f3ec6ccb11082a62dca3364df5aba6b8d0e616b0dc75e05e475422683766e975

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe
Size 243KB
Sample261104-wqbzpsev3m
SHA256 f3ec6ccb11082a62dca3364df5aba6b8d0e616b0dc75e05e475422683766e975
MD5 694b788eb45dbf196f8f856ff957ac39
SHA1 7e4f9e3aad596ce3b6d4f93bb29bea4e9ebae0f3
SHA512 f295bdc361a99cbdde66b3d9456c88b84d28bb7aa29dd698a507ac99f91ac6082ec241a4e42e5e0987a29a117bad626c9ae14ee99eb19e12da95f328183a85e9
SSDEEP 3072:BVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:zXP7LQMa3lLNngoqRttA7c
TLSH
T1D4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3472	CP.exe
5864	qolgdywqoj.exe
6012	CP.exe
5552	CP.exe
3900	i_qolgdywqoj.exe
1128	yvtnlfdyvq.sys
4244	CP.exe
4636	oigaysqkid.exe
4116	CP.exe
1560	CP.exe
3492	i_oigaysqkid.exe
3744	kigaysqkif.sys
1140	CP.exe
2724	ifayspnifd.exe
2100	CP.exe
1408	CP.exe
3048	i_ifayspnifd.exe
4272	ifaxsqkica.sys
3112	CP.exe
5260	xusnkfdxvp.exe
4176	CP.exe
2252	CP.exe
4168	i_xusnkfdxvp.exe
1196	hczusmkecz.sys
5844	CP.exe
3008	causmkeczu.exe
1680	CP.exe
4936	CP.exe
2784	i_causmkeczu.exe
3220	hczxrpjhfz.sys
2628	CP.exe
4272	zxuomkebzx.exe
1700	CP.exe
2556	CP.exe
3420	i_zxuomkebzx.exe
4932	jgezwrpjhb.sys
2388	CP.exe
2424	jgezwrpjhb.exe
1704	CP.exe
5816	CP.exe
4924	i_jgezwrpjhb.exe
1192	ljebwuoljd.sys
200	CP.exe
1592	ojhbztrlje.exe
1952	CP.exe
4336	CP.exe
3796	i_ojhbztrlje.exe
432	troiytqolg.sys
5044	CP.exe
5188	dbvtoljdby.exe
5300	CP.exe
1860	CP.exe
5148	i_dbvtoljdby.exe
2124	igbytqliga.sys
3292	CP.exe
3632	dynlidavtn.exe
4924	CP.exe
2172	CP.exe
696	i_dynlidavtn.exe
4428	avsqligays.sys
3492	CP.exe
6100	ysqkidavsn.exe
3488	CP.exe
4480	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_166180307\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2086596517\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_163559547\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_163559547\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_166180307\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3952_1141358749\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2086596517\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_532225980\_locales\ne\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxuomkebzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dynlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dynlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxuomkebzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifayspnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifayspnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbywqolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
4168	ipconfig.exe
4572	ipconfig.exe
5508	ipconfig.exe
1128	ipconfig.exe
3412	ipconfig.exe
2716	ipconfig.exe
4596	ipconfig.exe
1696	ipconfig.exe
4764	ipconfig.exe
3720	ipconfig.exe
3720	ipconfig.exe
5932	ipconfig.exe
2536	ipconfig.exe
3484	ipconfig.exe
4512	ipconfig.exe
1212	ipconfig.exe
3900	ipconfig.exe
2248	ipconfig.exe
4788	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{3CDCE085-B5F3-41B9-B25D-1A149D62C1ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	i_qolgdywqoj.exe
Token: SeDebugPrivilege	3492	i_oigaysqkid.exe
Token: SeDebugPrivilege	3048	i_ifayspnifd.exe
Token: SeDebugPrivilege	4168	i_xusnkfdxvp.exe
Token: SeDebugPrivilege	2784	i_causmkeczu.exe
Token: SeDebugPrivilege	3420	i_zxuomkebzx.exe
Token: SeDebugPrivilege	4924	i_jgezwrpjhb.exe
Token: SeDebugPrivilege	3796	i_ojhbztrlje.exe
Token: SeDebugPrivilege	5148	i_dbvtoljdby.exe
Token: SeDebugPrivilege	696	i_dynlidavtn.exe
Token: SeDebugPrivilege	5420	i_ysqkidavsn.exe
Token: SeDebugPrivilege	2124	i_ysqkicaxvp.exe
Token: SeDebugPrivilege	1220	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	6108	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	5192	i_zurpjheczu.exe
Token: SeDebugPrivilege	4752	i_ztrpjhbztr.exe
Token: SeDebugPrivilege	2788	i_bvtolgeywt.exe
Token: SeDebugPrivilege	2264	i_jdbywqolgd.exe
Token: SeDebugPrivilege	4220	i_igdyvqoiga.exe
Token: SeDebugPrivilege	2560	i_lfdxvqniga.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 5628	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	89
PID 5628 wrote to memory of 3952	5628	iexplore.exe	90
PID 3952 wrote to memory of 4692	3952	msedge.exe	91
PID 3952 wrote to memory of 1740	3952	msedge.exe	92
PID 3952 wrote to memory of 6112	3952	msedge.exe	93
PID 3952 wrote to memory of 1740	3952	msedge.exe	92
PID 3952 wrote to memory of 1740	3952	msedge.exe	92
PID 3952 wrote to memory of 1188	3952	msedge.exe	94
PID 3952 wrote to memory of 1188	3952	msedge.exe	94
PID 3952 wrote to memory of 2824	3952	msedge.exe	96
PID 3952 wrote to memory of 2824	3952	msedge.exe	96
PID 3952 wrote to memory of 4316	3952	msedge.exe	97
PID 3952 wrote to memory of 2824	3952	msedge.exe	96
PID 3952 wrote to memory of 4316	3952	msedge.exe	97
PID 3952 wrote to memory of 4316	3952	msedge.exe	97
PID 3952 wrote to memory of 1276	3952	msedge.exe	98
PID 3952 wrote to memory of 3668	3952	msedge.exe	99
PID 3952 wrote to memory of 1276	3952	msedge.exe	98
PID 3952 wrote to memory of 1276	3952	msedge.exe	98
PID 3952 wrote to memory of 3668	3952	msedge.exe	99
PID 3952 wrote to memory of 3668	3952	msedge.exe	99
PID 3952 wrote to memory of 4612	3952	msedge.exe	100
PID 3952 wrote to memory of 4612	3952	msedge.exe	100
PID 3952 wrote to memory of 4612	3952	msedge.exe	100
PID 3952 wrote to memory of 4872	3952	msedge.exe	102
PID 3952 wrote to memory of 4872	3952	msedge.exe	102
PID 3952 wrote to memory of 4876	3952	msedge.exe	103
PID 3952 wrote to memory of 4876	3952	msedge.exe	103
PID 3952 wrote to memory of 4876	3952	msedge.exe	103
PID 3952 wrote to memory of 4120	3952	msedge.exe	104
PID 3952 wrote to memory of 4120	3952	msedge.exe	104
PID 3952 wrote to memory of 5420	3952	msedge.exe	105
PID 3952 wrote to memory of 5420	3952	msedge.exe	105
PID 436 wrote to memory of 3472	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	106
PID 3952 wrote to memory of 4336	3952	msedge.exe	109
PID 5864 wrote to memory of 6012	5864	qolgdywqoj.exe	111
PID 3952 wrote to memory of 3436	3952	msedge.exe	114
PID 3952 wrote to memory of 3436	3952	msedge.exe	114
PID 3952 wrote to memory of 3012	3952	msedge.exe	115
PID 3952 wrote to memory of 3012	3952	msedge.exe	115
PID 3952 wrote to memory of 1164	3952	msedge.exe	118
PID 3952 wrote to memory of 1164	3952	msedge.exe	118
PID 3952 wrote to memory of 1212	3952	msedge.exe	119
PID 3952 wrote to memory of 1212	3952	msedge.exe	119
PID 436 wrote to memory of 5552	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	120
PID 3952 wrote to memory of 2308	3952	msedge.exe	122
PID 3952 wrote to memory of 2308	3952	msedge.exe	122
PID 3952 wrote to memory of 2308	3952	msedge.exe	122
PID 3952 wrote to memory of 1556	3952	msedge.exe	125
PID 3952 wrote to memory of 1556	3952	msedge.exe	125
PID 3952 wrote to memory of 1556	3952	msedge.exe	125
PID 436 wrote to memory of 4244	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	126
PID 4636 wrote to memory of 4116	4636	oigaysqkid.exe	128
PID 436 wrote to memory of 1560	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	131
PID 436 wrote to memory of 1140	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	135
PID 2724 wrote to memory of 2100	2724	ifayspnifd.exe	137
PID 436 wrote to memory of 1408	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	140
PID 436 wrote to memory of 3112	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	144
PID 5260 wrote to memory of 4176	5260	xusnkfdxvp.exe	146
PID 436 wrote to memory of 2252	436	2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe	149
PID 3952 wrote to memory of 1592	3952	msedge.exe	152
PID 3952 wrote to memory of 5788	3952	msedge.exe	153
PID 3952 wrote to memory of 4488	3952	msedge.exe	154
PID 3952 wrote to memory of 4292	3952	msedge.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_694b788eb45dbf196f8f856ff957ac39_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffb3bf5c188,0x7ffb3bf5c194,0x7ffb3bf5c1a0
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,14875416602921245309,1905193425619002097,262144 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15849908737440882812,5127156063842927231,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,18328197100516668965,17945675141187728,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,16294223596981734257,13778291206505418657,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,660399026615796015,1283782488511003203,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,14534352068234656407,7607997209939850349,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,5105780555356943201,12565748614219338291,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:9
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3760,i,4009409885316156983,1646298665640041366,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,5352753014522134539,1544576190139489843,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3732,i,14658734693791054082,9870979726186889599,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,11279242615565092736,9300645748266549712,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,12771721246471982003,13523864767376820302,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10916310441503979608,2809600354759743370,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10916310441503979608,2809600354759743370,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,8384074760750469568,12071349446522825744,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,13529785022673538750,8010177348735137814,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,7626317019035410461,15610143375262336138,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,11657105620528924127,17654977452054518432,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6532,i,17421608492197190901,11159525267932668859,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6380,i,9098059359925723371,5475197381516304662,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6522593131327130393,2216329261999082912,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,6392986609625953756,7336767895788113481,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,14980453377056515210,12396129570618617651,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3844,i,7208435710441978379,17012635385614546673,2097152 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,16868240233805880571,17955926809000654486,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,9276594323642614124,9957854244710155587,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,42454032658501072,14344619534549590930,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7024,i,10287296248845566143,698779769284355221,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3516,i,5017701324005024689,16183865587397139271,262144 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,15926599477490137736,11737182266182434356,524288 --field-trial-handle=2336,i,4929394976480733524,14376533829693601379,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:14
      4⤵
      PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qolgdywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3472
- - C:\Temp\qolgdywqoj.exe
    C:\Temp\qolgdywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qolgdywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5552
- - C:\Temp\i_qolgdywqoj.exe
    C:\Temp\i_qolgdywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Temp\oigaysqkid.exe
    C:\Temp\oigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1560
- - C:\Temp\i_oigaysqkid.exe
    C:\Temp\i_oigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifayspnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1140
- - C:\Temp\ifayspnifd.exe
    C:\Temp\ifayspnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifayspnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1408
- - C:\Temp\i_ifayspnifd.exe
    C:\Temp\i_ifayspnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3112
- - C:\Temp\xusnkfdxvp.exe
    C:\Temp\xusnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Temp\i_xusnkfdxvp.exe
    C:\Temp\i_xusnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkeczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5844
- - C:\Temp\causmkeczu.exe
    C:\Temp\causmkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkeczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4936
- - C:\Temp\i_causmkeczu.exe
    C:\Temp\i_causmkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxuomkebzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\zxuomkebzx.exe
    C:\Temp\zxuomkebzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxuomkebzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\i_zxuomkebzx.exe
    C:\Temp\i_zxuomkebzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgezwrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\jgezwrpjhb.exe
    C:\Temp\jgezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgezwrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5816
- - C:\Temp\i_jgezwrpjhb.exe
    C:\Temp\i_jgezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4336
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtoljdby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\dbvtoljdby.exe
    C:\Temp\dbvtoljdby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtoljdby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\i_dbvtoljdby.exe
    C:\Temp\i_dbvtoljdby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dynlidavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3292
- - C:\Temp\dynlidavtn.exe
    C:\Temp\dynlidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dynlidavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2172
- - C:\Temp\i_dynlidavtn.exe
    C:\Temp\i_dynlidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3492
- - C:\Temp\ysqkidavsn.exe
    C:\Temp\ysqkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Temp\i_ysqkidavsn.exe
    C:\Temp\i_ysqkidavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicaxvp.exe ups_run
  2⤵
  PID:1212
- - C:\Temp\ysqkicaxvp.exe
    C:\Temp\ysqkicaxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicaxvp.exe ups_ins
  2⤵
  PID:4932
- - C:\Temp\i_ysqkicaxvp.exe
    C:\Temp\i_ysqkicaxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  PID:4488
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  PID:3496
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  PID:1196
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  PID:3856
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpjheczu.exe ups_run
  2⤵
  PID:264
- - C:\Temp\zurpjheczu.exe
    C:\Temp\zurpjheczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpjheczu.exe ups_ins
  2⤵
  PID:4616
- - C:\Temp\i_zurpjheczu.exe
    C:\Temp\i_zurpjheczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrpjhbztr.exe ups_run
  2⤵
  PID:3908
- - C:\Temp\ztrpjhbztr.exe
    C:\Temp\ztrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrpjhbztr.exe ups_ins
  2⤵
  PID:2488
- - C:\Temp\i_ztrpjhbztr.exe
    C:\Temp\i_ztrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgeywt.exe ups_run
  2⤵
  PID:4984
- - C:\Temp\bvtolgeywt.exe
    C:\Temp\bvtolgeywt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgeywt.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_bvtolgeywt.exe
    C:\Temp\i_bvtolgeywt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbywqolgd.exe ups_run
  2⤵
  PID:4744
- - C:\Temp\jdbywqolgd.exe
    C:\Temp\jdbywqolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbywqolgd.exe ups_ins
  2⤵
  PID:1528
- - C:\Temp\i_jdbywqolgd.exe
    C:\Temp\i_jdbywqolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdyvqoiga.exe ups_run
  2⤵
  PID:3228
- - C:\Temp\igdyvqoiga.exe
    C:\Temp\igdyvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdyvqoiga.exe ups_ins
  2⤵
  PID:3524
- - C:\Temp\i_igdyvqoiga.exe
    C:\Temp\i_igdyvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  PID:4980
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  PID:5528
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3732

C:\Temp\yvtnlfdyvq.sys
C:\Temp\yvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\kigaysqkif.sys
C:\Temp\kigaysqkif.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\hczusmkecz.sys
C:\Temp\hczusmkecz.sys
1⤵
- Executes dropped EXE
PID:1196

C:\Temp\hczxrpjhfz.sys
C:\Temp\hczxrpjhfz.sys
1⤵
- Executes dropped EXE
PID:3220

C:\Temp\jgezwrpjhb.sys
C:\Temp\jgezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\ljebwuoljd.sys
C:\Temp\ljebwuoljd.sys
1⤵
- Executes dropped EXE
PID:1192

C:\Temp\troiytqolg.sys
C:\Temp\troiytqolg.sys
1⤵
- Executes dropped EXE
PID:432

C:\Temp\igbytqliga.sys
C:\Temp\igbytqliga.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\avsqligays.sys
C:\Temp\avsqligays.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\vpnifaxvsn.sys
C:\Temp\vpnifaxvsn.sys
1⤵
PID:4280

C:\Temp\causpkhfvs.sys
C:\Temp\causpkhfvs.sys
1⤵
PID:5440

C:\Temp\hfzxspkhcz.sys
C:\Temp\hfzxspkhcz.sys
1⤵
PID:3248

C:\Temp\urmkeczurm.sys
C:\Temp\urmkeczurm.sys
1⤵
PID:5548

C:\Temp\bztrojgeyw.sys
C:\Temp\bztrojgeyw.sys
1⤵
PID:2092

C:\Temp\omjebwtomg.sys
C:\Temp\omjebwtomg.sys
1⤵
PID:2816

C:\Temp\lgeywqolge.sys
C:\Temp\lgeywqolge.sys
1⤵
PID:5904

C:\Temp\igdyvqnigd.sys
C:\Temp\igdyvqnigd.sys
1⤵
PID:1684

C:\Temp\igayvpnlfd.sys
C:\Temp\igayvpnlfd.sys
1⤵
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkeczu.exe

Path C:\Temp\causmkeczu.exe
Size 243KB
SHA256 29f1364304e9ea680fe7ba46bf0fec687e00e3089e71f98c494e3703ce5be686
MD5 2fda9707524f4044f53c6382101c7ab8
SHA1 c268df4b729209d4b879249d163b1f54bed745d2
SHA512 8e1582c84fe5ea13307f9eb66dac7438ec77d986866966f00d94394e1d941d03a68f02115fe560ae6c3870c27ab37d67eef7429dbe85b7769613f1c5890ad90b
SSDEEP 3072:CVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:CXP7LQMa3lLNngoqRttA77
TLSH
T1BE345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecz.sys

Path C:\Temp\hczusmkecz.sys
Size 141KB
SHA256 70dd352c8e4230792bb23ecf3b4b2dd458d662dd6a8be3ac5d46e5065842a523
MD5 27d4621b14c8b35c35f04e1deefa120a
SHA1 bc0367df34ac46208d64506fec04f6abc8d16e4d
SHA512 d32762c3024b707ed5ed22e664762f7bd0d7db6a7e9b9537c2375516f5c9d00e3e6c9267ada445baef37be7be430843dbae2b6b1759ffe7c867b1b7243dc7369
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T188E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxrpjhfz.sys

Path C:\Temp\hczxrpjhfz.sys
Size 141KB
SHA256 c7ae4fa5abd8671f09b0d97afd17e478d196ff6bd433aa68c6fcc714d1f49ca0
MD5 f5bc9a4591f28dd16eaa3aaa838f9bd6
SHA1 54eb9b1c4f634c29594d19720ea1c0686e694be0
SHA512 3750cad3f73744cdc86d690141191098f48d3e26f35c50e4bce3cbb5d78d9ee16a3ed59bccf55015e5370e1f9aebc36fa2ddcb717dda839a7d5a826f26438e9b
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkeczu.exe

Path C:\Temp\i_causmkeczu.exe
Size 243KB
SHA256 c6aae7521ee48bb8a9013c435625a4613d5d1b6a82923e7bde3ea6f6aeb28887
MD5 8281a4dcee5208c05488a9e3d6b6aa2e
SHA1 c23c0945af99937123bfe0f49e412dc3a8687327
SHA512 3c1c997d5cb5398e9fd939d29757ce51fc3838f18716e983ff3be2b69f5c104ef702f1ccd2d3d087998534899371892eb5ee0b8dd069c36bfd2a23b68cae3a7f
SSDEEP 3072:jVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:xXP7LQMa3lLNngoqRttA7m
TLSH
T181345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifayspnifd.exe

Path C:\Temp\i_ifayspnifd.exe
Size 243KB
SHA256 8c3b00d98d30ccd8d64d39e34ef7bd825501d30a8e14c710cb12b46e393a86dd
MD5 de84689b177302ca5d34a75dfd377a0c
SHA1 7ee2b900cb198a055fb7b3101564889915c4ac5c
SHA512 336b9a75924a61dd17c870ce7cf3600c50b60ce844db9e82e6bf77dbd41db2a25cec10a7b3c2abd6fdb4be92c7133b2ef995c82f86f5438e30d99870f49dde87
SSDEEP 3072:sVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:IXP7LQMa3lLNngoqRttA7t
TLSH
T191345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqkid.exe

Path C:\Temp\i_oigaysqkid.exe
Size 243KB
SHA256 3e117626d7c246d9eb72fbe9f77f8547963f50bd3aab6851c2ae7925136c1816
MD5 706a6934528e9f81a550edf52bed5075
SHA1 2c144601f9ce683bd2dd9c00d74295cae717fe17
SHA512 c3449fe2232ab161c2bca197f78c7bee1fc005941fdc751231432a4ef6a0a561487ef9febc555e40f8a396f972b4ce8d6d94a84e309419dfe63b9f836802cbad
SSDEEP 3072:3VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:lXP7LQMa3lLNngoqRttA7O
TLSH
T1B2345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgdywqoj.exe

Path C:\Temp\i_qolgdywqoj.exe
Size 243KB
SHA256 6aa4edf95505362b75b4fb6b3f45448b1ef0ea4bc0bcc78af0ac5ad2c7b58615
MD5 3bbda913d3bde68a9c00903a91d6abcc
SHA1 db2d286bb2c98c60b1d3e9d2eff1d43766481f08
SHA512 91b42b91a088812dffe5588042d6ddb82e080a9a8c79c243bd32da33736af49a32fd6eca2e9cbcd4f57629451706e50ec1184810a510c72a4cfeb406ab7b5bb5
SSDEEP 3072:+VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:uXP7LQMa3lLNngoqRttA7r
TLSH
T198345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusnkfdxvp.exe

Path C:\Temp\i_xusnkfdxvp.exe
Size 243KB
SHA256 c10f4d617702cc29c0590d1bd08a8e94ea2ff79bc279e7c18a8204318c1f274a
MD5 1d3d5aa8d9a286c457d604bd1e5a1b81
SHA1 8d06e74546b89c56fc8644bbac7a65f8168a9bdb
SHA512 f625968d9b85e9649974f252cd13459b475657c8ff0a036677a0c323db2556db893c14f57e4f98a546ec15971f2238f3d2dc4217d7a73d5fb1a50d8c31d78b6b
SSDEEP 3072:OVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:+XP7LQMa3lLNngoqRttA7j
TLSH
T145345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.sys

Path C:\Temp\ifaxsqkica.sys
Size 141KB
SHA256 e0ab511fc66e7d89f0631bb967c6d036c62a467232a0d306a8e8f8b9a38ef907
MD5 b12488688481fbc36bc5b21eaa919877
SHA1 fa62657a7c5de17e9582671cb18876cb37bc2e8e
SHA512 41833ba883d96aeec322d875d4433d3576fc4ca1d3e3a92b5ba261fc865d8de7c6d94433fafe31f9021720f17580ab3b60ff0eaac9626b573ba4688b7ff07aa8
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T177E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifayspnifd.exe

Path C:\Temp\ifayspnifd.exe
Size 243KB
SHA256 905d9e3513874470095e9e1a65923a6e0e0dd45da80a274237f2387193eb55ec
MD5 bd8255edc6847e5f9f503189d91d0419
SHA1 cd2fbeca0a2eaea70f54ccb01dea97d67e7e5cda
SHA512 a3e7ac586587e2ec5eaa7032759872bf51d73e5064fff67696710e81acdc267f9c635fadf332a4a5b2cb83b81c0776d77049d5263e5385a14f125fba6e61449b
SSDEEP 3072:uVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:eXP7LQMa3lLNngoqRttA7b
TLSH
T141345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqkif.sys

Path C:\Temp\kigaysqkif.sys
Size 141KB
SHA256 fb1715a60d591e013c37601acfa34b5b6ef452ade089f4e5381f105e48df8146
MD5 d1724479e76f42116830ca85ca8ad145
SHA1 81a1c95b6aa2d598f98ed78020e4f53ea75a6db0
SHA512 3303bcd0b5b5cb81cf4107a116249a0903187cf62b8efa1727a025936c8782705653c08dc7474db14f66cfbaf36e8bae0c3859581774f1a705ca7f12adb87260
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqkid.exe

Path C:\Temp\oigaysqkid.exe
Size 243KB
SHA256 a953d3c176e471872c919a2fdcaeb16d1cfec03a88acf04d890be3ecb3737dcc
MD5 9559eb9cb279f6e81110bc66e23253f8
SHA1 f57e93bc49f89a8a5cb574f4c515df06d1be0351
SHA512 77f3210bafca7b5c86c796ee4ca77159b3b4fcb26e81226b56ad0baa97115414733af39949fe442d1cc5967fb7a91bed0a5e2d8b4d7953375404577df1c9f040
SSDEEP 3072:SVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:SXP7LQMa3lLNngoqRttA7z
TLSH
T1D6345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdywqoj.exe

Path C:\Temp\qolgdywqoj.exe
Size 243KB
SHA256 c741da8d6dc94f6e2fe1f4cb11879263974721df656998e339ab32541c304c5b
MD5 0ad7ea63184bfd23a34cb9b5de2ef3a2
SHA1 7cec66c2387dfc6def0d350ee0c39dff1810d431
SHA512 862e574fb0884ddf871b28fedd2b7e2f04241b5dd7d012eac68238fe5febe760fc89a96efba91b85f1f005ba9aefe7f889e069c9eff8a822c6c4f6a3e74fb371
SSDEEP 3072:xVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Ct:jXP7LQMa3lLNngoqRttA7o
TLSH
T136345A0172818031E7560B78046AE7A1467E7C384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkfdxvp.exe

Path C:\Temp\xusnkfdxvp.exe
Size 243KB
SHA256 f799fed608e1094b86b1d0e7c27745dd750f0a60226e36d97cf99d2f0ff7c883
MD5 5df489927ddcebe55a8aa46a19e49044
SHA1 79f919eade9167735fd72955697d5e816630e84b
SHA512 1f41d3e784e958c7be865784970a98e4c53e4faaff05580f126a46f84f7f10cb623fbf8f2e396549f2cf1b1cd7bbb30a3287cfd8b4a2719446fbde7e61496e31
SSDEEP 3072:SVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:SXP7LQMa3lLNngoqRttA7v
TLSH
T1B9345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvq.sys

Path C:\Temp\yvtnlfdyvq.sys
Size 141KB
SHA256 07f59f06724f521b338256eab0c0685786e9b7e77913b10303cd1921889c70c1
MD5 121b82f07fb798c06e1f9972be2441c8
SHA1 c9c323dbdfe8dad347dfc2a0951dc1395009a4c5
SHA512 158a7d6b30801565947b9830f4bd5e5dc83940ac3eb1cb3bdafa32b7f855ddd46f5fdb9b5bb01a237f059a022e575821d449955c036e248ffcf4b0bff6996cdb
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T143E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31b35cdf-2951-4688-9561-8959b18b0f12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31b35cdf-2951-4688-9561-8959b18b0f12.tmp
Size 33KB
SHA256 f9b09f60b079bcb79aa5461e0d4842593e728ee6a0c34959e5b89a345385d105
MD5 bf3c0d4b6fbb6546beb643a269f60092
SHA1 705a7418e55a422809ec34bcbf0a7560677715a2
SHA512 49cd6b7ad98800de7a9758e8ad44694d8574fea6f7304001bcb3ccc1e2436fb38c3b16fd5a312a57d66c2afb4a9969146e2c1893b333e9da561a5ac9de224201
SSDEEP 768:lF3PCm+RxybNbAREztyOeRFZD1fTos7RjJE75ErLLd:lF3PCm+roY1fT/RNkeLp
TLSH
T1E3F2AF35B8E49D334CF6E245F2093A87BEF061A3CDD94984D5D95E1E04C7B9E234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54e5ce26-c94b-409c-9453-ebfe53fd6e57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54e5ce26-c94b-409c-9453-ebfe53fd6e57.tmp
Size 33KB
SHA256 db0dae8af011af13f175ad8d07055ccedf1978a7e66889689c1b7c171f6cbea1
MD5 51722d6feca522e8c4e9fd882d47b50b
SHA1 b65e3110f87ddbe35060cc8b61584b8435c4aad1
SHA512 121bdd7c37d3a07f71cfc761d18e882e1fa049ae7a72dae1e97c3986f30d4f49566a853add0d8895e5138a21a6e608927882c48533c20bb633a5cb30b4cde5b3
SSDEEP 768:AF3uCmhRxybNbAREztUOeRFZD1fTos7RjJE75ErLLd:AF3uCmhrWY1fT/RNkeLp
TLSH
T1C5F2AF35F8E49D334CF6E245F2493A87BEF061A3C9D90984D5D95E1E04C7B9E234B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

860034f6-8484-4d8a-a811-8f49b0b17d0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\860034f6-8484-4d8a-a811-8f49b0b17d0a.tmp
Size 37KB
SHA256 9c76c2a64239e4958b56e23408e3a6d072d15a2078c9468bee5de380a62bad59
MD5 c233532e87e59f1b6f8e41f5d940417f
SHA1 08e7f48d774d4dc3c1d3824eb488ec14752ddc0c
SHA512 b0efef6cb005f2db6fc568a82c76e96f63dabaf0f30bc8e8b9e8a8ef95c4661498c51a08ea501b94d04c303fa0cdc9c2298b684ae13422153379fa0d3bcb5d59
SSDEEP 768:z/UxvxjgC+k3UcQybNbAyOeRFZD1fTos7RzH/+Pu:GZj3+k3UnzY1fT/R7Ku
TLSH
T11303CF3AF8D46D338CF6E244B20A764BBFF055B386C91A9809ED6F0E158B79D1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9508f971-c6f1-4a31-a934-765fd4957e93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9508f971-c6f1-4a31-a934-765fd4957e93.tmp
Size 42KB
SHA256 09d4721eaa2e568a525727ba2b28d89c13af8eae6c349cdb1a4bccfdb6d3c2dd
MD5 90a3c639c2196b0c06be355f1fe09fc4
SHA1 399755b3d12f5312dc59dbe32ce1f198798f09dc
SHA512 e4422c42fc195f081bef173e81bb49220a7002e1967e31d8ce23c683092696699e13ea05bb9ae9d0c3ec5430a952369abad0138e5b3346d18c240cfe2f466b1e
SSDEEP 768:cFd83TwgTCm+KdSAREztGOeRFZD1fTos7RjJE75ErLLd:Q835Cm+3Y1fT/RNkeLp
TLSH
T1A51329F5A8D39937D8AE9743A33D3E46ADBCD163B9884884B7844D0DCC826BFD346815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

5a1bfa35-cf70-4af4-bea5-bf22970b7560.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a1bfa35-cf70-4af4-bea5-bf22970b7560.tmp
Size 29KB
SHA256 1ec8533f81f5e1c4e82c88bae63e8295f628a45612ad989e07157686d5ba145f
MD5 e8cfb125430089fc8045fc7f7de936eb
SHA1 797c519b0d27d4ce07f471fb0e3d0e9806ccc2dd
SHA512 27766813913a7e303547360fccdc1a8184a9353cb80f2e43793d6542add92e5808f6c3248394316ba5664a34a44fb4c1f7a46d23ba732cf40caa8cf46a31b537
SSDEEP 768:SzYbx+7pLuLj7UWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OV+bw8WSDroG43/:SzYbx+Ej7UWgasfA6u1jaNbwtSwp3/
TLSH
T1CCD2DA7B640CCB7F4F804ADDE91A7A9E6D6802CB96D8C98047FE941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78404f07-28c4-43e6-a93b-988dff166614.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78404f07-28c4-43e6-a93b-988dff166614.tmp
Size 11KB
SHA256 c9df11638da3b719f5ff03b67427c8684309b00d2512499a40f541bd83958eb1
MD5 52cbe70bf2f9dd3c6619d7140ca8a9ab
SHA1 956e2214f8e5eca3edf423b96f6f4a222bdfaa7b
SHA512 18d87027c9152403dcaccc74d46558ddfaae2f968d418417f158debfd7caa5f2693488a772dbb2532499b02a3886773878653101a88fce41a9f9cb1d2fa38059
SSDEEP 192:sxR3RoCG/fmsPmZfZjIzoA8p9R/g6+WNIYDo6qjGzIgVlHJ:sxR3pG/fmsPQR9v/5IaTp
TLSH
T1B632C715AE28A93B9CC7D21DFB657F53D2F92032A0D05E48B6FC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c27f4ff-c8c9-40f8-9a8f-73526cab9f19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c27f4ff-c8c9-40f8-9a8f-73526cab9f19.tmp
Size 12KB
SHA256 e4e2d33df1588fbd113dc01b62b0735dffe057f7c42334d6921a12e03acddbbe
MD5 bb9ac0c2a6034209fdba1df9648739d2
SHA1 1f5c363fa47d9a8d361a7ecf599e6d5b3b8d68a3
SHA512 21c18e628f9a302cda83610114c1dd1e1b9f105dfebdb3c591166eb99e8a156d3ea9f85a7f0a27f8c4b3e76d2ca0baf2b8c0a83d0bb7f4b136f003ee8d77b95b
SSDEEP 192:sxRgRoCG/fmsFmZfZjIzoA8p9g/g6+WNCFV/YDlyqjGzIgDdlHJ:sxRgpG/fmsFQR9G/5+/73p
TLSH
T16442C715AD28AD3B9CDBD219FB55BF17D2F92032A0C05E48B6FC8A1C15E76CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 9084f154cc348ac23ad88cf3ad34de9bbf193f30c960e77f72796a51d9c11c3d
MD5 29b97e5ee5e6ab9651b2fced2af7a8a1
SHA1 c2ce766eee5c87551ac8391b57ae6559ddc41908
SHA512 01c0c04e293fd7140d07dccaaf34b6d78e55fc1d6866e5ce2a180c8d8698dc29a1c466c47a0a9434af6e72d7f8e8e84c670601502ce2ed5eef133222cef0ee5d
TLSH
T13851A4D799E19970E3F820F09DE60387FAFC49B1DACB0D030094D5F96B1A36CA305A54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 24fdc89e70f62f310b038d6f1331e86a4bff732d4ec08f4a81b8cea450890ac7
MD5 4957a4026ebdd8d1f2cc33fce9dec7a3
SHA1 d69790c3bcc43740dd90219ad2db608a38cd84ce
SHA512 15c9534589ef8e6cec5d63832aa5496eeebec8e8ba67113d0cb609fb3638921e8ca9faedecb2217c2bfb8e71f4e35c958ae517c8f3ed6a2c1005c71cbe65f773
TLSH
T10751A3C799E19970E3F820F09DE6038BFAFC49B1DACB0E030094D5F96B1A36CA345A54
MD5 SHA1 SHA512 TLSH

Submit Download

99612b34-b8e3-4892-8eb3-b5c73d3344b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\99612b34-b8e3-4892-8eb3-b5c73d3344b1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

4750b1c6-f7da-4082-aa44-826c44b0415b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4750b1c6-f7da-4082-aa44-826c44b0415b.tmp
Size 2KB
SHA256 b8400157eccfdaab60add17eb27333d291994bf08ac74818ea66f0dbe17f98e4
MD5 4b090dbaf094b8b893283053ee206e18
SHA1 2dd36a86432af34300b3c9988da18ad298f6d45a
SHA512 7df8f86e9b80e95cf9ac5a01e50a93197590012240ce44721155e03c70e5921d3b5b80a326fcd5b56476795b98883213de54d0bd2b8d759919e77d727a0e0156
TLSH
T1FE41CEF3C3F8852D8A0186F0AB186E2FCE2D0915432C7D5688E4AE1B93E3871E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

b1dbc9ea-4712-4d0c-99cb-264f776f5f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1dbc9ea-4712-4d0c-99cb-264f776f5f6a.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

d3413a4e-1739-4cac-8fa6-07aabd893a01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d3413a4e-1739-4cac-8fa6-07aabd893a01.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

beada8b4-566f-4bf2-b30b-d89a9b3e2e1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\beada8b4-566f-4bf2-b30b-d89a9b3e2e1f.tmp
Size 11KB
SHA256 bb6879adf1438a223813afcfce91fc1218e4dd9e32b07bcc66abd5f153386dec
MD5 03002833e8f5bd955c43112a5671572f
SHA1 a491883ee0e0131080b2f0265aee3e5f58bf6aa7
SHA512 6db8742029833eba652e2bbbe681f3009bb5246e6f49ea0f891b4a44105389deb6016679bed2f76aab6f8957e577c126ceb741388b6ed42839499249aec261c4
SSDEEP 192:sxRgRoCG/fmsAmZfZjIzoA8p9R/g6+WNIYDo6qjGzIgDPlHJ:sxRgpG/fmsAQR9v/5IaJp
TLSH
T12132B715AE28AD3B9CDBD21DFB65BF57D2F92032A0905E48B6FC8A1C15E76CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1b69c2f-48dc-4646-94d5-b9aed5f22223.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1b69c2f-48dc-4646-94d5-b9aed5f22223.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b83d4875-e37b-41ee-813b-af84cd10a188.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b83d4875-e37b-41ee-813b-af84cd10a188.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5407f36-043b-4ac8-a107-4c7b8fba7372.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5407f36-043b-4ac8-a107-4c7b8fba7372.tmp
Size 38KB
SHA256 2cde400f6d5b45419cbbfd5a93366990766ec5233e1d1c8e8e1d3ce5baf9efa5
MD5 c7a8dd62a507e41a70c134a46273ff9b
SHA1 132e32c80e24fdc7ff2a897a59563624c9862b94
SHA512 a4e17bee55bf52d29912ef986f1f73c0ab8f001eeecce58da6d4a0905faddfd3c7e68afb35a21b6398860a723cb6ee15c494e6e07cbf86fb6d5b2ec108c999f7
SSDEEP 768:L/UxvxjgC+k3SVQDybNbAREzt2OeRFZD1fTos7RCJ/+Pu:+Zj3+k3SVgIY1fT/R+Ku
TLSH
T15303BF39F8A89C338CF6E245B24A778BFFF015B389C91D9849D95E0E0587B9D130B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f9efc5d-3500-4559-b669-760235627e5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\0f9efc5d-3500-4559-b669-760235627e5a.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

1971bc8f-acbc-4246-95bc-cf933e719147.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1971bc8f-acbc-4246-95bc-cf933e719147.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

405992df-dcb8-4442-a6de-7065a408ec6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\405992df-dcb8-4442-a6de-7065a408ec6c.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

bd3c3b9d-d74d-4248-8d22-c0a05e2af855.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\bd3c3b9d-d74d-4248-8d22-c0a05e2af855.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89eb2a68-6a06-41fe-ac88-c6fa40e57812.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89eb2a68-6a06-41fe-ac88-c6fa40e57812.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

10a49a2a-c275-480d-a24e-a70155ebb6b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\10a49a2a-c275-480d-a24e-a70155ebb6b3.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c0c7d1b4-3d7b-4b0b-b822-5d613e9d210e.tmp

Path C:\Users\Admin\AppData\Local\Temp\c0c7d1b4-3d7b-4b0b-b822-5d613e9d210e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3952_2134098852\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3952_757672356\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_163559547\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_166180307\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_2086596517\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_78013000\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

memory/432-571-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1192-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1196-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1684-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2092-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-607-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2816-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3220-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3248-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4272-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4280-627-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-725-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5440-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5548-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-703-0x0000000000010000-0x0000000000083000-memory.dmp

Download