54ed00aedb596c3c0bab801dd73e156f1ea75875155207b27e40ae4588d6c76c

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
Size 243KB
Sample260516-ppldesdw2z
SHA256 54ed00aedb596c3c0bab801dd73e156f1ea75875155207b27e40ae4588d6c76c
MD5 604bf8744757283259e1267bc306d532
SHA1 fd34adc85159745d8c1dae0d9f18fac6bf5b6dff
SHA512 d5e81e3f7d940ac17b844a65e956b16825cb4f3a19430651d17476a8b920c2115981438e103a1c68fbc78b2ba3a517968a22084dd55158f04bde35dd29a33446
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:uvMsLaOa3lLNngoqRttA7B
TLSH
T168345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5952	CP.exe
3592	causmkecxs.exe
572	CP.exe
244	CP.exe
5600	i_causmkecxs.exe
1328	zusmkecwup.sys
5964	CP.exe
1076	mkezurpjec.exe
5776	CP.exe
3160	CP.exe
5412	i_mkezurpjec.exe
5240	jebwuomgey.sys
6076	CP.exe
1148	wtomgeywro.exe
4840	CP.exe
560	CP.exe
4980	i_wtomgeywro.exe
3476	CP.exe
2356	qojgbytrlj.exe
5100	CP.exe
852	CP.exe
4436	i_qojgbytrlj.exe
4800	bytrlgdywq.sys
2228	CP.exe
3216	nljdbvtolg.exe
3208	CP.exe
3260	CP.exe
2960	i_nljdbvtolg.exe
4740	tnlgdywqoi.sys
2980	CP.exe
3604	idavtnlfdy.exe
4172	CP.exe
5060	CP.exe
3024	i_idavtnlfdy.exe
2716	kicavsnlfd.sys
3864	CP.exe
1900	dxvpnifaxs.exe
5600	CP.exe
5932	CP.exe
2328	i_dxvpnifaxs.exe
1160	kicavsnkfd.sys
1972	CP.exe
940	spkicaupnh.exe
1520	CP.exe
3144	CP.exe
4024	i_spkicaupnh.exe
4896	ecxvpnhfax.sys
5084	CP.exe
4660	upnhfzxrpk.exe
5900	CP.exe
4372	CP.exe
3532	i_upnhfzxrpk.exe
3564	upmhfzxrpk.sys
2076	CP.exe
3536	hecwrpjhcz.exe
4820	CP.exe
5476	CP.exe
3148	i_hecwrpjhcz.exe
5584	jhbzurmjec.sys
2624	CP.exe
2340	ywrojhbztr.exe
3612	CP.exe
5304	CP.exe
404	i_ywrojhbztr.exe

Loads dropped DLL 1 IoCs

pid	Process
3752	msedge.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_884557039\well_known_domains.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_705111888\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_705111888\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_993252133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_993252133\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_884557039\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkicxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdysnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdysnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkezurpjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkezurpjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkicxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdy.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2584	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3912	ipconfig.exe
3108	ipconfig.exe
4176	ipconfig.exe
3148	ipconfig.exe
4948	ipconfig.exe
960	ipconfig.exe
5112	ipconfig.exe
2396	ipconfig.exe
4392	ipconfig.exe
4164	ipconfig.exe
3336	ipconfig.exe
4104	ipconfig.exe
5588	ipconfig.exe
3164	ipconfig.exe
1972	ipconfig.exe
2632	ipconfig.exe
764	ipconfig.exe
1328	ipconfig.exe
5416	ipconfig.exe
4920	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31254741"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "334171025"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237764699157271"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{EBB3DA8F-6FB2-4152-B256-5D76E4C43DEC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5600	i_causmkecxs.exe
Token: SeDebugPrivilege	5412	i_mkezurpjec.exe
Token: SeDebugPrivilege	4980	i_wtomgeywro.exe
Token: SeDebugPrivilege	4436	i_qojgbytrlj.exe
Token: SeDebugPrivilege	2960	i_nljdbvtolg.exe
Token: SeDebugPrivilege	3024	i_idavtnlfdy.exe
Token: SeDebugPrivilege	2328	i_dxvpnifaxs.exe
Token: SeDebugPrivilege	4024	i_spkicaupnh.exe
Token: SeDebugPrivilege	3532	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	3148	i_hecwrpjhcz.exe
Token: SeDebugPrivilege	404	i_ywrojhbztr.exe
Token: SeDebugPrivilege	3012	i_wrojhbztom.exe
Token: SeDebugPrivilege	3672	i_ljdbwtolge.exe
Token: SeDebugPrivilege	860	i_bvtnlgdywq.exe
Token: SeDebugPrivilege	3984	i_qlfdysnlfd.exe
Token: SeDebugPrivilege	2960	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	4772	i_causmkicxu.exe
Token: SeDebugPrivilege	2444	i_xrpjhczusm.exe
Token: SeDebugPrivilege	2424	i_mhbzurmjhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5772 wrote to memory of 5432	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	80
PID 5432 wrote to memory of 3752	5432	iexplore.exe	81
PID 3752 wrote to memory of 6088	3752	msedge.exe	82
PID 3752 wrote to memory of 2584	3752	msedge.exe	83
PID 3752 wrote to memory of 4676	3752	msedge.exe	84
PID 3752 wrote to memory of 4676	3752	msedge.exe	84
PID 3752 wrote to memory of 4676	3752	msedge.exe	84
PID 3752 wrote to memory of 1132	3752	msedge.exe	86
PID 3752 wrote to memory of 1132	3752	msedge.exe	86
PID 3752 wrote to memory of 2064	3752	msedge.exe	87
PID 3752 wrote to memory of 2064	3752	msedge.exe	87
PID 3752 wrote to memory of 2064	3752	msedge.exe	87
PID 3752 wrote to memory of 492	3752	msedge.exe	88
PID 3752 wrote to memory of 492	3752	msedge.exe	88
PID 3752 wrote to memory of 492	3752	msedge.exe	88
PID 5772 wrote to memory of 5952	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	90
PID 3752 wrote to memory of 1940	3752	msedge.exe	92
PID 3752 wrote to memory of 5688	3752	msedge.exe	93
PID 3752 wrote to memory of 1940	3752	msedge.exe	92
PID 3752 wrote to memory of 5688	3752	msedge.exe	93
PID 3592 wrote to memory of 572	3592	causmkecxs.exe	95
PID 3752 wrote to memory of 1560	3752	msedge.exe	99
PID 3752 wrote to memory of 5344	3752	msedge.exe	100
PID 1560 wrote to memory of 2980	1560	msedge.exe	101
PID 5772 wrote to memory of 244	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	104
PID 5772 wrote to memory of 5964	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	108
PID 1076 wrote to memory of 5776	1076	mkezurpjec.exe	110
PID 5772 wrote to memory of 3160	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	113
PID 5772 wrote to memory of 6076	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	117
PID 1148 wrote to memory of 4840	1148	wtomgeywro.exe	119
PID 5772 wrote to memory of 560	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	122
PID 5772 wrote to memory of 3476	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	124
PID 2356 wrote to memory of 5100	2356	qojgbytrlj.exe	126
PID 5772 wrote to memory of 852	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	129
PID 3752 wrote to memory of 1244	3752	msedge.exe	131
PID 3752 wrote to memory of 1432	3752	msedge.exe	132
PID 3752 wrote to memory of 2156	3752	msedge.exe	133
PID 5772 wrote to memory of 2228	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	136
PID 3216 wrote to memory of 3208	3216	nljdbvtolg.exe	138
PID 5772 wrote to memory of 3260	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	141
PID 5772 wrote to memory of 2980	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	145
PID 3604 wrote to memory of 4172	3604	idavtnlfdy.exe	147
PID 5772 wrote to memory of 5060	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	150
PID 5772 wrote to memory of 3864	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	154
PID 1900 wrote to memory of 5600	1900	dxvpnifaxs.exe	156
PID 5772 wrote to memory of 5932	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	159
PID 5772 wrote to memory of 1972	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	163
PID 940 wrote to memory of 1520	940	spkicaupnh.exe	165
PID 5772 wrote to memory of 3144	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	168
PID 3752 wrote to memory of 1232	3752	msedge.exe	170
PID 3752 wrote to memory of 1232	3752	msedge.exe	170
PID 5772 wrote to memory of 5084	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	175
PID 4660 wrote to memory of 5900	4660	upnhfzxrpk.exe	177
PID 5772 wrote to memory of 4372	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	180
PID 5772 wrote to memory of 2076	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	184
PID 3536 wrote to memory of 4820	3536	hecwrpjhcz.exe	186
PID 5772 wrote to memory of 5476	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	189
PID 5772 wrote to memory of 2624	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	193
PID 2340 wrote to memory of 3612	2340	ywrojhbztr.exe	195
PID 5772 wrote to memory of 5304	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	198
PID 3752 wrote to memory of 1080	3752	msedge.exe	200
PID 3752 wrote to memory of 1080	3752	msedge.exe	200
PID 5772 wrote to memory of 3772	5772	2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe	203
PID 4832 wrote to memory of 4564	4832	wrojhbztom.exe	205

C:\Users\Admin\AppData\Local\Temp\2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_604bf8744757283259e1267bc306d532_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc180ec188,0x7ffc180ec194,0x7ffc180ec1a0
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15665011277708073772,1532870314846613916,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:11
      4⤵
      System Time Discovery
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12377207178431362112,4779198275956120516,262144 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,2872504723580076320,13615546075412867702,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:13
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11284545724988157446,16248753730197616167,2097152 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,14328246689829664815,3797089219764573356,2097152 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,16478354597197539507,6867426337586884479,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4781554923617707493,4552855783680898967,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,979207477097621388,11756508567309357787,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,17780134749008505305,9018873973063024866,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,979207477097621388,11756508567309357787,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,8539992990780029446,1334304736392913612,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6943287724070876640,3168590852724402937,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,6289673896597598205,11325070004923678386,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,16336539325411665402,14465947424543888748,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,10784968419825245916,17232684039943506548,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,12478014045842741565,9488101868251774834,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5096,i,12855626793645191685,2447155810467863225,262144 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,14179524025037671933,743306669734336035,524288 --field-trial-handle=2172,i,16652580904728389678,2392163071418036780,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:14
      4⤵
      PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5952
- - C:\Temp\causmkecxs.exe
    C:\Temp\causmkecxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:244
- - C:\Temp\i_causmkecxs.exe
    C:\Temp\i_causmkecxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkezurpjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\mkezurpjec.exe
    C:\Temp\mkezurpjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkezurpjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3160
- - C:\Temp\i_mkezurpjec.exe
    C:\Temp\i_mkezurpjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\wtomgeywro.exe
    C:\Temp\wtomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Temp\i_wtomgeywro.exe
    C:\Temp\i_wtomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qojgbytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\qojgbytrlj.exe
    C:\Temp\qojgbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qojgbytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:852
- - C:\Temp\i_qojgbytrlj.exe
    C:\Temp\i_qojgbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2228
- - C:\Temp\nljdbvtolg.exe
    C:\Temp\nljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3260
- - C:\Temp\i_nljdbvtolg.exe
    C:\Temp\i_nljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\idavtnlfdy.exe
    C:\Temp\idavtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\i_idavtnlfdy.exe
    C:\Temp\i_idavtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3864
- - C:\Temp\dxvpnifaxs.exe
    C:\Temp\dxvpnifaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\i_dxvpnifaxs.exe
    C:\Temp\i_dxvpnifaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicaupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Temp\spkicaupnh.exe
    C:\Temp\spkicaupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicaupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3144
- - C:\Temp\i_spkicaupnh.exe
    C:\Temp\i_spkicaupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5084
- - C:\Temp\upnhfzxrpk.exe
    C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4372
- - C:\Temp\i_upnhfzxrpk.exe
    C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\hecwrpjhcz.exe
    C:\Temp\hecwrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\i_hecwrpjhcz.exe
    C:\Temp\i_hecwrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrojhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Temp\ywrojhbztr.exe
    C:\Temp\ywrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrojhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\i_ywrojhbztr.exe
    C:\Temp\i_ywrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztom.exe ups_run
  2⤵
  PID:3772
- - C:\Temp\wrojhbztom.exe
    C:\Temp\wrojhbztom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztom.exe ups_ins
  2⤵
  PID:1816
- - C:\Temp\i_wrojhbztom.exe
    C:\Temp\i_wrojhbztom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtolge.exe ups_run
  2⤵
  PID:240
- - C:\Temp\ljdbwtolge.exe
    C:\Temp\ljdbwtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtolge.exe ups_ins
  2⤵
  PID:4488
- - C:\Temp\i_ljdbwtolge.exe
    C:\Temp\i_ljdbwtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgdywq.exe ups_run
  2⤵
  PID:1760
- - C:\Temp\bvtnlgdywq.exe
    C:\Temp\bvtnlgdywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgdywq.exe ups_ins
  2⤵
  PID:3368
- - C:\Temp\i_bvtnlgdywq.exe
    C:\Temp\i_bvtnlgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlfdysnlfd.exe ups_run
  2⤵
  PID:3564
- - C:\Temp\qlfdysnlfd.exe
    C:\Temp\qlfdysnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlfdysnlfd.exe ups_ins
  2⤵
  PID:5204
- - C:\Temp\i_qlfdysnlfd.exe
    C:\Temp\i_qlfdysnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  PID:2436
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkicxu.exe ups_run
  2⤵
  PID:4484
- - C:\Temp\causmkicxu.exe
    C:\Temp\causmkicxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkicxu.exe ups_ins
  2⤵
  PID:5184
- - C:\Temp\i_causmkicxu.exe
    C:\Temp\i_causmkicxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusm.exe ups_run
  2⤵
  PID:1492
- - C:\Temp\xrpjhczusm.exe
    C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusm.exe ups_ins
  2⤵
  PID:4256
- - C:\Temp\i_xrpjhczusm.exe
    C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzurmjhb.exe ups_run
  2⤵
  PID:1804
- - C:\Temp\mhbzurmjhb.exe
    C:\Temp\mhbzurmjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzurmjhb.exe ups_ins
  2⤵
  PID:5624
- - C:\Temp\i_mhbzurmjhb.exe
    C:\Temp\i_mhbzurmjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgezw.exe ups_run
  2⤵
  PID:5368
- - C:\Temp\ebwuomgezw.exe
    C:\Temp\ebwuomgezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgezw.exe ups_ins
  2⤵
  PID:4340
- - C:\Temp\i_ebwuomgezw.exe
    C:\Temp\i_ebwuomgezw.exe ups_ins
    3⤵
    PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5876

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:5240

C:\Temp\bytrlgdywq.sys
C:\Temp\bytrlgdywq.sys
1⤵
- Executes dropped EXE
PID:4800

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
- Executes dropped EXE
PID:4740

C:\Temp\kicavsnlfd.sys
C:\Temp\kicavsnlfd.sys
1⤵
- Executes dropped EXE
PID:2716

C:\Temp\kicavsnkfd.sys
C:\Temp\kicavsnkfd.sys
1⤵
- Executes dropped EXE
PID:1160

C:\Temp\ecxvpnhfax.sys
C:\Temp\ecxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\upmhfzxrpk.sys
C:\Temp\upmhfzxrpk.sys
1⤵
- Executes dropped EXE
PID:3564

C:\Temp\jhbzurmjec.sys
C:\Temp\jhbzurmjec.sys
1⤵
- Executes dropped EXE
PID:5584

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
PID:2408

C:\Temp\wqoigeywqo.sys
C:\Temp\wqoigeywqo.sys
1⤵
PID:5960

C:\Temp\lgaysqlidb.sys
C:\Temp\lgaysqlidb.sys
1⤵
PID:4516

C:\Temp\aysqkidbvt.sys
C:\Temp\aysqkidbvt.sys
1⤵
PID:5328

C:\Temp\xvsnlfdxvq.sys
C:\Temp\xvsnlfdxvq.sys
1⤵
PID:1932

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
PID:3420

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:2904

C:\Temp\urmkecwupm.sys
C:\Temp\urmkecwupm.sys
1⤵
PID:2204

C:\Temp\trmjebwurm.sys
C:\Temp\trmjebwurm.sys
1⤵
PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrlgdywq.sys

Path C:\Temp\bytrlgdywq.sys
Size 141KB
SHA256 b75a964bebe2eb90d41cf80fc8e2af074d0f1eec73013e3be0b8f2c2dfaf00ed
MD5 c4a45e0ab8d601ce7628796d78d545ed
SHA1 2b63f6d833670d5e16a83b696b51e7713a0167f9
SHA512 c11cd71d7986bc149ab7d2198632e3c01bce1d6dd80121b3dae5b4ddf5230dce628edecc2df85eee00ffd351bc2826e074e894748d931f8eb7f310c07b82fd8b
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecxs.exe

Path C:\Temp\causmkecxs.exe
Size 243KB
SHA256 c75cdf417f8076c9b4a5a3e801ba8fd1ef94697962a05e35ae67c2441ca1cb49
MD5 b9f3baddcb7e559b54a6b03153dd5d4d
SHA1 d5a5cd53104d4962f951ff1e883aff10a7ebd82a
SHA512 a45ed024b205d1b358f3786c0513e6542e910a942c170b4239696f346ff0be1e33be6093b47d83ff2f3ad91d5a222b3d8a94b9582796a36a63f5cc36f10e87cb
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:wvMsLaOa3lLNngoqRttA7n
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaxs.exe

Path C:\Temp\dxvpnifaxs.exe
Size 243KB
SHA256 bdf11f0d7f145feea72254b3a62163a099096d6390696a707d18028348ac0dc5
MD5 61b0a51e71527fd1c9c5b6ea3f9e5038
SHA1 a127e40567e8bff433cc40c60eb1ac79886759a5
SHA512 853d2742d1f61049a91401e379c82f8e37a449c9122467e1519c2c0200f43da896ce2d8a79a108ae8eaf225c6ac428a8d9f9a1a850809391dd316099cc3b5fb5
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:EvMsLaOa3lLNngoqRttA7L
TLSH
T15C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkecxs.exe

Path C:\Temp\i_causmkecxs.exe
Size 243KB
SHA256 66b177fceee565f8b57e2555bc10b9e5349a8c3bdc189108df491da4d55759c1
MD5 711ad1ce3c9b5fa759e55a950a27825c
SHA1 f3394a6fcd326a45802ad6c9a3df17bb416ffbc4
SHA512 3be8e5de7360c70a292a8994df4426e026fd94c08cecd47fca246fadd640096c7a7837e5006201be286754a3c6408bf58487b9162af3417c74a19bd8472151e2
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:HvMsLaOa3lLNngoqRttA7q
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idavtnlfdy.exe

Path C:\Temp\i_idavtnlfdy.exe
Size 243KB
SHA256 38d088f58626c6998e50c955bfd2767edcc317a06505d7803f94c0c6e1191bb0
MD5 8f324e7c1267a37117cb195dfe8ab544
SHA1 18d78b95e14743261a2469a6f0ed9d24c02bf0cc
SHA512 ffcce05b1b6352b66ebe760ae6c6b581da485fbeb2f3df14dc90d67d7918565b37d4cb3179cac3343645f602085c72ef2ec201933c3738f238f5c758df735cda
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:jvMsLaOa3lLNngoqRttA7S
TLSH
T1A4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkezurpjec.exe

Path C:\Temp\i_mkezurpjec.exe
Size 243KB
SHA256 789e214d86433578be3d5d705941d2deebab985b069c5bb3536b44c8586d45c2
MD5 76f403ec1f97726103e5e91a18cd170f
SHA1 afdf5862b3d9a445f648ec1983813c5b1168b9f4
SHA512 16e3069a72a8da84ab357e5a2e2fb5fa6fcfa6e9af78d9e67d159d1a9651d89fea4b5414de5e085bb4d8122c1859442a42f3804332ecd29ff004e926d12f1f02
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:avMsLaOa3lLNngoqRttA79
TLSH
T1FE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtolg.exe

Path C:\Temp\i_nljdbvtolg.exe
Size 243KB
SHA256 a19d769f6979ff9debb146d666564278ff26d73df8e4150d656b502886e4780f
MD5 d1286ac46ebf583ffe8091f6f48b62a3
SHA1 0247b0b32dd9b46263a4049ddf502622234375d7
SHA512 6c19faa64a7c5ed61ea2d4c2b46908fefc6b950993a553e5656c1ad8c94ae20147d42c5b7d8e19d89f73b0505ed60dba9358d78a4a52323567ebef2a3024dc22
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:ovMsLaOa3lLNngoqRttA7b
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgbytrlj.exe

Path C:\Temp\i_qojgbytrlj.exe
Size 243KB
SHA256 1c3ed04b998d8ef6463bd226346a4923bb361209a274f44c8468847279b61514
MD5 08c6345a843f56d18c7f55eee89d0090
SHA1 18af8f751f04065a080b2ad1f9a7099f0adcd059
SHA512 9678bc8627f2bbd9c496893b003804ae5288d46e0ada815dec4cf6e0a2f8647746c9461795a378487bdbf173aec76a4a0407fd91642b1304a69cd9da81680395
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:wvMsLaOa3lLNngoqRttA7D
TLSH
T18A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtomgeywro.exe

Path C:\Temp\i_wtomgeywro.exe
Size 243KB
SHA256 615d53a3215dad0a5e679f447d934e22857fe6a204198bf010600f111ac7cd1f
MD5 a17572f8fb68ff84d1e9ae2cf07a7837
SHA1 aa0dfc8700d93e17c3dbf0e056f2fc745ef098b0
SHA512 e67d3dc7bbf866d70e85b64c2dd1555cadf14c4731d4b8a920047b83f0bb19d730e55ffcc4ca634a61e95076ad61b8f5d4e022c2b81b62d8d6a1fa19965203ac
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:FvMsLaOa3lLNngoqRttA7w
TLSH
T128345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdy.exe

Path C:\Temp\idavtnlfdy.exe
Size 243KB
SHA256 4de997f9541de5db791cbda7c16493ed141764507aaa8f26bce2d40a17531911
MD5 bdfc29cdd6de07f51b0ba08082cb7c36
SHA1 5ea3caa907f916b0776371f17944d3ffd1def537
SHA512 114de3b6f6883065caaebd1f0c4229b3e06096c061b1ae7a28fa7320bb37145d56d14be5e212c958b58637fecec4e3f442de742f7ca09392665ebdfdbe917ae0
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:bvMsLaOa3lLNngoqRttA7i
TLSH
T15E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 141KB
SHA256 c5f9aa6ab507638fc9f6ccdac7238f4361fa9c9c4639657e8777fa136cefa8ea
MD5 9e59a00ea4a5bab208eb3a0cc1ab9ceb
SHA1 8b9402ca24770a8dc660fb3283daaf8c57e90cb9
SHA512 0053ab9d42c4c0195791c9e7ffc576e47a900fe1307c76c5c99a033a63c0b66efcd4f389422931de5dda27ecb9ad267bac786eb5841297aad2e36fbf923f68e0
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T103E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 141KB
SHA256 7e999f7bd24cd34fa83672469c5f0a9c8481515f97a63698428e47404f256cea
MD5 f21ae260dc08646c57c325d5c8007651
SHA1 75efd30ee38f9f4e7e949aecf1bd3629420ea9c0
SHA512 893beb55dbb19c35219e8895c7a8b5ba4fb83b3ecdf02e4663b3d72cd0b19114e8150f4a2b0843bd8c760eb9d651cc7a82f25c5abd065d8a7100fcd36db24ad7
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavsnlfd.sys

Path C:\Temp\kicavsnlfd.sys
Size 141KB
SHA256 14ead312be5422c3cd54e3994225904f17fcaa4f3b400784e94cea07ab2e54c6
MD5 f7516f81a098e9a3d6cd9adc40da70c9
SHA1 fde2e5e9fd54860f547d760765d5017447c12614
SHA512 8450378e4ef145c418314b2b6dfc3d5e98c002003c424337bf0745f69ccb63eb32c957174e4eb73b23e838e73b0ccdde6755f0b850271392ee83f598b4725128
SSDEEP 1536:Oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkezurpjec.exe

Path C:\Temp\mkezurpjec.exe
Size 243KB
SHA256 44ccf94f6f0283c682d435183405db4bb01500c21820f03b53c521a52cbda917
MD5 f4123caedeb96f4bfb21037996b370f2
SHA1 198866e24c6d2a18edb14610adcbb353c0bc5e0f
SHA512 b962881b877f9b0f4a00a9447039d1f68adccc543a4066ac8b26edfb7e808fc46eced64c5164a4881d182135406c2e964b995ce8a7f3f76abdc6bbb2f4f10e14
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:jvMsLaOa3lLNngoqRttA7W
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtolg.exe

Path C:\Temp\nljdbvtolg.exe
Size 243KB
SHA256 f21d7d4396ab456138477a425f149316a9b27ecbbb92247c3ccaa689af2cf40e
MD5 a0948b4387c8a6fcc4c5ae569a4417b5
SHA1 f6e260beb4fbbbe5011d49acf31a7dc26ff60f57
SHA512 a59e12ef493a4be1f178c9a61fafa76c2f0599997699b522b844f1817416b8007bc0244b2e9bcbb1a223c1dd5237ae9e4286bc9ca2717538bd352c6dcbd96a98
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:tvMsLaOa3lLNngoqRttA7w
TLSH
T1EE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbytrlj.exe

Path C:\Temp\qojgbytrlj.exe
Size 243KB
SHA256 6714d369664d586257b906e009c51a3f0baf3cf9e6cddc90c10490d8f92ea4bd
MD5 1cabe203f05a9b84bbab1bee9f404c18
SHA1 348677a0058984c07bab9f571f3891b38680826c
SHA512 456376460b17d17cf317efeb5f1e8bf8ebe1660022867c06f468fca2677a1e7a6da2f8ccccc1fd7bccc4e5680522f414816091bcfffd398782fe34d07d3e6f4c
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:ovMsLaOa3lLNngoqRttA7X
TLSH
T143345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.sys

Path C:\Temp\tnlgdywqoi.sys
Size 141KB
SHA256 a48ffd9ae234922750e9fd959142bc808c99ebdc839bda0e2e253b49cc9f55b3
MD5 dc646380b10514dccad630e785cdf2bf
SHA1 a1f11f114926d33251738f880fda83a8be8df1b7
SHA512 a9188fc28bf0620c71b83a855cd988f6e3145925415390793699d0127ab1a90a888a7f01d471f7d0ed0e0139b382eedc25863a4ec43af1e076ad88cdf9ad9afa
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C5E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywro.exe

Path C:\Temp\wtomgeywro.exe
Size 243KB
SHA256 3be6ba45919db8089b62c9d409ee6f392fcf3b6c8bddd20a43e8df5bda55833c
MD5 0a8db5f86bcc6b3cb0a5d80320097edd
SHA1 db7cc4e51af22f5d684e80cb5d04f9037b53ab9e
SHA512 f689932bebd5b6ab920fdc8c5eebc1a8efd0939b9702b6f44d75e49667807d1d6fdcf813e00fbccd85000272dbd5ae19a9395f7e596c5f69b37b3e0270840e5a
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:mvMsLaOa3lLNngoqRttA75
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.sys

Path C:\Temp\zusmkecwup.sys
Size 141KB
SHA256 8ccdff1949456a62278cc2dfbd24227386a1b0fab4b7e8dfae8d69c200766724
MD5 92665d76362ddeeaeba1b316eb44e2e1
SHA1 b5a3e8e960f30829c522fe0a01cef7a210fb1592
SHA512 6cf1b11b7ba901266637eb5225d06e355dde9a9466c31a19ac896d116b0b647ebcddbed1c2e490e1b6391d3448abfc404b0f44d76257cbbff0e974d377b54c47
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 10ee015d29741fe94af81d0a6535c5b3f782e97ad971fb734314cc5460f3ee15
MD5 af70c74fd623569a6886845df808c7b0
SHA1 7283b96e2f363cbc77f18528037083c05d35df01
SHA512 1989349535147875e0917a7a35fd2cb1e1e741f5846462d938123b7666835145a4ef31f8ab92bc28673bb22a4f5729a6332b08190fb5ceef7804d0088c45f52d
TLSH
T193E02BEACD21983B09FD271D60546745EB0413971B414A4F3B3CC1088FB163A4685C7C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1cc91920407baf006a7e1fefcf0b0b3affa8bb031413a264af5d5c950707adf0
MD5 6833e0688e3a89d763282ddd7ede3833
SHA1 93f08e402a5d890c47b2a9a0ab974843acf70243
SHA512 0c160c2b4670f779dfd45409809a3651a91ae9a839931cf8d30b98487f8a02ece884e478325d660d8e612dc5c198c0206b3097939e5f41241b89fd83be0dde1b
TLSH
T11841C1F7C3E4856DC90195F0BA18BE2BCE2D0914436C3D9AC9E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f217745d3d140a2ef9baa750cba50348429126bbd66b86c8303381d313be8b1e
MD5 9420fe216b9a898c33b8551b8fa06f92
SHA1 cfe89900a198cc08ac3ce92d9edd85790ae1c235
SHA512 777452369a058e8911fc2c6bfd515b22bedb48a79752c4f3d700c1bdebe5d66567fd216476f7f67ec30fd7ccad538487a0429c3e6f4209ac352180624a951328
SSDEEP 192:sxZrR4yMqZjK1Ml8UQoc7/fgsfFKTG5GN2BwdzodpZ7/W6+WNsu9/Y0hR34Ig5Q+:sxZrRqn7/fgsfFUei2t9/b7/5MeEh
TLSH
T1A872E9166A784977CCDBD219F955BB53D7F9157292900E48AAFCCB0C04E6AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bad82ba9802643fe509c563834ffafb12da616c2b353257dddc0a6faa247e454
MD5 f5ba490edd29d7b42e6a6ce2bee2ea97
SHA1 3a78bb2a1276d8f3b1309ad57cc04f3108b9686a
SHA512 c4c784d08b132428c5585403023e7e764a0e6dc8ffc542cecc1982bb3dcce18501e2971fd72081f9efb252dda70612c429100d239fc32a38a8fadd3e3ffa24d5
SSDEEP 192:sxZrR4yMqZjK1Ml8Mc7/fgsrBKTG5GN2BwdzodpZ7/W6+WNsu9/Y0h534Igj+OJ:sxZrR07/fgsrBUei2t9/b7/5Uj+a
TLSH
T1C862D8066A684977CCD7D319FA55BB53D6F9157292904E48AAFCCB0C04E6AEC2213C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 4585fd2262cc468dbad8f5b17018ce206008fae872da51ac210d980e2995d6c9
MD5 a6684a3bd61d741a7fba2341da014dc2
SHA1 93f08d6e50506655a18086580c3206d1e8d2f3d7
SHA512 2220a6a7dd65cd96a798c7a4aaa7d826f3b24f9107d9ddc578a4cb1a6135fcb5c230694697241fe1a3d5b3d22e7ded3c08119179c3eb1e9ef93adc4fade6f690
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nzx4Lls:wQAKq8y02yqEnjbWRmj1QWTu1jaKnzxn
TLSH
T18603FA3B680CCB7E4F804E9CED277E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 4ad170958be804a4c8d84de95be903e5f5e7176de85eac7b0185eb09421a47c9
MD5 31f4cc2da8bb464879f05391a0d20f9c
SHA1 b1321f02cd72e0aee59b6fdfe176569272772e02
SHA512 bd731cd8b437d22140897935c1af58781dd6b48ec4f14672029962f49b3be22acd1694dd65cd64debfa987d57315deb51772d4d30d82ff56927f6ee2a85f87f4
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5p:GZLVDJjEDPV0/Zdm/g
TLSH
T1C6A2491232FA42023C7E290C93969B674A42F1633459ED3F7BA940B54E67E125EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e5d2b05ec54e2321520bc0a5250d405aa6b62e2dcc2c9bbde08dbf74b72e3464
MD5 63d1c3d31b3b406c845bfa1f370d4e99
SHA1 daa5b91b91955f39cecd58d92ed97cab188b76dd
SHA512 0f63c10dcb9a09a906e3b89c69107678584acf66367c8094a6fe4fab629ee7165625ef9d5159ad011416f307d1435cdd10b1a34bddbe6283a26280e6448c2f63
SSDEEP 768:trF/cpY3dwgjOKekmg+Y4GdyKpvamyvwHbyLhj5n:t0Y3v+kTyKImyvrhh
TLSH
T17EF2B3F198D78977D99E4B87A77E6D029AFCC163B5880994FB880D0DCC861BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 69a764f75b6d1eed1d2cea20f8e665336a2d0a6cde7debc16ee60920e1391306
MD5 ecda374b1108900c25e09f249771404a
SHA1 9258f889d74682c781701385f882514ecb20678c
SHA512 8faf67f506f954ce8875dea82264e0c38a6806befd8beec1acfed15611c843eab8fc0ba28135d21b494c6b759b15afcfc2c9e75379feabcf4d0a0310201786c0
SSDEEP 768:gFccps35wgqs8KekmlB90GdyKphEI8p0J:os3Cs0kyBhyKwI8p0J
TLSH
T1EAB25B31ECA8CABBEDE64FC9FB4A6A07DEE01163858C49E4DAD81D1D00971DD134B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 68d7679aa787d1e7f8086c6189c14e4f18c66d858d04d35379025548fabe3c62
MD5 bcfaf82fa2643a7c4cd5be65f2c616de
SHA1 dc08eaf0088003f3f6cd8f75b86e34cb2c5c7ea3
SHA512 1a04be671ddc2fdac4d1840b9dee6b9d3ae2f53c5f228eb204bbc6da1e813146f1798ba097f519d61d3a237306b652433b9b8fd4168a86e276847c633ff9091f
SSDEEP 768:MFccps3dwgQKekmq4GdyKphamyvwHbyL1:Ms3MkfyK+myvr1
TLSH
T17CD25B31E8A8DABBEDE64F89F74A7603DEE0516385CC49E8DAD91E1D00971DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 74c54cc1ef7c32b94701b911bcb6fc04397d97e9fd2c172597e989acb1d2985e
MD5 dba5b472d2513830039c07340508d08b
SHA1 a5c74462dbd65964c7cf578160b01bc6ded9c901
SHA512 513826d46d955dc2e1ab23013176320c8071721313dcee2b32f0a5bafb254f1e5778a7863460c75f9e86eac5e8d8dcfc6b35eb66822510bcd274747b492b1b9d
SSDEEP 768:MFHcpm3dwgjOKekmx4GdyKpNamyvwHbyLhj5n:xm3v+kIyKKmyvrhh
TLSH
T1F3D24B35D8A8DABBEDE64F89E74A7603DEE0516385CC4AD8DAD91E1D009B1DC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0412e899d42a8e6cfb92b35c03974fa865633858a660f51b5e98a020142caf8d
MD5 c2c4cc2153f57609507bcaa7a9b97051
SHA1 e2395d28d6b843e41d99ddad04dcaac9300a7934
SHA512 84974ed0f5ef64e8742c182ba9acddf9b0f6d48ace183b2b8fd8969e87a2c95c70f658590658ec53cc4e7791bc8d23b28e405508d5a001ea604f2aedc9551e92
SSDEEP 768:MF/cpm3dwgjOKekmB4GdyKpoamyvwHbyLhj5n:Pm3v+ksyKTmyvrhh
TLSH
T1FCD24B35D8A8DABBEDE64F89E74A7603DEE0516385CC4AD8DAD81E1D00971DC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a695e69615aa4e6e1e84fd65fda03628e537cdf79e201684a827dec7f5ae183e
MD5 7984c2f76f5459f188511683adfd515f
SHA1 91d587682dc1d77633a705b97bcfdc0301463a64
SHA512 b4f3b2130e38da7246e5a9efed1104d993131963221bea4e98846e083aeba3518f25322070fbf1ddf5f7ca55d517af39b8385e714d88f72d70ef82dbd1c8ffed
SSDEEP 768:tqF/cpO3dwgjOKekm44GdyKpoamyvwHbyLhj5n:tpO3v+khyKTmyvrhh
TLSH
T12BD25B35D8A8DABBEDE64F89E74A7643DEE0516389CC4AD8DAD81E1D00971DC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

well_known_domains.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains.dll
Size 572KB
SHA256 2778063e5ded354d852004e80492edb3a0f731b838bb27ba3a233bc937592f6e
MD5 f5f5b37fd514776f455864502c852773
SHA1 8d5ed434173fd77feb33cb6cb0fad5e2388d97c6
SHA512 b0931f1cae171190e6ec8880f4d560cc7b3d5bffe1db11525bd133eaf51e2e0b3c920ea194d6c7577f95e7b4b4380f7845c82eb2898ad1f5c35d4550f93a14b6
SSDEEP 6144:XbBXgDO9CyiiKPFv3GPkDNiTHoIDiXkCBIvzVXCfwX5pWr+W1gUe3h576:XbBQDwi5FvGPkDNirYBIvzVXCoXWiWr
TLSH
T130C49E02B7D846A8D07AD0748A574642EA76BC950F74A6DF02E0B27D2F77BE45B3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 2d60d747fd90cdbe731756286fd2502191b0cf94423ce04cd94e97227c06dd98
MD5 7e31e7727f292c2a942ed5e9043103ef
SHA1 38217429b91081c021db2a221b4103c3052b8dbf
SHA512 04f4b7fa47125cb07cde189152af5078816d7f8a12dbb854bf29d65a6b273521f477ba6170012fd1b9e9138f4501e1b8c1114159aaf4400aa39ecb061cf40f83
TLSH
T10A4122E15C3D1AC1D4BE0DAFA48B34FC94D8C326F5A4707A6C68ED644639A1E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17843d217743888d4235da83df1dce7f4bca85be25aa4c97b0316c2d99fe77ad
MD5 15b8dc2f4eb29d408c6d4ca1178c3dc3
SHA1 16f09f881406e6f569f5a6b69c85308814b38ae3
SHA512 e1f58807ecf32b2aa95681bbe8e699b72d985a989ba18a271729326986901270462bac4ff21e4bdec693b2cb1c79f27df72c7fea93d8d57bc60344137efa69e6
TLSH
T1754143E25C3D2AC1D4BD0DBFA48B34FC94D8C326F5A4307A2858EE68463951D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c4383b57d551749f06e6e73e0fae63b0a4c819f80525609b6ff753f47572608
MD5 c4b2602defc9d85b9ec6ea51bfcd6801
SHA1 2ea49efbd102ecdb16bd003dd152cb408bae3850
SHA512 ca7a44fdaf6754d5b18ecbfcc7d4297371c85ec0a51e64b1d01b9c9d653358b5850884b6d48db6f7def349283d2a8f3b33e9eda8caad2186bd434eba5ee01888
TLSH
T12F4142E1583C2AD1D4BD0ABFB48B34FC84E8C726F5A4307E2858EAA8473961D258143F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_705111888\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_705111888\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3752_884557039\manifest.json
Size 141B
SHA256 dbfb38a16e33a39c35ac50bd81782e4608be14954f1df69ac8272c0b9ce87a5d
MD5 811f0436837c701dc1cea3d6292b3922
SHA1 4e51a3e9f5cbf8c9c96985dabe8ffc2de28dae87
SHA512 21e7bf2f8333b2900bcbcb871ede14684073249597d105095dc7d3f101e7ccc326068732f11d4a167365f245a3f2205793f520c7666d7f948e70919b40b43d35
TLSH
T134C04C5185005D72509D87781D6C97054B12CF4618947509DDC68309EC1DCCB64B234E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1160-303-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1932-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2204-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2716-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3420-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3564-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-397-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-243-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5240-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5240-201-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5328-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5344-190-0x00000266AD160000-0x00000266AE160000-memory.dmp

Download

memory/5584-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5960-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download