ac6d26cb027f8d3cb615b
MD5 149a496de4c6696e04b6f97305535155
SHA1 1e9f92265b8cc42bab750404ac4856cb0391775b
SHA512 997b880ff910e606ce58a01b8706c0fd8f54ea8d03a5464996d739535f6f623afaba42be185cbe05a1e9fff6263f47fd87b3df75722b26c440d4172d4ad475fc
SSDEEP 3072:kF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:w3frLQsa3lLNngoqRttA7o
TLSH
T118345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fdce8ed-dcfa-42ed-bcb1-f4490ee0faf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fdce8ed-dcfa-42ed-bcb1-f4490ee0faf4.tmp
Size 37KB
SHA256 b8c90b6d8a9adc26ae55912bd452d3db62943cb3e8871f268f5a27ae73b6de03
MD5 f09af936c91123348f90d0bb3eeab408
SHA1 8ff1c4516b49dd61a2bd84f03b66a8a4a5cde665
SHA512 f8363ec70feb320053cdd6cf62b555d7bee91350b6b6ff2266bc160ce6b62c96bbde27fd1b737bdd2358e7bf59c63b65ad67742014c8f1515620db2e839353a0
SSDEEP 768:h/UxvxjgC+i3CU9TOfHf/VKJYe1ELsAvC8/YMezSHrkw:0Zj3+i3qfHfyYe1EQujY3S4w
TLSH
T1EB03CF31ECA48D775EF2A788774A5717FEF4812394C46BA486DD2B0D06C72AC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f63edf8-134b-40a6-9fbf-af2e945dd9fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f63edf8-134b-40a6-9fbf-af2e945dd9fd.tmp
Size 40KB
SHA256 db7eb3d3be24638e7a3cffb2672d28dc2858eecfaef9ee532dc2c2be95f2a7d0
MD5 321171a6927eb7f4701e0d813f0881be
SHA1 44e39518a9a9b99c6a91940d3d4d148b5afabc50
SHA512 9717266e5600661ac88357add9a220be364aaf06383448fd88d78f6a4f780ad9843af5e0b8ffd243dae771f560e7ecd59128b7f0e45c39f0ddb4ece7e329d9c2
SSDEEP 768:j/UxvxjgC+A38l9TOfHf/if4yJYe1ELsAvC8/YEt6Xp:2Zj3+A3hfHfafxYe1EQujY8ep
TLSH
T10403BE31DCB89D335EF2A694B74A5B53EEF8412384C45A9896D92B0C09C33ED274F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

908c05bc-8d4e-45a4-afc8-2b6ba4686402.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\908c05bc-8d4e-45a4-afc8-2b6ba4686402.tmp
Size 33KB
SHA256 d9a1e32995192ea84b542f3905683246fd93295ce5de6ea4e10f857ac63b3234
MD5 e5bedeb1ab87678cf2e893e6e44fbe3e
SHA1 a07a205aa63c79a85e96d8337a3fdb242e25c1d2
SHA512 435a0d9cc4407177ccca10b5704ce38c75dc7ecb6eff85c6eae93f880d1f0f763887e857a8218887ecefe9f8b99584e7af7e7be8391bac71dbbfb447218e9b0e
SSDEEP 768:VU3El9TOfHf/ifkyJYe1ELsAvC8/YEt6+Ld:VU3ZfHfaf1Ye1EQujY8ZB
TLSH
T119F29D71DCB59D374EF2A694B74A2B53EEB48213C4C84A58D6CA2B0C05C72ED274F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

00ba0235-b5f2-4c2b-a40a-10886a914c30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00ba0235-b5f2-4c2b-a40a-10886a914c30.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

312cb479-10b5-4ee7-b64d-7088c4114059.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\312cb479-10b5-4ee7-b64d-7088c4114059.tmp
Size 11KB
SHA256 30a63f774d5276b26b55269223edc6158bae3c86d902827c17dbb46491db1c02
MD5 dab605a1caf0cfba1678c5202e8ca102
SHA1 52cd9a71c3f26e5331d1562baae3f0ae9c9ec5e9
SHA512 7ed6d849b89c6b5c7fefc8e632310d7f5e3258ea61727d433f641f472de3a41877f5586aab0c9f98a913ec22d710d4dcce4c31b44f40e2576b32b0bd57c1be12
SSDEEP 192:sxR0R2Cc/feaksQeZAzoA8p9nw/g6+WNCnJTq/YxTF6qUUG9IgV4HJ:sxR0fc/f5ksQY5Zw/52Zq/khUxWp
TLSH
T1D042A915AE38A93B4CC7D21DFB557F53D6F92032A1911F48AAFC9A1C14E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f7c025c-8ed3-4161-bf2e-cf9e28912de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f7c025c-8ed3-4161-bf2e-cf9e28912de7.tmp
Size 12KB
SHA256 bd9b5a61030f10b93c56073d7202065b31e339a2f8d828ff2481ca9a738f894b
MD5 4d8490bcf08e66d66efaf264f51b657a
SHA1 57dd467e9389babf5229bf69426a29b380b42e94
SHA512 984880ef8e54da330114b6dd9a05fda8797b5a96ff1760dbdf9af32c6bd9aad812441847005798ece54e47f8d5e03fb60bd6256587e2efecc1a2790052a5c6f6
SSDEEP 192:sxRXR2Cc/feaksdeZAzoA8p9nw/g6+WNCnJTq/YxTroqUUG9IgD84HJ:sxRXfc/f5ksdY5Zw/52Zq/kZUx3p
TLSH
T13A42B915AE38A93B4CD7D21DFB557F53E2F9203291911F48AAFC9A1C10E76DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ddda1518354a833b9cb2796b1fada86b523202e831ddeca23a02bf9a89780f24
MD5 f42c8f90fb86b20d1b8ca1e0d9c1bfd6
SHA1 48881437d7ccf35dfafdde10923d6a8e89fd2ed1
SHA512 b69495c33f7cec690878524b10041ce9901b767ff8e501ff9c07ac42bbe3a5175466a42ed88ac0ce5b816f99f25e577da06f2c6b7e4ca87c92f0f2a5fc41830b
TLSH
T12961714D1B81B195DBAC00F188C05CD7FE747AB9A0AB0E1103B9C47B798A32D63A13F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c045936d8c48d677aed908ede097dddd1a55300e6a600b23165db5709b581d5e
MD5 fc1599e2751fe5b0eebd18a610917c3d
SHA1 3d7a28b38f399cc45abde87142b8a1ceee1fb2e5
SHA512 578dc1e296384d73127788fa8c758e820682e93e8324757f32856ce93b0484eeabd3e0af1f30a0f949556f674f7c0d47558557d310f4bfe6b1d52ce83ff3214f
TLSH
T18661824C1B81B195DBAC01F188C05CD7FE743AB9A4AB1E1103B5C47B798A32D63A13F8
MD5 SHA1 SHA512 TLSH

Submit Download

ee118243-c0fd-4bfd-9577-31783ae486de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ee118243-c0fd-4bfd-9577-31783ae486de.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

6834146e-cc76-4971-aaef-16d8f0225539.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6834146e-cc76-4971-aaef-16d8f0225539.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ca56d10d-fe9b-44e3-a26b-c239c4e16a85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca56d10d-fe9b-44e3-a26b-c239c4e16a85.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f9f3c854-691d-4752-b2d2-47e8a8dba2ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9f3c854-691d-4752-b2d2-47e8a8dba2ef.tmp
Size 1KB
SHA256 c7014be145a18cf0cb89dcc5123cb2765e0f426c7a8625e5b4350baff005f789
MD5 bc84979025c3ff297a0a9a3d6e95010c
SHA1 af8dd5f21f5941ccbec5b932cde70769bc0b5f85
SHA512 b63738e35e8e14a6e54683d507a3146f1bf80b0ad24c38163d4f7101f90e5851358130265e785a20f1a8019737802f9b66ecdd213a92d184cd5934fb4eb6f26e
TLSH
T1EB41AEF7C7F4893D8A0195F4AB186E1BCE2C0915832C7D5AC4E4AE2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

a8787a66-b5f5-4507-a847-224710b8b8a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8787a66-b5f5-4507-a847-224710b8b8a0.tmp
Size 11KB
SHA256 4d22f7e0058f8b7604919cef70f25f439549b0ae3b2580104f432a88fb3710d4
MD5 89cc3331da8f736839a7f5500b5f89ed
SHA1 d7f195902d02acc6bec355bcc86ab0a1d3d700a2
SHA512 fa1796f4b871c202a5f7ba3d3a3594fd940dd2dcc5176703895d2e40d178cd5def209152d48831da0d261cfe96703153c9fd04913650b31cd2809d5af6b62614
SSDEEP 192:sxRXR2Cc/feaksleZAzoA8p9nw/g6+WNCnJTq/YxTF6qUUG9IgDG4HJ:sxRXfc/f5kslY5Zw/52Zq/khUxxp
TLSH
T14D42B815AE38A93B4CC7D21DFB557F53D6F92032A1911F48AAFC9A1C14E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5eed03d-2730-4bac-858f-f93ccd61f50a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5eed03d-2730-4bac-858f-f93ccd61f50a.tmp
Size 29KB
SHA256 e50e2ddaf8d5b46a9dc72191a6e369a118f574de5067b49717a9410f49ce2566
MD5 b70fc24edd95ffe517bc3239ada467d6
SHA1 9290e3be3950963d2a6fe87692b17a4c31a3f430
SHA512 7789cf94131ddd04d9a33adb7dac5f0abba9ec26245587a3b3ab97efaf77811bb4c2b6e92591b8141f9e6f6a525b1a799973386526e91ccdd5e437fea9b8a84a
SSDEEP 768:zBDnQh7pLuLjiFWgbjfkW8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6mZBK3FrokT0:zBDnQXEjiFWgbjfkWu1ja9mZ03+20
TLSH
T101D2D87B744CCA7F4F804A9DDC197E9E6DA802CB9698CD4047FE945C02C6BEE511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

f395b765-c82f-44b3-a38e-252f1f6dfae9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f395b765-c82f-44b3-a38e-252f1f6dfae9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06641214-fb28-4a83-b202-832a4231782a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\06641214-fb28-4a83-b202-832a4231782a.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

63d844b3-9ae9-4e4e-b695-5c08dcf5c8a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\63d844b3-9ae9-4e4e-b695-5c08dcf5c8a3.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e2ab1afd-76d5-4f23-b35b-622991243945.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e2ab1afd-76d5-4f23-b35b-622991243945.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e733f9f5-9cb5-4612-8cf0-cbc3cd819d13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e733f9f5-9cb5-4612-8cf0-cbc3cd819d13.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

da3968a7-242f-40ef-a21d-55e90bc9aa93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da3968a7-242f-40ef-a21d-55e90bc9aa93.tmp
Size 33KB
SHA256 b128fccb538fc8165b749e0eec4a3e10f2dd296b3bea26bad230280b4c92264b
MD5 14a4831246f1f0f3c8a6c8f4a7cf4624
SHA1 4c7a714f3d97ab16cd68b52441a76c2074912ade
SHA512 957ea82126176312bbc5b3ab6758098d0690bac37e594d42a202dbb4f596db019f33a341e6bb974e6bd48122fd946fb0fff696538dcead0db475452b3a3b449e
SSDEEP 768:AU3vl9TOfHf/ifkyJYe1ELsAvC8/YEt6+Ld:AU3ifHfaf1Ye1EQujY8ZB
TLSH
T143F28D71DCB59D374EF1A694B64A2B53AEB48223C4C84B58D6CA2B0C05C72ED274F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd168034-4f19-4e74-bd9f-be72a1b3c375.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dd168034-4f19-4e74-bd9f-be72a1b3c375.tmp
Size 38KB
SHA256 f23d3c8cf8c12d75c8481140392308a8ef539f9d1c6416d73780b3d62e1b0dae
MD5 ef66c6486b0e5ff611056bd82999e002
SHA1 5e956ac31fc42d5454b204813a1efde6b960d2a5
SHA512 11691ec6c620e31d1f5127cbd7572b54c31edd907a5f05cf1a2171dce0d99e6832db1f48fdb68b4ee2e22995f9a58d215302c6f09fef0e6ad5ef07e13472b994
SSDEEP 768:W/UxvxjgC+i3fH9TOfHf/ifAyJYe1ELsAvC8/YNtSHrkw:LZj3+i3QfHfafpYe1EQujY7S4w
TLSH
T1D203BE31DC79CC371EF2A698778A4B57EEF8412394C55AA896D92B0C05C73AD230F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59c54d6f-55a1-4561-a06d-8b9ac06a5ffb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59c54d6f-55a1-4561-a06d-8b9ac06a5ffb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8497d159-9545-45fc-831c-edf95e0390f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8497d159-9545-45fc-831c-edf95e0390f6.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

fe1376f9-fef5-49ca-84e9-ccf24eb7629b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fe1376f9-fef5-49ca-84e9-ccf24eb7629b.tmp
Size 42KB
SHA256 6f6174de8010ed5c322ba6905b3be8ead748ac4df720b90cf205b12f0c757520
MD5 8cd0558712adb4a24876279dc3cf6b19
SHA1 7be23214c149cdaf5495d2cebacfdafb87af30ee
SHA512 79fafa75415c97f78e3a122f90d272601d11484e7818d1efaf8409422cd81ca9bc93772cab6783ce3dc31f36f63899c0ba6e4c74e1c92700c2f5bbb3018f4330
SSDEEP 768:wKFdG3hwg3dUOfHf/if7GJYe1ELsAvC8/YEt6+Ld:wqG3hfHfaf4Ye1EQujY8ZB
TLSH
T1B71317F198E78937D9AE9783A77D2E429DBCC113B4884994F7851D4CCC822BFD24A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f8bcd87-7c17-4b14-972d-6e74137afb04.tmp

Path C:\Users\Admin\AppData\Local\Temp\3f8bcd87-7c17-4b14-972d-6e74137afb04.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4f34e11-09d6-4c78-a974-e6347d0ab482.tmp

Path C:\Users\Admin\AppData\Local\Temp\f4f34e11-09d6-4c78-a974-e6347d0ab482.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8_1165687948\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir8_1199634030\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1177141346\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1441847143\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1560399944\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_1621750487\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8_567700413\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1164-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1164-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1652-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1652-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-628-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-747-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-741-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2676-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2824-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2824-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3240-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3728-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3888-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3940-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4776-528-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-764-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5496-577-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5556-695-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5556-717-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-745-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5848-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-663-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5908-608-0x0000000000010000-0x0000000000083000-memory.dmp

Download