4c77cd3701757e6ab46dae0e4b7617b9a3276ec81459a20a8939c6c172bbc88f

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe
Size 243KB
Sample261027-jyhe8sda59
SHA256 4c77cd3701757e6ab46dae0e4b7617b9a3276ec81459a20a8939c6c172bbc88f
MD5 bc899f7eb763ebf24c490fa8eb508ea3
SHA1 6de6a344a721e009239d3d0d05e964afb8d5488f
SHA512 697683bcee470c9a45d8c86c3c214e40f25b87a3fe8717f174cf59ea24c4107f162c1a4e508a1a0990bff2edc895d368aeec6ec9729b3d5760f9a4cbf4282a99
SSDEEP 3072:eF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:+3frLQsa3lLNngoqRttA7C
TLSH
T193345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4424	CP.exe
2388	wrpjhbzuom.exe
3444	CP.exe
3212	CP.exe
1560	i_wrpjhbzuom.exe
4148	tqojgbytqo.sys
4084	CP.exe
5512	rljdbvtolg.exe
5516	CP.exe
4872	CP.exe
4120	i_rljdbvtolg.exe
4952	nlgbvtnlgd.sys
4136	CP.exe
4752	igdywqoigd.exe
5344	CP.exe
3928	CP.exe
5856	i_igdywqoigd.exe
5916	tqljdbvtnl.sys
3168	CP.exe
2812	dayvqnlfda.exe
4840	CP.exe
2100	CP.exe
1312	i_dayvqnlfda.exe
4300	nifdavtnlf.sys
1272	CP.exe
3736	icavsnlfdx.exe
1652	CP.exe
3020	CP.exe
2628	i_icavsnlfdx.exe
3812	causmkfcax.sys
5696	CP.exe
2648	icausmkfcx.exe
6092	CP.exe
3552	CP.exe
5920	i_icausmkfcx.exe
4688	hczxupmkfc.sys
1048	CP.exe
5000	hfcausmkec.exe
1804	CP.exe
1092	CP.exe
5648	i_hfcausmkec.exe
620	uspkhcausm.sys
2996	CP.exe
1300	kecwuomhec.exe
5456	CP.exe
5708	CP.exe
2736	i_kecwuomhec.exe
1128	rpjhbzwurm.sys
796	CP.exe
1484	rpjhbzurmk.exe
2016	CP.exe
868	CP.exe
5920	i_rpjhbzurmk.exe
5748	trojhbztrl.sys
3164	CP.exe
5816	tojgbztrlj.exe
3280	CP.exe
5888	CP.exe
4696	i_tojgbztrlj.exe
4616	eywqoiywqo.sys
2736	CP.exe
1776	trljgbytql.exe
1348	CP.exe
3424	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_402867049\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_402867049\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_1812316616\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3032_1360516047\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_2139883036\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_386491974\_locales\te\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfcays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dayvqnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dayvqnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebzwromj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfcays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5552	ipconfig.exe
4068	ipconfig.exe
2464	ipconfig.exe
2752	ipconfig.exe
592	ipconfig.exe
4384	ipconfig.exe
3068	ipconfig.exe
6104	ipconfig.exe
5284	ipconfig.exe
5820	ipconfig.exe
720	ipconfig.exe
3592	ipconfig.exe
2516	ipconfig.exe
128	ipconfig.exe
4864	ipconfig.exe
4616	ipconfig.exe
3620	ipconfig.exe
3108	ipconfig.exe
4672	ipconfig.exe
2700	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{34115711-3DEC-4777-955C-A23F9BBBB7DD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	i_wrpjhbzuom.exe
Token: SeDebugPrivilege	4120	i_rljdbvtolg.exe
Token: SeDebugPrivilege	5856	i_igdywqoigd.exe
Token: SeDebugPrivilege	1312	i_dayvqnlfda.exe
Token: SeDebugPrivilege	2628	i_icavsnlfdx.exe
Token: SeDebugPrivilege	5920	i_icausmkfcx.exe
Token: SeDebugPrivilege	5648	i_hfcausmkec.exe
Token: SeDebugPrivilege	2736	i_kecwuomhec.exe
Token: SeDebugPrivilege	5920	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	4696	i_tojgbztrlj.exe
Token: SeDebugPrivilege	5820	i_trljgbytql.exe
Token: SeDebugPrivilege	4148	i_bytqljdbnl.exe
Token: SeDebugPrivilege	204	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	6060	i_xvpnhfcays.exe
Token: SeDebugPrivilege	3952	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	6012	i_kfcxupnhfz.exe
Token: SeDebugPrivilege	5992	i_mkecwupmhf.exe
Token: SeDebugPrivilege	5892	i_ljebzwromj.exe
Token: SeDebugPrivilege	3776	i_rljgeywqoj.exe
Token: SeDebugPrivilege	1360	i_igaytqoige.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 4628	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	88
PID 4628 wrote to memory of 3032	4628	iexplore.exe	90
PID 3032 wrote to memory of 4588	3032	msedge.exe	91
PID 3032 wrote to memory of 1172	3032	msedge.exe	92
PID 3032 wrote to memory of 1720	3032	msedge.exe	94
PID 3032 wrote to memory of 1720	3032	msedge.exe	94
PID 3032 wrote to memory of 2900	3032	msedge.exe	93
PID 3032 wrote to memory of 2900	3032	msedge.exe	93
PID 3032 wrote to memory of 2900	3032	msedge.exe	93
PID 3032 wrote to memory of 4836	3032	msedge.exe	96
PID 3032 wrote to memory of 4836	3032	msedge.exe	96
PID 3032 wrote to memory of 4836	3032	msedge.exe	96
PID 3032 wrote to memory of 1536	3032	msedge.exe	97
PID 3032 wrote to memory of 1536	3032	msedge.exe	97
PID 3032 wrote to memory of 1536	3032	msedge.exe	97
PID 3032 wrote to memory of 1348	3032	msedge.exe	98
PID 3032 wrote to memory of 1348	3032	msedge.exe	98
PID 3032 wrote to memory of 1348	3032	msedge.exe	98
PID 3032 wrote to memory of 616	3032	msedge.exe	99
PID 3032 wrote to memory of 616	3032	msedge.exe	99
PID 3032 wrote to memory of 616	3032	msedge.exe	99
PID 3032 wrote to memory of 3432	3032	msedge.exe	101
PID 3032 wrote to memory of 3432	3032	msedge.exe	101
PID 3032 wrote to memory of 3432	3032	msedge.exe	101
PID 3032 wrote to memory of 6120	3032	msedge.exe	102
PID 3032 wrote to memory of 6120	3032	msedge.exe	102
PID 3032 wrote to memory of 4776	3032	msedge.exe	103
PID 3032 wrote to memory of 4776	3032	msedge.exe	103
PID 3032 wrote to memory of 4776	3032	msedge.exe	103
PID 3032 wrote to memory of 4680	3032	msedge.exe	104
PID 3032 wrote to memory of 4680	3032	msedge.exe	104
PID 3032 wrote to memory of 1712	3032	msedge.exe	105
PID 3032 wrote to memory of 1712	3032	msedge.exe	105
PID 1732 wrote to memory of 4424	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	106
PID 3032 wrote to memory of 5136	3032	msedge.exe	109
PID 2388 wrote to memory of 3444	2388	wrpjhbzuom.exe	111
PID 3032 wrote to memory of 2016	3032	msedge.exe	114
PID 3032 wrote to memory of 2016	3032	msedge.exe	114
PID 3032 wrote to memory of 1068	3032	msedge.exe	115
PID 3032 wrote to memory of 1068	3032	msedge.exe	115
PID 3032 wrote to memory of 3116	3032	msedge.exe	118
PID 3032 wrote to memory of 3116	3032	msedge.exe	118
PID 3032 wrote to memory of 6060	3032	msedge.exe	119
PID 3032 wrote to memory of 6060	3032	msedge.exe	119
PID 1732 wrote to memory of 3212	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	120
PID 3032 wrote to memory of 4468	3032	msedge.exe	122
PID 3032 wrote to memory of 4468	3032	msedge.exe	122
PID 3032 wrote to memory of 4468	3032	msedge.exe	122
PID 1732 wrote to memory of 4084	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	125
PID 5512 wrote to memory of 5516	5512	rljdbvtolg.exe	127
PID 1732 wrote to memory of 4872	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	130
PID 1732 wrote to memory of 4136	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	134
PID 4752 wrote to memory of 5344	4752	igdywqoigd.exe	136
PID 1732 wrote to memory of 3928	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	139
PID 1732 wrote to memory of 3168	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	143
PID 2812 wrote to memory of 4840	2812	dayvqnlfda.exe	145
PID 1732 wrote to memory of 2100	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	148
PID 3032 wrote to memory of 2996	3032	msedge.exe	151
PID 3032 wrote to memory of 6064	3032	msedge.exe	152
PID 3032 wrote to memory of 4672	3032	msedge.exe	153
PID 1732 wrote to memory of 1272	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	156
PID 3736 wrote to memory of 1652	3736	icavsnlfdx.exe	158
PID 1732 wrote to memory of 3020	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	161
PID 1732 wrote to memory of 5696	1732	2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_bc899f7eb763ebf24c490fa8eb508ea3_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x334,0x7ffe7ba2c188,0x7ffe7ba2c194,0x7ffe7ba2c1a0
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,10131498621189935815,16526200007527566636,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
      4⤵
      System Time Discovery
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5049994025696403181,5451060808247174720,262144 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,10788805442422019829,1447299436312655231,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,2520141171078185570,9364311613618024870,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,11491301158305008908,5677050905030342010,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,13993755451991263084,11815198987487473125,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:9
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,11579202091887738424,12485614758505752210,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3720,i,14150644492795743966,3739333714357147565,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4949496342744167791,15099982685122740872,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5548,i,517010460723643015,8126319153041119017,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,2405343150395184066,18060235460065116878,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,3736574741848599010,9528571867177493437,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,5149250461264437796,225964072016615539,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,5149250461264437796,225964072016615539,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5747262344263142539,7226657530859244554,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5437520927128296202,17536242123280611360,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,1502125922965939541,8049621982316880966,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,8819374223039687605,7140166527421807888,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6704,i,4950982633397384441,6981921649788048762,2097152 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,5570261946124146880,14067165834870771484,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,12691082008067224496,10711271966259033406,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,14866856928620845115,11901177521111692912,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,17783500578344276841,4854197736627647145,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1954478179248370870,7963538992514284786,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2307949227195089361,4845878156055510563,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,12941580996307835137,13316791807606473887,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,3655173202786142748,11959023790555416567,262144 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,13974340209840792470,5345980348477612761,524288 --field-trial-handle=2628,i,5679230984473159511,9427649203390248374,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzuom.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4424
- - C:\Temp\wrpjhbzuom.exe
    C:\Temp\wrpjhbzuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_wrpjhbzuom.exe
    C:\Temp\i_wrpjhbzuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4084
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdywqoigd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4136
- - C:\Temp\igdywqoigd.exe
    C:\Temp\igdywqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdywqoigd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3928
- - C:\Temp\i_igdywqoigd.exe
    C:\Temp\i_igdywqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dayvqnlfda.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\dayvqnlfda.exe
    C:\Temp\dayvqnlfda.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dayvqnlfda.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2100
- - C:\Temp\i_dayvqnlfda.exe
    C:\Temp\i_dayvqnlfda.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1272
- - C:\Temp\icavsnlfdx.exe
    C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3020
- - C:\Temp\i_icavsnlfdx.exe
    C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5696
- - C:\Temp\icausmkfcx.exe
    C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\i_icausmkfcx.exe
    C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcausmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1048
- - C:\Temp\hfcausmkec.exe
    C:\Temp\hfcausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcausmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1092
- - C:\Temp\i_hfcausmkec.exe
    C:\Temp\i_hfcausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwuomhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\kecwuomhec.exe
    C:\Temp\kecwuomhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwuomhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5708
- - C:\Temp\i_kecwuomhec.exe
    C:\Temp\i_kecwuomhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:796
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tojgbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3164
- - C:\Temp\tojgbztrlj.exe
    C:\Temp\tojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tojgbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\i_tojgbztrlj.exe
    C:\Temp\i_tojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljgbytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2736
- - C:\Temp\trljgbytql.exe
    C:\Temp\trljgbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljgbytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\i_trljgbytql.exe
    C:\Temp\i_trljgbytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbnl.exe ups_run
  2⤵
  PID:3400
- - C:\Temp\bytqljdbnl.exe
    C:\Temp\bytqljdbnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbnl.exe ups_ins
  2⤵
  PID:2936
- - C:\Temp\i_bytqljdbnl.exe
    C:\Temp\i_bytqljdbnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  PID:1956
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfcays.exe ups_run
  2⤵
  PID:3912
- - C:\Temp\xvpnhfcays.exe
    C:\Temp\xvpnhfcays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfcays.exe ups_ins
  2⤵
  PID:248
- - C:\Temp\i_xvpnhfcays.exe
    C:\Temp\i_xvpnhfcays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  PID:1280
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  PID:5368
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxupnhfz.exe ups_run
  2⤵
  PID:1308
- - C:\Temp\kfcxupnhfz.exe
    C:\Temp\kfcxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxupnhfz.exe ups_ins
  2⤵
  PID:5404
- - C:\Temp\i_kfcxupnhfz.exe
    C:\Temp\i_kfcxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  PID:1128
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebzwromj.exe ups_run
  2⤵
  PID:700
- - C:\Temp\ljebzwromj.exe
    C:\Temp\ljebzwromj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebzwromj.exe ups_ins
  2⤵
  PID:5152
- - C:\Temp\i_ljebzwromj.exe
    C:\Temp\i_ljebzwromj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljgeywqoj.exe ups_run
  2⤵
  PID:5056
- - C:\Temp\rljgeywqoj.exe
    C:\Temp\rljgeywqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljgeywqoj.exe ups_ins
  2⤵
  PID:5860
- - C:\Temp\i_rljgeywqoj.exe
    C:\Temp\i_rljgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqoige.exe ups_run
  2⤵
  PID:244
- - C:\Temp\igaytqoige.exe
    C:\Temp\igaytqoige.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqoige.exe ups_ins
  2⤵
  PID:5784
- - C:\Temp\i_igaytqoige.exe
    C:\Temp\i_igaytqoige.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4148

C:\Temp\tqojgbytqo.sys
C:\Temp\tqojgbytqo.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\nlgbvtnlgd.sys
C:\Temp\nlgbvtnlgd.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\nifdavtnlf.sys
C:\Temp\nifdavtnlf.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\causmkfcax.sys
C:\Temp\causmkfcax.sys
1⤵
- Executes dropped EXE
PID:3812

C:\Temp\hczxupmkfc.sys
C:\Temp\hczxupmkfc.sys
1⤵
- Executes dropped EXE
PID:4688

C:\Temp\uspkhcausm.sys
C:\Temp\uspkhcausm.sys
1⤵
- Executes dropped EXE
PID:620

C:\Temp\rpjhbzwurm.sys
C:\Temp\rpjhbzwurm.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\trojhbztrl.sys
C:\Temp\trojhbztrl.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\eywqoiywqo.sys
C:\Temp\eywqoiywqo.sys
1⤵
- Executes dropped EXE
PID:4616

C:\Temp\byvqoigdyv.sys
C:\Temp\byvqoigdyv.sys
1⤵
PID:2484

C:\Temp\daytnlfdxv.sys
C:\Temp\daytnlfdxv.sys
1⤵
PID:5772

C:\Temp\aysqnifaxs.sys
C:\Temp\aysqnifaxs.sys
1⤵
PID:3500

C:\Temp\mkicausnkf.sys
C:\Temp\mkicausnkf.sys
1⤵
PID:5920

C:\Temp\mkecxupmke.sys
C:\Temp\mkecxupmke.sys
1⤵
PID:3432

C:\Temp\jhecwurpjh.sys
C:\Temp\jhecwurpjh.sys
1⤵
PID:4892

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
PID:5996

C:\Temp\ztrljgbzwu.sys
C:\Temp\ztrljgbzwu.sys
1⤵
PID:1872

C:\Temp\ljgbztrljd.sys
C:\Temp\ljgbztrljd.sys
1⤵
PID:2748

C:\Temp\vqnigayvqo.sys
C:\Temp\vqnigayvqo.sys
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcax.sys

Path C:\Temp\causmkfcax.sys
Size 141KB
SHA256 08ef491a092ba8d7b5711aeeaabd2dc6eb5d99b4906da48fc0bc93216a7d1216
MD5 cbd432495ba89c75e5c29690d5511598
SHA1 eac1218a7877edcb63016db7de233323b72b9c08
SHA512 d5bf2567cf94ec408333350a3f85123df1e7627e91e24477443e765e7f407dc16932aba86aa7998afa6ba98e0e76ad36f6a7a8bc914a00ab28f536827a7c6596
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dayvqnlfda.exe

Path C:\Temp\dayvqnlfda.exe
Size 243KB
SHA256 1309570ebf22365ed1ed64a67d74afcb9ed05c0bccc28be426d5d72d7ccba404
MD5 6666063996b495d2cc9f6bb536912314
SHA1 0900cf51d9f9a6c3c0ac8c83692233607fbe7bc2
SHA512 381d78bb9c17d1ed4e5536638910b3e7477f0556322a4750a15056b463f600af21319082e698d38b238f36932f21641986c20ced900ac69552467a0b32f0f492
SSDEEP 3072:cF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:I3frLQsa3lLNngoqRttA70
TLSH
T1FE345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dayvqnlfda.exe

Path C:\Temp\i_dayvqnlfda.exe
Size 243KB
SHA256 8825ca17873212d0978cc4004656f9e0f55494d8517cc280cbe6f98fef3ab1f0
MD5 cc8286bbd326f253b3dc3c8f72ade10a
SHA1 a6f94c665c691fe24c4236a1705a21d7c6e26ffa
SHA512 19a62a1d3106bf6657e620dfb2df9733a0626aede26e57cd7ec0a4aea4ce980bfceb932f65933bbaf6439be13ae397ae99bc7e17faeda9ef5920607fa8309f67
SSDEEP 3072:NF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7J:v3frLQsa3lLNngoqRttA7J
TLSH
T13E345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsnlfdx.exe

Path C:\Temp\i_icavsnlfdx.exe
Size 243KB
SHA256 994d5df5b12491b60c85934b11e24c7b438634b24c4672c72d1871451b7e9916
MD5 3b06151e062747fd77b7fc6a4cfceaf5
SHA1 bf5a3cb1662da263c4d2acf145dfcf70049ee925
SHA512 a1313520c31a2a7f61619b05a15694c10afe2e849040915a7370079775c07ca9d536ac8159b139e5828544eae326deb46c6cef8b2fbe4352c967f6341438afa2
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:Q3frLQsa3lLNngoqRttA7I
TLSH
T179345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdywqoigd.exe

Path C:\Temp\i_igdywqoigd.exe
Size 243KB
SHA256 387cd76bb7e77fefbd59b1fbd17c42d746f6b4b5194fe7828224ab2b94625037
MD5 fee9ce4343e6e4728291a358d4704b9f
SHA1 d7818927e22bf18daf272d224745946897867dc7
SHA512 2c7ec6d350653d4efa0d2e731e7f3173cdb2fcc991ec1c1226f6ba43942c79d58ac59dc0bc6b6a3a42c758da939965f160935206f672a1df3e60a0efba6e388e
SSDEEP 3072:UUF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7ma:T3frLQsa3lLNngoqRttA7Z
TLSH
T154345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbvtolg.exe

Path C:\Temp\i_rljdbvtolg.exe
Size 243KB
SHA256 d12793102932258c7ee654f753d4a036d0919ce089fe54bd8488dd3fc2d60962
MD5 fa13471b8fa7793015cc3d06b467d96d
SHA1 07bdbd9bbeef1aebbb69b59d0aa4ccecc9f36638
SHA512 92aa114b0df97ee1e8d2358eed2530c03f57560f760693286cf371a639e40fb445506ec42cb0fc5b1c0e2581510b5757bbfbc47024b698b96ed9e851831d6001
SSDEEP 3072:MF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Y3frLQsa3lLNngoqRttA7s
TLSH
T11D34590172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbzuom.exe

Path C:\Temp\i_wrpjhbzuom.exe
Size 243KB
SHA256 1c8e46efce7ce36af0f0602f54ded2fe0d013710709457c8ae0cc094862a162a
MD5 8de277c3405618048fef54d89ea59612
SHA1 774f2ebd19a74e179301dfc7ae35c06e7d6af866
SHA512 563b59b606cc73607aaddc3e599b925905124879ac902ee5f9fb373a92fa5a238a31118c9e71a746b0aa8a2b025295548e061830ba58d7a10c0038fc47ced874
SSDEEP 3072:zF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:x3frLQsa3lLNngoqRttA7b
TLSH
T19F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfcx.exe

Path C:\Temp\icausmkfcx.exe
Size 243KB
SHA256 f8d76b4d379315558aa4033b36360de977199c8a02db01033c392dd70fd13bd5
MD5 a0a09f1434cf1b0e16fb4e2f8eed94e0
SHA1 381d4a8dfe4f37e271da6ea16132be868d79fc61
SHA512 a8cb56f54fffeb0c18271fbe2b1e46c1f0afd954e9e247446c150dfbe64c7b57c10ec06a7dfe916abcba2a45c01e4dc30f90a54b1f0037bf0ed967d5a832af05
SSDEEP 3072:9F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:/3frLQsa3lLNngoqRttA7B
TLSH
T19D345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.exe

Path C:\Temp\icavsnlfdx.exe
Size 243KB
SHA256 2e05e9e1e3206678f1b3f1a37ff8491c60c7ed7a9548bc5e44acd16aa2374790
MD5 6fb90601aeade3489492484347b08ee4
SHA1 3cbc85e8508cd7b5baf545d8269ae60109dee022
SHA512 d2344ff7456d47fe729dfbc125e79d2cd669c46a6478f53e806974dd8c93b4505b2db2a29e12539d3ed559958cc8e83f57491bb0b3c995e7072e4abda94d5eaf
SSDEEP 3072:WF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:23frLQsa3lLNngoqRttA72
TLSH
T1F7345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdywqoigd.exe

Path C:\Temp\igdywqoigd.exe
Size 243KB
SHA256 d65359cdd599dbb7e7833749c68de5e87792e13d390d8f803a88495a00cc4e35
MD5 3301872dfac8b10dffe04ca150d2761f
SHA1 933974d9d607a5f03385c30c8239b717bc788035
SHA512 bee5b4d99c40c67e46a2aba3564c12263321600b603617b255fb7d417f18669d0de8b4dcd7a357273849da4c7c7ac85b96eea858f72739bdd7f168a7ac236254
SSDEEP 3072:UF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:A3frLQsa3lLNngoqRttA7s
TLSH
T17A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdavtnlf.sys

Path C:\Temp\nifdavtnlf.sys
Size 141KB
SHA256 568d007fac52ace42f40b13b99e31100720ca1042587eba3725e209c56669e25
MD5 3ab7ef6c6bac94f7bc62542e8b95680e
SHA1 8c588ab11e2d83e58a71510e6c1d4f20644e384c
SHA512 4f6211571f78db790f495af1f296b725170429c4f83ad716c732577329cf219c6fc5df31d9249ae2f5089cb1248b59d2f70f36a80fb63c9278b1c8fa23ac7c28
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgbvtnlgd.sys

Path C:\Temp\nlgbvtnlgd.sys
Size 141KB
SHA256 f06fdec4cc02687de8b5ac1f127e25911c0c7a9f23405c373bc58d48ab535dcd
MD5 9672b8659ab37274b9e6ef50f0bdc228
SHA1 01dc9f6c114f135584fbe334e2be708263acab1d
SHA512 eeb319dabdf1d475a273246fb47ae6e8444a3a3f2dc26c1a647b8f31f54b1baf1ccb2c849915c551f31993c8b69b58562df02a2d161205051f578852d04c79d7
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T155E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtolg.exe

Path C:\Temp\rljdbvtolg.exe
Size 243KB
SHA256 ad34c78f66d85def23f6c9b1beb998f0dbe51e782fc4f36abd3072a47a05cbe8
MD5 ffd24a76c96c86458b2fb440e25c3801
SHA1 dbc2714efd0f308ad5d88107abe537aec1da3606
SHA512 8ea4a884ec3e0aa1e3d4fc67d0e8bae53979139377c809690ea75f96acb03d435a3dc5f021f8af133410bf7402d81469a90abd966fd7f3e6422731337c32c519
SSDEEP 3072:yF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:i3frLQsa3lLNngoqRttA7e
TLSH
T16F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.sys

Path C:\Temp\tqljdbvtnl.sys
Size 141KB
SHA256 cfc02f233e4b3df318dbef3cdaeb019bba4c7a9d63700a2422421b81b5c034ec
MD5 17b4db66be15aa596e9b7fb3db8b0c97
SHA1 36eccfa4140620704199c5a11433553e65d15f94
SHA512 c3a48f434b91737f470663a58269c5d4da88bd53538e233ee2a069f0e0a18aa0aa42252ef98969b58e95e946b9d4ce02725b244f7fd16086f9ce5d8665820bd2
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqojgbytqo.sys

Path C:\Temp\tqojgbytqo.sys
Size 141KB
SHA256 5da3602830659b6f5ed46bef4ae30594e96899e6e5911a465ffe4c087a723db2
MD5 cf00b2d7fb8af795d35815bcb18ce17a
SHA1 54614aaad3361d34189e2dc7150a802d2c156092
SHA512 44d097f183598012eaf2abbb730e9c96dc76051a4da3ff9ee37a658d85b2d05022016dc0edce890f4bd05118f81d399baf4d0e696129b484f3f999b764c619ef
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T117E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbzuom.exe

Path C:\Temp\wrpjhbzuom.exe
Size 243KB
SHA256 a44f489f9c0b4e973e5fc1ac73c4a0bba94d0258c6383bc6b4505e1f3c709b41
MD5 c684c7137dc437cf63a765968fc8f37f
SHA1 29236b22b200f21e0ce21f951dbd23d233be9c0c
SHA512 70fc325fd2bb244373621feb695700eac06eb66e407e4cffc77908f380dfe04980b76e02bd10e79a2bce273b4678c9afdb9a6555c0e88a72fb0f80cca776bf6a
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:m3frLQsa3lLNngoqRttA7e
TLSH
T11E345A0172818032E7150B78045AE7A1867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155a6e10-6263-45a0-a7bc-1f06e1d79f5c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\155a6e10-6263-45a0-a7bc-1f06e1d79f5c.tmp
Size 33KB
SHA256 2012e09931c23c84337ca21e22edbc2224795e2be7d699c2305b252f3ec40d78
MD5 199e52ba99421b15a7e8c2e259bab374
SHA1 053f63568e3dba068a741c94bc99921b0f82aaef
SHA512 9f1b8d6755062d3f2ea76d3ae036fda88026910766c7d3fa0742ec1fe1d5dcc4d6eacdd3f0bc81a0f76b9cad887e827002416ad18993e33c510a2b3b29cb39fc
SSDEEP 768:cP3kTJKc7fZrKN1tw5p5XSwQs88uBkiT2roaTZc8iLI:cP3SftrCcILNB29pis
TLSH
T121F2B034F8959C63ACF6A38176873783AEF06157C8C40B54D9DEA62D018775D3B8B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d5e81a2-34d0-4e84-a77a-a03b939e12d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d5e81a2-34d0-4e84-a77a-a03b939e12d6.tmp
Size 37KB
SHA256 a1f213020f1b46eba415a1fc9deead466f08b0a659dd453904e2d30bc5c5cb2b
MD5 e7339b24d8270c03978e30958eaf04c9
SHA1 deb0d25dfcfaa282e0ddff9df340bd0cd5f9e6a0
SHA512 18335fb0795d16a01ffb1df7738c1c0599a87c24c8227ea7090aeafa382418e7711ceacc86c5cfb2b8f17d8a9dd8e8629391f909c5ba3c3dba9fdc4833f92e22
SSDEEP 768:R/UxvxjgC+W3UZUc7fZrKfp5XSwQs88uBkiTCW/P84g:kZj3+W3UNtrMILNB3Hg
TLSH
T17103D039EC946863ACF3E385375A275BAFF06063C4C41B9849EE7A1E028775D6307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87b3d2e2-284e-4f8d-920a-1018ee5d8677.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\87b3d2e2-284e-4f8d-920a-1018ee5d8677.tmp
Size 33KB
SHA256 543ca0cfba7fdc5d22268477cd08214e647cc85f4ecabb7ed3befb7ceade305e
MD5 ceb8e5d2bed316e2049ef806cb10a433
SHA1 54c86315a9bb0f13aefb0655282e5f7497871de1
SHA512 79f32527a03c7352555b0bad56f196c819e598192df44ac0bb99b16fd756893c06bced3d049957e5c0725a14839e3a40c300aa6a01bc0442753500491c204695
SSDEEP 768:bP3k+OKc7fZrKN1twSp5XSwQs88uBkiT2roaTZc8iLI:bP3R0trCLILNB29pis
TLSH
T1E6F2BF34F8959C63ACF6A381768A3783AEF06157C8C40F54D9DEA62D018775D3B8B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d7a7139-61fc-4ceb-a8ee-7c6ec2746d67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d7a7139-61fc-4ceb-a8ee-7c6ec2746d67.tmp
Size 38KB
SHA256 02718703bba1c721797816c8de7e5fb915a5365e4cb58ab3c6b7c7ae59e8bb29
MD5 f7891490fa5b8189b62959d2a3680cdb
SHA1 b534101baec0d04e63b2f1c33c01e3350760ee87
SHA512 24daebf79243512010cb62cccdabbbe710cedb0daa3d137f0687ce4801a2124fb4aef2385527e6128d65e1f4f8e5fff2098cf8a60eee0086e5bc4be717a8f90d
SSDEEP 768:k/UxvxjgC+W33l0Uc7fZrKN1twtp5XSwQs88uBkiTzr/P84g:RZj3+W3VAtrCoILNBNHg
TLSH
T1FF03C139E8949C63BCF79345369B239BAFF020A3C4C50F9489EE6A1E028775D2747857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

0cb733a7-f9ed-4047-9781-99f3529c4cb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0cb733a7-f9ed-4047-9781-99f3529c4cb6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6731b8c5-035f-42a9-9b7b-044b69650d02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6731b8c5-035f-42a9-9b7b-044b69650d02.tmp
Size 11KB
SHA256 3df7d67119ab177fd85fa7592bb3170d4e4f928f0b4b492b8d86770c22b90f27
MD5 e2c82166d27a7e9095fea0bdf38c08fe
SHA1 1f9a323affc02f3361199f60523355c2da517d4a
SHA512 7406020fce61d7e6ed1422e971889fd00357e36e7d2159d0b3c654157bb4e9040965361fe8c79683f8d7ef86ee7560dbe7a03350cbfeb56d899f5ed7829fa634
SSDEEP 192:sxRdR2CL/f3s2DSw2ZU2P2zoA8p9x/g6+WNCE1gx/YE3of/GzIgVTHJ:sxRd7L/f3s2DpA1TX/5G/Jxp
TLSH
T1E642B815AE24A93B9CCBD21DBB657F53D2F95132A0D41F48A6FC8A1C04EB6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c86f031-e828-425b-8482-cbafbe49b8bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c86f031-e828-425b-8482-cbafbe49b8bc.tmp
Size 12KB
SHA256 e9bc03bd987c290d54d03dedef9482696c0bf6ce8ec1876bb551433f10b0dcac
MD5 e5c9580b4f4af19126d626ffa00b99db
SHA1 4e2d3e716735e49f0f464b98217fedc6ef1ef443
SHA512 430b3f2971a6fec2b6ffbbdc941166801ff6bcf5c1f8feccfdd64a8dab762b6370e92adbe53f3a86ee38e589491f6c3b66c8101ebc40a1bb4816b34b5b0aeb2b
SSDEEP 192:sxRaR2CL/f3s2DKw2ZU2P2zoA8p9x/g6+WNCE1gx/YE326Z/GzIgDyTHJ:sxRa7L/f3s2DhA1TX/5G/6/ap
TLSH
T14542C915AE24A93B9CCBD21DBB557F53E2F9513290D41F48A6FC8B1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90bb8c62-93b7-4a58-9795-9caac08ada1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90bb8c62-93b7-4a58-9795-9caac08ada1e.tmp
Size 11KB
SHA256 daf88aa17342544456f420bbb7e268f7bef990eb79a0023adec4525cddfc1dd7
MD5 12f35d65167a2263b8c69b4c1c2dc70c
SHA1 604d8f5ff1d1f65e10c1ee99f009c5e59546f118
SHA512 aaa8ff86cdd0592ac4fcfc7accd8d83d67d62382d83f504567d7e32c049bbe5074af7ecfbaeb469c7406dda98c42223e3b93acf144e134be2f2d9f64cb026065
SSDEEP 192:sxRaR2CL/f3s2DSw2ZU2P2zoA8p9x/g6+WNCE1gx/YE3of/GzIgDgTHJ:sxRa7L/f3s2DpA1TX/5G/Jwp
TLSH
T1EA42B815AE24A93B9CCBD21DFB557F53D6F95032A0D41F48A6FC8A1C04EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f1f2bde9991e4a377253c2ecb16f9413904bf9a604bc2d12be66e9e46c359187
MD5 1e1b5c964176eb5f699acaa82a1d277a
SHA1 8a9f59a7b89a77a73222f77a2eecf0550b38b3b6
SHA512 984ad84629ee507ec27efc2becba0f147af6320f06c6c061a4523032b04a2d6129c9166a5066eff0f50335f6c2628e4eee5fa07c981cbbbf594b92d6f6f1d242
TLSH
T13D51958D50C18AE5DBC884B085D010A3393AB572C7C39E1B0DA5F57A4F7672322660DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9e7bd01f536dd5c5566004b25dec9da23fed426830bdf7c160a84ff2bdb30b41
MD5 a9ce3f66d651f1c6ad83cd85aad2e74c
SHA1 3acf3a0960a1324355659388aa68b8d249f71c69
SHA512 ccdbc9cd6a09ba305be7a851d5d29487cbea0f5a01622c348960390bd99a74216005522a43ffa8dbfaa3b66ff64f2d0ed5db0aef0f90be81f4b95550735e472a
TLSH
T14A51958D51C18AE5DBC884B085E011A33A3AB572C7C39E1B0DA4F57A4F7673322A60DC
MD5 SHA1 SHA512 TLSH

Submit Download

01f02fec-2ca4-416c-9504-c4a539812733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\01f02fec-2ca4-416c-9504-c4a539812733.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

2500c837-3889-4e9e-bd97-85e0637433e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2500c837-3889-4e9e-bd97-85e0637433e0.tmp
Size 2KB
SHA256 a607ed9261ec2d53b436cf320575ed5376171844af39c5206b4ef584a531de08
MD5 83af08f0190f56ce5e1901fe782213f5
SHA1 f79213ffe019cb0c0d436f5588d5852bf182e34f
SHA512 ea425b34930efce6ac635c8263fb0d3829be5b25a6ab39440980b406bf9d5240aa780a09e2f4e0f134f0ce607bfe60ce8e65335c332b0ce002b0c9cc562d27fe
TLSH
T1AE41CFF7C3F4857D8A0196F0AA146E1FCE2C0515432C7D5A85E49E2B93E34B1E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

a4d1d830-ab9b-41d7-b497-458b4ede4398.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a4d1d830-ab9b-41d7-b497-458b4ede4398.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d4db58d0-216e-45a8-8594-be824a5a22fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4db58d0-216e-45a8-8594-be824a5a22fb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f1eca7e9-6627-48c6-8420-c539b7dddca6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f1eca7e9-6627-48c6-8420-c539b7dddca6.tmp
Size 29KB
SHA256 c411f3e3e00d71f94d41bc116bcb73866acaaf6d52ec4ae722864d50479551a6
MD5 15bdeeef2fd73d68dba7982bb5773ee5
SHA1 81c5c433cb69fea906b550de660afb2342289134
SHA512 4329c59c88c658ce8ff58f3f101f640396d97870403aebc646bc65c9ef8da941cbf4a8aa573e725cf7110179c9441fa96e1097b7698b8fbdc4331ba58c3499ff
SSDEEP 768:U/pChF7pLuLjJmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4uyhp2roJb:U/pChTEjJmWg8KfrLu1jaU4u8pN1
TLSH
T177D2D97B740CCB7F4F804ADDA8197ADB6DA902CB9698CD4047FE941C02C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f210b84-5c97-4890-9d0a-e0c230a9e437.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2f210b84-5c97-4890-9d0a-e0c230a9e437.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a84eda47-4172-4b01-a78b-b1d917ff8f9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a84eda47-4172-4b01-a78b-b1d917ff8f9f.tmp
Size 42KB
SHA256 7040d31f7db33c3ac385d54862620b9d690b58509156c63051a4fbc80105174d
MD5 966f6472449bd748224c5d8df84ae56b
SHA1 a114d84be44b56f51a058cf6f8946b1aad83efb5
SHA512 310393251dfaf0e434de3085dec6f2e95901082e2df2fa37c5e2f33bcd0a7330cc3d6e68c71a18d4e59ec6f88fcaf73456e84dcae33d0a93936bb93e7019b89b
SSDEEP 768:mFd/3k8wgpsagerKN1twUZp5XSwQs88uBkiT2roaTZc8iLI:2/3n5rC/HILNB29pis
TLSH
T1E71327F598D38876E8AE5383677D2E429EFCD053B4840984FBC9591CCC822BFD74A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1610ea45-225c-4abd-a2a9-389beff0b484.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1610ea45-225c-4abd-a2a9-389beff0b484.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a08f48bf-0151-4d42-9e05-da057226ac75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\a08f48bf-0151-4d42-9e05-da057226ac75.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

dceb9c70-8b5f-4bdb-8dd8-0236382c9553.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\dceb9c70-8b5f-4bdb-8dd8-0236382c9553.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

eb09b1bb-357a-4ac6-8cc9-de1335caab10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb09b1bb-357a-4ac6-8cc9-de1335caab10.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c2ae376-c47c-47f0-a35a-3901505c71c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9c2ae376-c47c-47f0-a35a-3901505c71c7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a75be45b-a7fa-4732-9a60-71e03a636385.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a75be45b-a7fa-4732-9a60-71e03a636385.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

4683864d-bbe7-46d6-9030-f0b0b57e9aa4.tmp

Path C:\Users\Admin\AppData\Local\Temp\4683864d-bbe7-46d6-9030-f0b0b57e9aa4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbb64e07-be63-42e4-bac2-665782a3795c.tmp

Path C:\Users\Admin\AppData\Local\Temp\bbb64e07-be63-42e4-bac2-665782a3795c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1503061877\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1886069758\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_1433014763\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_1812316616\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_2139883036\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3032_402867049\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

memory/620-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1872-715-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1872-735-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-733-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3432-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-526-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-754-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4688-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4892-689-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-507-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5748-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-711-0x0000000000010000-0x0000000000083000-memory.dmp

Download