7650b34a8dbfe0f39ff77356794b07f2c12d0832d455625f52462fee5055c17a

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe
Size 243KB
Sample261030-hdan8axt2n
SHA256 7650b34a8dbfe0f39ff77356794b07f2c12d0832d455625f52462fee5055c17a
MD5 3a4b6727737e0a6262085b72ca92f9b5
SHA1 3df8f8605d4e2da391eb04ec75254f2ffa2e2555
SHA512 30a071a4c4d93b4c2e02b3c1e8c8273a50d923933f29d31cd47cf654a9ecfd7e042bad060741f4aa89639d5cb165caef2e820b8f85ed9ff0582489203ca289b9
SSDEEP 3072:NBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:Xb3TfLAUa3lLNngoqRttA79
TLSH
T10134490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6120	CP.exe
4052	qnlgdysqlf.exe
3784	CP.exe
5540	CP.exe
2516	i_qnlgdysqlf.exe
4468	aysqkidavt.sys
4188	CP.exe
428	ifavsnlfdx.exe
2996	CP.exe
5036	CP.exe
6024	i_ifavsnlfdx.exe
3112	kifaxvsqki.sys
5100	CP.exe
704	nifaxvpnif.exe
1516	CP.exe
5176	CP.exe
120	i_nifaxvpnif.exe
5472	fcxusnkfcx.sys
3036	CP.exe
2508	hfzxspkhca.exe
4200	CP.exe
248	CP.exe
4432	i_hfzxspkhca.exe
4848	mkhfzxmkec.sys
2140	CP.exe
4512	cwusmjhfzx.exe
5948	CP.exe
3092	CP.exe
4248	i_cwusmjhfzx.exe
992	jhezxrpmhf.sys
4116	CP.exe
4864	hczurmbwuo.exe
5316	CP.exe
4860	CP.exe
5140	i_hczurmbwuo.exe
4832	jhbzwuomje.sys
5024	CP.exe
3924	rpjhecwrom.exe
120	CP.exe
4500	CP.exe
996	i_rpjhecwrom.exe
476	wtrljgbywt.sys
5800	CP.exe
1260	bzwrojgbyt.exe
4080	CP.exe
3404	CP.exe
264	i_bzwrojgbyt.exe
752	vtolgdywqo.sys
1788	CP.exe
1288	ljdbvtqlig.exe
4296	CP.exe
992	CP.exe
4780	i_ljdbvtqlig.exe
3112	nlidbvtnlj.sys
3720	CP.exe
1656	igaytqoiga.exe
2788	CP.exe
4928	CP.exe
5292	i_igaytqoiga.exe
2632	igaysqniga.sys
4916	CP.exe
4888	gaysqnigay.exe
5408	CP.exe
5756	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1299692958\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1380759276\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1299692958\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1554123494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1380759276\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1554123494\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1554123494\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3416_673467517\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_328652548\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1764657933\_locales\as\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwusmjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgdysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfcwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkfcaysp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwusmjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfcwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkfcaysp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgdysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifavsnlfdx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2128	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4312	ipconfig.exe
1660	ipconfig.exe
5992	ipconfig.exe
4504	ipconfig.exe
4124	ipconfig.exe
4536	ipconfig.exe
1576	ipconfig.exe
4124	ipconfig.exe
240	ipconfig.exe
5680	ipconfig.exe
1052	ipconfig.exe
4344	ipconfig.exe
3576	ipconfig.exe
2172	ipconfig.exe
3360	ipconfig.exe
960	ipconfig.exe
2668	ipconfig.exe
1828	ipconfig.exe
3500	ipconfig.exe
3112	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{56AA81E4-E9E1-4A87-9BCC-E0ABD9F3D565}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4364	msedge.exe
4364	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	i_qnlgdysqlf.exe
Token: SeDebugPrivilege	6024	i_ifavsnlfdx.exe
Token: SeDebugPrivilege	120	i_nifaxvpnif.exe
Token: SeDebugPrivilege	4432	i_hfzxspkhca.exe
Token: SeDebugPrivilege	4248	i_cwusmjhfzx.exe
Token: SeDebugPrivilege	5140	i_hczurmbwuo.exe
Token: SeDebugPrivilege	996	i_rpjhecwrom.exe
Token: SeDebugPrivilege	264	i_bzwrojgbyt.exe
Token: SeDebugPrivilege	4780	i_ljdbvtqlig.exe
Token: SeDebugPrivilege	5292	i_igaytqoiga.exe
Token: SeDebugPrivilege	4264	i_gaysqnigay.exe
Token: SeDebugPrivilege	3880	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	5888	i_spkhfcwupm.exe
Token: SeDebugPrivilege	4172	i_ausmkecxup.exe
Token: SeDebugPrivilege	3108	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	5892	i_hbzwromgey.exe
Token: SeDebugPrivilege	460	i_ztrljytrlj.exe
Token: SeDebugPrivilege	6076	i_yvqnljdbvt.exe
Token: SeDebugPrivilege	3476	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	1316	i_vpnkfcaysp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1032	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	89
PID 1032 wrote to memory of 3416	1032	iexplore.exe	90
PID 3416 wrote to memory of 4544	3416	msedge.exe	91
PID 3416 wrote to memory of 2128	3416	msedge.exe	92
PID 3416 wrote to memory of 1476	3416	msedge.exe	93
PID 3416 wrote to memory of 1476	3416	msedge.exe	93
PID 3416 wrote to memory of 1476	3416	msedge.exe	93
PID 3416 wrote to memory of 4676	3416	msedge.exe	94
PID 3416 wrote to memory of 4676	3416	msedge.exe	94
PID 3416 wrote to memory of 2876	3416	msedge.exe	96
PID 3416 wrote to memory of 2876	3416	msedge.exe	96
PID 3416 wrote to memory of 2876	3416	msedge.exe	96
PID 3416 wrote to memory of 5956	3416	msedge.exe	97
PID 3416 wrote to memory of 5956	3416	msedge.exe	97
PID 3416 wrote to memory of 5956	3416	msedge.exe	97
PID 3416 wrote to memory of 5336	3416	msedge.exe	98
PID 3416 wrote to memory of 5796	3416	msedge.exe	99
PID 3416 wrote to memory of 5336	3416	msedge.exe	98
PID 3416 wrote to memory of 5336	3416	msedge.exe	98
PID 3416 wrote to memory of 5796	3416	msedge.exe	99
PID 3416 wrote to memory of 5796	3416	msedge.exe	99
PID 3416 wrote to memory of 3420	3416	msedge.exe	100
PID 3416 wrote to memory of 3420	3416	msedge.exe	100
PID 3416 wrote to memory of 3420	3416	msedge.exe	100
PID 3416 wrote to memory of 3328	3416	msedge.exe	101
PID 3416 wrote to memory of 3328	3416	msedge.exe	101
PID 3416 wrote to memory of 1588	3416	msedge.exe	103
PID 3416 wrote to memory of 1588	3416	msedge.exe	103
PID 3416 wrote to memory of 1588	3416	msedge.exe	103
PID 3176 wrote to memory of 6120	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	104
PID 4052 wrote to memory of 3784	4052	qnlgdysqlf.exe	107
PID 3416 wrote to memory of 5744	3416	msedge.exe	110
PID 3416 wrote to memory of 5868	3416	msedge.exe	111
PID 3416 wrote to memory of 5744	3416	msedge.exe	110
PID 3416 wrote to memory of 5868	3416	msedge.exe	111
PID 3416 wrote to memory of 4256	3416	msedge.exe	113
PID 3416 wrote to memory of 5428	3416	msedge.exe	114
PID 3416 wrote to memory of 5428	3416	msedge.exe	114
PID 3416 wrote to memory of 5684	3416	msedge.exe	115
PID 3416 wrote to memory of 5684	3416	msedge.exe	115
PID 3416 wrote to memory of 5332	3416	msedge.exe	118
PID 3416 wrote to memory of 5332	3416	msedge.exe	118
PID 3416 wrote to memory of 5852	3416	msedge.exe	119
PID 3416 wrote to memory of 5852	3416	msedge.exe	119
PID 3176 wrote to memory of 5540	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	120
PID 3176 wrote to memory of 4188	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	124
PID 428 wrote to memory of 2996	428	ifavsnlfdx.exe	126
PID 3176 wrote to memory of 5036	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	129
PID 3176 wrote to memory of 5100	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	133
PID 704 wrote to memory of 1516	704	nifaxvpnif.exe	135
PID 3176 wrote to memory of 5176	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	138
PID 3176 wrote to memory of 3036	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	142
PID 2508 wrote to memory of 4200	2508	hfzxspkhca.exe	144
PID 3176 wrote to memory of 248	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	147
PID 3416 wrote to memory of 4344	3416	msedge.exe	150
PID 3416 wrote to memory of 4528	3416	msedge.exe	151
PID 3416 wrote to memory of 4592	3416	msedge.exe	152
PID 3176 wrote to memory of 2140	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	155
PID 4512 wrote to memory of 5948	4512	cwusmjhfzx.exe	157
PID 3176 wrote to memory of 3092	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	160
PID 3176 wrote to memory of 4116	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	164
PID 4864 wrote to memory of 5316	4864	hczurmbwuo.exe	166
PID 3176 wrote to memory of 4860	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	169
PID 3176 wrote to memory of 5024	3176	2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_3a4b6727737e0a6262085b72ca92f9b5_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x30c,0x7ffba12bc188,0x7ffba12bc194,0x7ffba12bc1a0
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,4030642703324804025,3683120666411046026,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:11
      4⤵
      System Time Discovery
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,18332681286267217410,14861550677452846616,262144 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,9501328147912557442,12985658064321251186,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6781015613724718151,16190664684738545473,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,16159476620792343684,852261192019216822,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,15958973831473889361,8338682647309746072,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4388,i,12684778037582922182,15120839974694015785,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5376,i,14726338704425042458,7106302561888970776,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15726683123381891568,16623833635068957166,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5568,i,17598214362319705745,17816845468687631811,2097152 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,13614234633659868445,4819874700794631654,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,6128491665185662783,3993497040710281892,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9714913317893358430,231809765099810307,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,9714913317893358430,231809765099810307,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10776684757068838528,2218064794940239455,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,13026702529932963427,6682852995163599863,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,3975295577446595377,9502818249368660343,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,15186802954774644787,14284435570969613977,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,2896923130233583050,13237590932165912237,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,12131141851203496236,10254487793872819402,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12357205071279613855,17058636605053441292,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,3758712603554275380,6563337417561043059,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,7770310753446056165,5779310791899132406,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,17129263451747682819,7729722173835267459,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=884 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17789058051628017814,12719646486508295435,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5100,i,956876087541995130,13891516184593331606,262144 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15110786487919708901,6784313492293371097,524288 --field-trial-handle=2612,i,293310561676761270,5820204001426621801,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlgdysqlf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6120
- - C:\Temp\qnlgdysqlf.exe
    C:\Temp\qnlgdysqlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlgdysqlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5540
- - C:\Temp\i_qnlgdysqlf.exe
    C:\Temp\i_qnlgdysqlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifavsnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4188
- - C:\Temp\ifavsnlfdx.exe
    C:\Temp\ifavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifavsnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\i_ifavsnlfdx.exe
    C:\Temp\i_ifavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaxvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5100
- - C:\Temp\nifaxvpnif.exe
    C:\Temp\nifaxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaxvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5176
- - C:\Temp\i_nifaxvpnif.exe
    C:\Temp\i_nifaxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:248
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwusmjhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\cwusmjhfzx.exe
    C:\Temp\cwusmjhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwusmjhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3092
- - C:\Temp\i_cwusmjhfzx.exe
    C:\Temp\i_cwusmjhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmbwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\hczurmbwuo.exe
    C:\Temp\hczurmbwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmbwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Temp\i_hczurmbwuo.exe
    C:\Temp\i_hczurmbwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhecwrom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5024
- - C:\Temp\rpjhecwrom.exe
    C:\Temp\rpjhecwrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhecwrom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\i_rpjhecwrom.exe
    C:\Temp\i_rpjhecwrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwrojgbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5800
- - C:\Temp\bzwrojgbyt.exe
    C:\Temp\bzwrojgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwrojgbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\i_bzwrojgbyt.exe
    C:\Temp\i_bzwrojgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtqlig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1788
- - C:\Temp\ljdbvtqlig.exe
    C:\Temp\ljdbvtqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtqlig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:992
- - C:\Temp\i_ljdbvtqlig.exe
    C:\Temp\i_ljdbvtqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3720
- - C:\Temp\igaytqoiga.exe
    C:\Temp\igaytqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\i_igaytqoiga.exe
    C:\Temp\i_igaytqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqnigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4916
- - C:\Temp\gaysqnigay.exe
    C:\Temp\gaysqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqnigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\i_gaysqnigay.exe
    C:\Temp\i_gaysqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run
  2⤵
  PID:3324
- - C:\Temp\nkfdxvpnhf.exe
    C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
  2⤵
  PID:916
- - C:\Temp\i_nkfdxvpnhf.exe
    C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhfcwupm.exe ups_run
  2⤵
  PID:5988
- - C:\Temp\spkhfcwupm.exe
    C:\Temp\spkhfcwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhfcwupm.exe ups_ins
  2⤵
  PID:3620
- - C:\Temp\i_spkhfcwupm.exe
    C:\Temp\i_spkhfcwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:752
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:5460
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  PID:4652
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  PID:6028
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzwromgey.exe ups_run
  2⤵
  PID:1984
- - C:\Temp\hbzwromgey.exe
    C:\Temp\hbzwromgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzwromgey.exe ups_ins
  2⤵
  PID:1200
- - C:\Temp\i_hbzwromgey.exe
    C:\Temp\i_hbzwromgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljytrlj.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\ztrljytrlj.exe
    C:\Temp\ztrljytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljytrlj.exe ups_ins
  2⤵
  PID:1724
- - C:\Temp\i_ztrljytrlj.exe
    C:\Temp\i_ztrljytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnljdbvt.exe ups_run
  2⤵
  PID:2796
- - C:\Temp\yvqnljdbvt.exe
    C:\Temp\yvqnljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnljdbvt.exe ups_ins
  2⤵
  PID:1412
- - C:\Temp\i_yvqnljdbvt.exe
    C:\Temp\i_yvqnljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxvqn.exe ups_run
  2⤵
  PID:2168
- - C:\Temp\vtnlfdxvqn.exe
    C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
  2⤵
  PID:1572
- - C:\Temp\i_vtnlfdxvqn.exe
    C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnkfcaysp.exe ups_run
  2⤵
  PID:5116
- - C:\Temp\vpnkfcaysp.exe
    C:\Temp\vpnkfcaysp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnkfcaysp.exe ups_ins
  2⤵
  PID:2360
- - C:\Temp\i_vpnkfcaysp.exe
    C:\Temp\i_vpnkfcaysp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4908

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
- Executes dropped EXE
PID:4468

C:\Temp\kifaxvsqki.sys
C:\Temp\kifaxvsqki.sys
1⤵
- Executes dropped EXE
PID:3112

C:\Temp\fcxusnkfcx.sys
C:\Temp\fcxusnkfcx.sys
1⤵
- Executes dropped EXE
PID:5472

C:\Temp\mkhfzxmkec.sys
C:\Temp\mkhfzxmkec.sys
1⤵
- Executes dropped EXE
PID:4848

C:\Temp\jhezxrpmhf.sys
C:\Temp\jhezxrpmhf.sys
1⤵
- Executes dropped EXE
PID:992

C:\Temp\jhbzwuomje.sys
C:\Temp\jhbzwuomje.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Temp\wtrljgbywt.sys
C:\Temp\wtrljgbywt.sys
1⤵
- Executes dropped EXE
PID:476

C:\Temp\vtolgdywqo.sys
C:\Temp\vtolgdywqo.sys
1⤵
- Executes dropped EXE
PID:752

C:\Temp\nlidbvtnlj.sys
C:\Temp\nlidbvtnlj.sys
1⤵
- Executes dropped EXE
PID:3112

C:\Temp\igaysqniga.sys
C:\Temp\igaysqniga.sys
1⤵
- Executes dropped EXE
PID:2632

C:\Temp\qnhfaxsqki.sys
C:\Temp\qnhfaxsqki.sys
1⤵
PID:924

C:\Temp\ausmkicaxv.sys
C:\Temp\ausmkicaxv.sys
1⤵
PID:5992

C:\Temp\ecxupmhfzu.sys
C:\Temp\ecxupmhfzu.sys
1⤵
PID:3292

C:\Temp\czurmjecwu.sys
C:\Temp\czurmjecwu.sys
1⤵
PID:4560

C:\Temp\ebztrojhbz.sys
C:\Temp\ebztrojhbz.sys
1⤵
PID:4044

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
PID:4256

C:\Temp\ywqoigdbvt.sys
C:\Temp\ywqoigdbvt.sys
1⤵
PID:3112

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
PID:5428

C:\Temp\dxvtnlfdxv.sys
C:\Temp\dxvtnlfdxv.sys
1⤵
PID:3008

C:\Temp\fcausqnhfd.sys
C:\Temp\fcausqnhfd.sys
1⤵
PID:5324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavt.sys

Path C:\Temp\aysqkidavt.sys
Size 141KB
SHA256 4fe0a75394e432d0dcd0b07b297df09a39a1c096ef129ffe877a18cd7eb6ae89
MD5 78a9e2b4aa476f0dbaf61bb22f1a750a
SHA1 dd6fce9bd394da719001a08662711dd9c4ec28bd
SHA512 f039b522188f329f6d19e9d772605b640dc66594614a04b0f38a59d58b86ce89f31eef49955c13aab2260963ba4b763594bce4b7b0737b531cfecefda3df8139
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE37C12B292D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmjhfzx.exe

Path C:\Temp\cwusmjhfzx.exe
Size 243KB
SHA256 21db8ec3b9a5658ba5aeee71733d3fbd53ca21bb2169deed69be64102e360677
MD5 3f65c4cfd9206f652ceb9661fa05988d
SHA1 323835a0105997ea2f4b9d6487fe0738914235f7
SHA512 6cc22aff784e691f28f27c68facf71f38e34a7c535c14bb5fb7ca99a9ea71ff60aabcbc6044ef8cef3d6f2d87219b1f32936345a85b53b780da83df9216e2798
SSDEEP 3072:xBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:zb3TfLAUa3lLNngoqRttA7B
TLSH
T10D34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusnkfcx.sys

Path C:\Temp\fcxusnkfcx.sys
Size 141KB
SHA256 c22cf4977f1110e8b9a80ae3efd9fe7f393f1b4234cfb891f24c82702377a3f4
MD5 97578f1276a3c5b4cbf249f9e8c12a27
SHA1 0a22467a1bd9194305e194cf38b49484776d03ba
SHA512 b98b2395e8443655ea9725288901cfc6ad8affffcaa1c5ff84d253739a6b52b68acb39c8d123ff535e946f275e4e4b2626c072d76702f9131a21ce7fc37f1f0e
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmbwuo.exe

Path C:\Temp\hczurmbwuo.exe
Size 243KB
SHA256 d23b044db962527b6bd88dd42b5007cb6cae81f9f20c2f00e396f75622bc902d
MD5 bfd321db358dba11ad147e27eaeb414f
SHA1 88d6fc55dbc0ed8c6d5abf16d959fe5ca89cc7c7
SHA512 950a42070a6ea7438822e5a5114b436fbb4a9a44b5d0b4ea86f64e7617a8f3c0a4371deb3fd8f3915a29b56e96d8b76b4f138a17fe9fe9fa927069c9f2440ac9
SSDEEP 3072:+Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:+b3TfLAUa3lLNngoqRttA7S
TLSH
T14634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkhca.exe

Path C:\Temp\hfzxspkhca.exe
Size 243KB
SHA256 f8d21392fa7790326e3a3cc4bbe57a8e76c1ef32dca54d956443a44dcbd70f40
MD5 da0bb8ff1e363eaca26fa3533e7e19df
SHA1 5c07c4c6da661995f1d766d886dec41911b8373e
SHA512 1d89ee62fd7a003c851b094dd33232f712da0622a5389118f1c21aa4ccd188ab02a92d172d12a79eb62f836d5112287fc00ceacf161bea861994d0ecfe263f00
SSDEEP 3072:BBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:jb3TfLAUa3lLNngoqRttA7R
TLSH
T1CA344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwusmjhfzx.exe

Path C:\Temp\i_cwusmjhfzx.exe
Size 243KB
SHA256 c77de4e44d873f9760ca65aa95ccac49dbbb5045165b701075a77dd74093db63
MD5 75c957b40660510d9fbd50a397ce2830
SHA1 c398aaec465d4ec424625e6d3ddf223b902c1252
SHA512 282957514e87aa876901e0357067fc421fb9367a96e45e1d38d5f54ef9b1d9e566318d8ea8516b84f62b345205fa3110eee52c1077b8b72ecfb2266c78e6d6d2
SSDEEP 3072:7Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:Nb3TfLAUa3lLNngoqRttA77
TLSH
T10C344A0172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxspkhca.exe

Path C:\Temp\i_hfzxspkhca.exe
Size 243KB
SHA256 28ef87c765bf8891226bc82d7d799ba440e5bf550349f5f7a0c41eae05ffa8da
MD5 ab4144493b9b2ef4794c6e0da2e1b0a1
SHA1 a25c94029da8c753dabced24698cd8247e6b5cfa
SHA512 540fc0b91096fbb2e0b4103d26d5acdaba0a517eefd3dc7d35f2fe8a59b507051d5c164ba98974921e581836910c4db9329c0c7ae63475d8efa7835285257b6a
SSDEEP 3072:ABb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:Qb3TfLAUa3lLNngoqRttA7s
TLSH
T1E434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifavsnlfdx.exe

Path C:\Temp\i_ifavsnlfdx.exe
Size 243KB
SHA256 427511cbc6524446aab8833b2e784bdfd6563821f014a209024954af3bcb67f9
MD5 b246d64eb10b9e789078cf0cf4722c24
SHA1 377e5b069d0838165a6c67f6ae9e35fa14bc55b6
SHA512 e3597b5be2b39c030c605bd633e91a99311810129938c93504e47f2a4af212cb28b97d3eedf80fdb6027c0795046583cbabb25665c9157d1f7336dc1e69fef33
SSDEEP 3072:YBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:ob3TfLAUa3lLNngoqRttA7g
TLSH
T1D434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaxvpnif.exe

Path C:\Temp\i_nifaxvpnif.exe
Size 243KB
SHA256 37a46542f2a962ff996aac37784465c62a1c3f4bde33a07148a493a982b8a312
MD5 0c01d864f168a3ffdd1ac8a6dbe08ad2
SHA1 0a6966713065e55509fc313ee267b99e18d840ae
SHA512 5b6e54ef5930ad86cfdf3b882e0f09e1385eddcf62804f6ae6b7e1755a4cef59bfdaeb64dfe60b8e626d4c51943e09b62d5bd62cb9a76cf17896536395f2b5e2
SSDEEP 3072:VBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:/b3TfLAUa3lLNngoqRttA79
TLSH
T1F634490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlgdysqlf.exe

Path C:\Temp\i_qnlgdysqlf.exe
Size 243KB
SHA256 970e8d4d45e50e83f2ac27b4a55b3844fb995ce984a69b8604197a0a60e1331b
MD5 137f58c2f51a414870e7ddcd663e5d34
SHA1 634c75efa8f93190725c2d88dca76667f48d0377
SHA512 dd608a198bfa1740a0904222f679dd24f34aa611ee4c1d32307e88ee848a1a6e35c0d421671bf51f28379ca95345df5d318e3531c86857954a864f8be774ff94
SSDEEP 3072:GBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:Gb3TfLAUa3lLNngoqRttA7K
TLSH
T15434490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifavsnlfdx.exe

Path C:\Temp\ifavsnlfdx.exe
Size 243KB
SHA256 0dedb96a8cf14f241dbc8e5c1a017c987b755f65d9a405af7e4679ac2d15bb7e
MD5 072538f8bbf9b8a257a6f9f8dccff0cc
SHA1 60faf5d38161cee00212c60700096b09fd2286f9
SHA512 579fab3f6bae48ae82ba4a77ce0af551fd935a30f0c44238aa0b87c315a3ad1a33ca3b931edfc5f7221fe81f9f44dfa0a003979b5d3985ca4dd15281db8902bf
SSDEEP 3072:RBb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:Tb3TfLAUa3lLNngoqRttA7x
TLSH
T1C734490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezxrpmhf.sys

Path C:\Temp\jhezxrpmhf.sys
Size 141KB
SHA256 0df33253a76a6b6701c05a7f99085fb919626e34d0fbfbfac085904be195c04f
MD5 e537e75ac33d6b3bb4495dcc403dc442
SHA1 fdd49e6bd3a2b5c4624c1be69f109c747ae2bf85
SHA512 552805a409ed4c0b78adfa45f568f5c595e0a6c719061e7a66ffb3efac09d7b859a6360301997b60e5d1ade0e29aec4fdbbb9ec29760d207a779571c4bc64943
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T186E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxvsqki.sys

Path C:\Temp\kifaxvsqki.sys
Size 141KB
SHA256 4c9df3a1c9d5cc28b61d83340b79a37e70c00ee41942f7ac4b9bd4cb778d4a3d
MD5 9a080f7ca6297ee29c2e19bc63c32d70
SHA1 dc1fddaf1e283fae7dbbac2387544166cb97bbb0
SHA512 6a4b8d07ca4a24a905ad8dee6ace642892a712eae10173c8f1cacb17fbf44db19730df0ae3b594e62a7ecb790dda4ee61171e925f592660bb366282c488f9610
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhfzxmkec.sys

Path C:\Temp\mkhfzxmkec.sys
Size 141KB
SHA256 00fb4c019aa2aa2817f0b6afa2660afa84ccc0171afa1bd29c36bc00cc96dbf8
MD5 e35a67f1e983c8ddfc9b76a94cc88316
SHA1 f2fde16c22ad50d115ce04a68f0b6313d7f94c2c
SHA512 cd66850b3755fddcc977775925a209d393d088abc68423da801ca69b714e95c71f35e83ce2808268d5c5b62bd538b77eed5e352c6dce9363fc551f30b8d92e00
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxvpnif.exe

Path C:\Temp\nifaxvpnif.exe
Size 243KB
SHA256 81dd4d7fb8be0ae66fd8293b07b4daf1eaa335a56f19a34ea681eb852ebfb6ca
MD5 a6cdbe15cb8dc140be3798949a0c8901
SHA1 1508f27ed30c3544db4b93b818247bf7bce68d84
SHA512 49dcf26450b4a84a7e28d197ef0653e0091c523ecaa2cfb86bccc4fbd863f4c8aa82171b4fbd932c8a0844ff555816e69e49174846bff8b2c6792256747c7a5a
SSDEEP 3072:8Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:Ub3TfLAUa3lLNngoqRttA7k
TLSH
T19A34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlgdysqlf.exe

Path C:\Temp\qnlgdysqlf.exe
Size 243KB
SHA256 923fdeb0b095bb997d8a44d6a69494f518993e354760d2f0d4cca7f695e21288
MD5 970f8a596582ab95593b008a67f6343a
SHA1 13814be08e2697804c97b0ad584d2ec9e323f44b
SHA512 ddeb755a0c3016591f1578d85ff2a47bb08dcd58108d9431ee160b997a75db831788c37cf59f5973d946cb6141c5332378b32455fe7f615b10b342fb997d445a
SSDEEP 3072:7Bb3TfLlaJhb7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:Nb3TfLAUa3lLNngoqRttA7b
TLSH
T14F34490172818071E75A0B78045AEBA1867E7C384BA5E5CFF7683F795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

029e7dab-7ead-4ef6-aa3c-3269b41ea20f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\029e7dab-7ead-4ef6-aa3c-3269b41ea20f.tmp
Size 38KB
SHA256 532f3bed9fafd4f71f926fadf16707d564d0700025abc8a3e569801e80d2adb3
MD5 8bd86200f09d6832f13159b8845fde8c
SHA1 78b1fc4367df71cf512bf49660c6b69a331ad9cf
SHA512 6689d47f1a616d11411b74bdae282fd4f7c3aadfa78c05c28e1582745f8a20debe4ab520a24f33891b722d841b3a7cafe453e74a70a0b27d6d3bb1f4dc390f15
SSDEEP 768:dE/UxvxjgC+23YwSO5YhL4xMIYNa8S5oYklnALdSH8L4:HZj3+23Tk0PTWRdAJS04
TLSH
T11103C039A9A4AC6398F663C4734FA397EEE51173D4C56DE889EC1F0E06873AE1707411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10eda01c-0486-4430-9733-37a9cb704b0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10eda01c-0486-4430-9733-37a9cb704b0b.tmp
Size 34KB
SHA256 d3c09287706cfaaf8fb2704a07108393274083dc6800f2b605e85b28f5e38a8f
MD5 8dcb8fdd6df180776606be4d1088a770
SHA1 765262db5109f5499f477789100dd283da453b52
SHA512 e653667425c5a106987db61f0120e4987fe1694b612def0355c702a060ec9fed2a76f5b1612dd7ad24b4e0db661acb99d57794257f3059de0a7defdc6417f69a
SSDEEP 768:FsW3J0QqSO5YhLJMIYNa8S5oYklnA+d6lL9:yW3JqkDTWRdAu6x
TLSH
T1D0F2B035E9E4ED738CEA9384B30A7793AED41223C4881FD8D9D91F1E06C32AE1703816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1378f036-c204-4625-90b5-a1c58767d528.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1378f036-c204-4625-90b5-a1c58767d528.tmp
Size 38KB
SHA256 7ee3c3c759b07a7f7f8506ac0acdc96bd589a050e02daf26d17aec85ef6d77f3
MD5 e6ad2e1c7557a3acf0876cf46ec7fe04
SHA1 9f4ddb7945d509c5cafac43f99ed6ec09b12ea50
SHA512 2eeecf27780b3febbfa3fc58f3bb9da8c530f581789921e6f8a68b58563b6226e2417ed9af787c3fa282af4373a2e700a422dbbf1ced03feb6dac6fa4d399142
SSDEEP 768:do/UxvxjgC+23dfGSO5Yh9JMIYNa8S5oYklnAaySH8L4:nZj3+23NSk9HTWRdAVS04
TLSH
T11603C03A9DA4A9738CF663C4770AA357AEF55263D0C16AF88AEC1F0E17C72AD5303451
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e4603d1-ede2-4c5a-8818-ee916dd212b6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1e4603d1-ede2-4c5a-8818-ee916dd212b6.tmp
Size 42KB
SHA256 47963599ebbcd783b790afb44a04bb78a9dde88f21c564eb129498ee48423158
MD5 9213225b6859d2f6029fbff5a318952d
SHA1 abc6d19769e5e14caf12d492ceefbd2ee4697743
SHA512 6175adb2d7217de2ddf51c199f7a5d71d77b702394be5d7c30cabe54a1c293e4536d8fd4d18c790338d0c051fd4b656e1ecddd315d2e197e265229c9938af750
SSDEEP 768:TFds34wgr0idXO5YhLAMIYNa8S5oYklnA+d6lL9:zs3u6keTWRdAu6x
TLSH
T1801327F698D79977D8AE5383A33D6E429EBCC123B4885994BBC81D4DCD821BFC706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36f59a43-d52f-4a9c-8f8d-710f46fd2dfc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\36f59a43-d52f-4a9c-8f8d-710f46fd2dfc.tmp
Size 34KB
SHA256 7920b063188d00a18b8fe69266459b624c082a42d12b216a1063a41700acc491
MD5 ca590d9a767ea764a55392e116d15226
SHA1 c68cff3ac33fc54d85dc314312ba65f0e9d7f821
SHA512 55d522729cde8c0e0a3c6227963f832420779c4203425ce475e3683c0aaa59d2050bf5c048af232aed5c4600bd0f8d67991bd50cee6a803e5006a8bfd83c1f13
SSDEEP 768:tW3k0pqSO5YhLtMIYNa8S5oYklnA+d6lL9:tW3khk3TWRdAu6x
TLSH
T18CF2B035E9E4ED738CEA9385B30A7793AED41223C4881ED8DADD1F1E06C729E1707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 84d025c8484a1ba1eae075fe4fb60ee1013d5e3c0fe4757f9d23c77a5ecf4bff
MD5 40a03f8f45ceb83458e7ff6718e8114c
SHA1 3aee2deed85e7e1b8a1a9090347606288ce5f90c
SHA512 011f7c1ff606c9271e176c099ac19361c51f6a3eb7ee8dae4e0bead781595a3fa38a006247688a203ba11818d1de1b9066033932d5d22ba79d5a19f921cf6159
TLSH
T164D02B316CDD4D23C08CA27C0056004117617400FE10404011211048080824142823AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72a43fbaed1cd4a89462ff759b5bb2f6f6d1a7a9c08002937c809c101fc685e4
MD5 b04c9bc22d86d65999036cf784bd7a42
SHA1 74f3b96e34181e491a9fd238877d82f72fce321d
SHA512 9bbf9224f5546df81a26e79932518e2c3bea2fc0e37127e4af1f02d1a5543680b5d9370365c28b8bb5427b3bb4f27eb12737d158490216ff77859483f95a6b00
TLSH
T189D02B316CED4C23C08CA27C0057004117517400EA1040401221504808082414281399
MD5 SHA1 SHA512 TLSH

Submit Download

18d1d204-cb33-4d89-bf5b-c958fade434c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\18d1d204-cb33-4d89-bf5b-c958fade434c.tmp
Size 29KB
SHA256 57aa57c0b1dc1b3a949e08ef993dff82f5d91d9d98f8f9f4f975482c8beb3493
MD5 840f0eb5ba829215a78964325d679f85
SHA1 249e295a3eee6af84697cf1e82f6f3c7fa3f0358
SHA512 38ab8520a14a90d60cbb53b6ce6598e7bcb2fe88dc1136f528bbc47fd06cf0333bf93a8325fdef3db529db68c220bbc31b840061fba31778cccefe81842420f6
SSDEEP 768:/jnhTC7pLuLjuJWg6cfCw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnllRkP9rosHHg:/jnhTaEjuJWg6cfCwu1jaUlliP2eHg
TLSH
T138D2DA7B740CCA7F4F804ADDEC197E9B6DA802CB9698C98047FE945C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dceab78-6c87-4046-aef4-8a09b333dd3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6dceab78-6c87-4046-aef4-8a09b333dd3a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

830be7c3-83ef-4b7a-81b1-68c33a8be6c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\830be7c3-83ef-4b7a-81b1-68c33a8be6c9.tmp
Size 12KB
SHA256 0392e339c0b851381403bd67409ed06c4cbdc58dfa5c7dc26e6ce6552a6bc016
MD5 5af45b2919ce01f0be1a77e91c4e178d
SHA1 5871e07e40729b342bcacf58d77c84c744dbdad1
SHA512 82ba160eef0ae961f462e385455520378de50bcb8044f89b42978e34c8efb6489037c31a1d4016e085d3cbed38df45fd8fade3d4ee075cb962fd749ada444c28
SSDEEP 192:sxR5RQCD/fPsULZkazoA8p9t/g6+WNCBv/YukxirGPIgDGbHJ:sxR5pD/fPsUlkXf/5M/U6p
TLSH
T1E742B755AE38693B8CCBD31DBB557F23D6FD503290911E48AAFC9A1C14EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9943c722-3c14-45a4-8026-ec927d6dd184.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9943c722-3c14-45a4-8026-ec927d6dd184.tmp
Size 11KB
SHA256 1a946265827e063d1920ae06468a6b932def36765afad2f8ecfe235090c12c75
MD5 bfdf8cf5428dfd10afb6757c361f14b9
SHA1 e96debca8297994ce6f00b42abbd9cc508e5566f
SHA512 13098038f940f5db923d2d4223f956825e3aa2bc40b23335e160b54a58d7749100c16df5635fe615bf5d1d72eff7ce4db932d25a2ee970d822f7d1f0fa9995db
SSDEEP 192:sxRORQCD/fPsCLZkazoA8p9t/g6+WNCBv/YuZxirGPIgVbHJ:sxROpD/fPsClkXf/5M/bdp
TLSH
T1E942B755AE28A93B8CCBD31DBB557F13D6FD103290D11E48AAFC9A1C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 35e030f387ad36b21cc4d6677b971fc298924dd7a7b3bbc98a06db296113dc4f
MD5 39246cc3ed9f4d6bdd943bd8e556b574
SHA1 10663e96866b226f01212f722136947f374bd651
SHA512 8142967d1103866e3231779bc3afd3f44c0080892bf645285c0d5f42e35189c0c1db407fda63c411062fb6b6f5e02deddb0fa4ae4a02a0a146fb4bcc6ae4171e
TLSH
T15441290B52B84867F78814378ECC8ED7B73CFAA094C3EE012594CCFA5E643708164704
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ce9cc6f99bd3f295f37643699bcfbfbcdc7e68959e2556db651f6a722bb6b59c
MD5 c8ac5b521cfea906e121022b1c5de9f8
SHA1 10efcf149c43e39dd4515044937ca8a167e19274
SHA512 5e19978361bb489b274c6bc50808cdaf6d24d30fff29c7cefb09864e40b7f672193aba31269f05c4f2a6c87d034130ffcf5b3ee9f12a706f9fb3f543b3318773
TLSH
T17341F84B12B8486BF79854378ECC8ED7B63CFAA190C3EE112594CDFA5E6537081A4704
MD5 SHA1 SHA512 TLSH

Submit Download

ae08a3e7-49cb-49f4-b070-1f55f4bb22e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ae08a3e7-49cb-49f4-b070-1f55f4bb22e2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

2d245c60-4c3b-4ff0-ad42-490954008c30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d245c60-4c3b-4ff0-ad42-490954008c30.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b3306288-4778-4ea7-b91f-156af1344a35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3306288-4778-4ea7-b91f-156af1344a35.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

fb64defc-b2c7-410b-b02d-a1f72f24d68d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb64defc-b2c7-410b-b02d-a1f72f24d68d.tmp
Size 2KB
SHA256 5a7a3a839d9cfb41b6c66be7b2668f8c0e2e9b79dc99f76bff1427c11c02fea4
MD5 33712fd79b13f316890c2e03ee6b6bd3
SHA1 8f760e482f1937053605ad1126b5574ffb599adf
SHA512 1b80a8643f2338dea2895f8c12c4b0dba123a29d091258a124c5f0deebea4fb80cc5d6e80bfa5688acb0be3a11ddd8cebf902bc6fb4965b9d8de4f80b84f0456
TLSH
T119518EF3C7E8856D8A0156F4AB186E1FCE1D0914432C7D5A88E49F1B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4a75d173b62a64e883c779139a813c3653ff0cf60e8d178088f2d3e52d9096de
MD5 548099776d22f9da3fd56f9b12dd7bd5
SHA1 32b5e37c5039b51c5b246f668a2c4e8b2952de86
SHA512 2556de848806e1780407948ea4e8e2f8cdd0504837392f18f0fe6462c96a6dcdc307c2d24c23e677f14e1e2303226744217ab71cbe097a07d65f8ff2835d2398
SSDEEP 48:KgbIhKU48/yBEIzKRy8CBIlKi4o/ypOIHKDqIV:KgbeKU4uiEIKRyHByKi4qaOUKDqW
TLSH
T11FB1212031765220387E391852F8BB9B465231733014E92F7BED46D6DA3AF198DFE5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db518770-7bd6-4ef3-9ca7-cedead3500f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db518770-7bd6-4ef3-9ca7-cedead3500f8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0dd0d8d-6485-408d-83d9-7b8d584a0afe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0dd0d8d-6485-408d-83d9-7b8d584a0afe.tmp
Size 11KB
SHA256 f6c84cf93cc8a600c83c8aa737a5cf2b83137638ba0ab8c047dee182593c92db
MD5 67071aa68f4b4d30012bc44c37992b1c
SHA1 d6044d49196974f1535e871b258e15f0e1220e7e
SHA512 7ce86f37a215bcd83cda2923c93144197153c240276631ed9a3ff5b7e5cb33ef11256802829e18daa0c4de00630b4886ebd3ea16e2e70d1ed992d759187720ef
SSDEEP 192:sxR5RQCD/fPsJLZkazoA8p9t/g6+WNCBv/YuZxirGPIgDkbHJ:sxR5pD/fPsJlkXf/5M/b8p
TLSH
T17442B855AE38A93B8CCBD31DBB557F53D6FD103290911E48AAFC9A1C14EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a16eace-4279-45ca-8f47-39c774e280a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7a16eace-4279-45ca-8f47-39c774e280a1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

5e008e69-c4a2-44b5-b66c-255c32ea8cc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\5e008e69-c4a2-44b5-b66c-255c32ea8cc7.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

9004c87a-ae98-453c-a2b7-39d8248bd8bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9004c87a-ae98-453c-a2b7-39d8248bd8bf.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

bfa76ffd-442e-471a-8e4b-532c00f82b41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bfa76ffd-442e-471a-8e4b-532c00f82b41.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4694dd6d-16c1-4fcd-8f91-b03ef04ee563.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4694dd6d-16c1-4fcd-8f91-b03ef04ee563.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

eb2e2ae3-6103-4442-8027-6c94788b2f72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb2e2ae3-6103-4442-8027-6c94788b2f72.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

6d43ebe2-d123-42e4-8d01-6ca80a4a6227.tmp

Path C:\Users\Admin\AppData\Local\Temp\6d43ebe2-d123-42e4-8d01-6ca80a4a6227.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e36c5ca-b163-4a8f-9633-8c2e9390b269.tmp

Path C:\Users\Admin\AppData\Local\Temp\8e36c5ca-b163-4a8f-9633-8c2e9390b269.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3416_15252758\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3416_1548740431\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1299692958\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1380759276\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_1554123494\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3416_328652548\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/476-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/752-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/924-620-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/992-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2632-608-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-734-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-712-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3112-577-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-578-0x00000000007E0000-0x000000000081D000-memory.dmp

Download

memory/3292-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-686-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4256-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4560-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5324-754-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5428-716-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5472-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5992-633-0x0000000000010000-0x0000000000083000-memory.dmp

Download