01bbcf011dbaae8c7aae0161115811744e62a576ddda81bd89a17117c0ce5ee6

Analysis

max time kernel
148s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/05/2026, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe
Size 243KB
Sample260524-tc4fpadt7z
SHA256 01bbcf011dbaae8c7aae0161115811744e62a576ddda81bd89a17117c0ce5ee6
MD5 67602f37c42acff14c4c294778707994
SHA1 7ba08f60bcc67187842b5ec3993841efcb5734a6
SHA512 7e8a2e8c44a36e53458c579e54e1864b834cc7f76c4fe08e8f5eb5b6643020bf6429fb31998cfe783a9ab384f6d272f3176554a0db97fa59f274c64c049cf21b
SSDEEP 3072:z2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:zwD99LB68zowa3lLNngoqRttA7T
TLSH
T135345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1148	CP.exe
2628	snhfzxrpkh.exe
4052	CP.exe
3192	CP.exe
1064	i_snhfzxrpkh.exe
3200	usmhczusmk.sys
1968	CP.exe
5152	cwrpjhczur.exe
4904	CP.exe
2840	CP.exe
2968	i_cwrpjhczur.exe
5668	ecwrpjhbzu.sys
5872	CP.exe
5460	urmjecwuom.exe
5200	CP.exe
4604	CP.exe
4116	i_urmjecwuom.exe
1700	bwtomgeywr.sys
4012	CP.exe
6108	rojgezwqoj.exe
760	CP.exe
448	CP.exe
2896	i_rojgezwqoj.exe
4744	wtolgeywqo.sys
2260	CP.exe
2004	omdbywqojg.exe
5208	CP.exe
2924	CP.exe
272	i_omdbywqojg.exe
4964	tnlgdywqoi.sys
3564	CP.exe
5972	dywqoigays.exe
5248	CP.exe
5892	CP.exe
880	i_dywqoigays.exe
5352	nlgdyvqoid.sys
5736	CP.exe
5648	aysqlidbvq.exe
3448	CP.exe
3404	CP.exe
5680	i_aysqlidbvq.exe
4720	caysqkicav.sys
5592	CP.exe
3896	vsnkfdxvqk.exe
5732	CP.exe
5260	CP.exe
2328	i_vsnkfdxvqk.exe
6052	causmkfcxv.sys
3312	CP.exe
6024	xspkicausm.exe
3772	CP.exe
2164	CP.exe
2244	i_xspkicausm.exe
2896	hcxupnhfzx.sys
5976	CP.exe
2956	nhezxrpjhc.exe
2200	CP.exe
2816	CP.exe
2696	i_nhezxrpjhc.exe
4396	wuomhezxrp.sys
908	CP.exe
5320	pmhfzuomhe.exe
4632	CP.exe
4384	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgezwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omdbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkhcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkhcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgezwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhezxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omdbywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5536	ipconfig.exe
3256	ipconfig.exe
1652	ipconfig.exe
2752	ipconfig.exe
3224	ipconfig.exe
1972	ipconfig.exe
4952	ipconfig.exe
4376	ipconfig.exe
332	ipconfig.exe
5100	ipconfig.exe
196	ipconfig.exe
3612	ipconfig.exe
4968	ipconfig.exe
2212	ipconfig.exe
3908	ipconfig.exe
5192	ipconfig.exe
3600	ipconfig.exe
3064	ipconfig.exe
2800	ipconfig.exe
4884	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1183333285"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31255464"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241117499178388"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{EF561135-3995-4BB9-88C9-D4C6216F8A74}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	i_snhfzxrpkh.exe
Token: SeDebugPrivilege	2968	i_cwrpjhczur.exe
Token: SeDebugPrivilege	4116	i_urmjecwuom.exe
Token: SeDebugPrivilege	2896	i_rojgezwqoj.exe
Token: SeDebugPrivilege	272	i_omdbywqojg.exe
Token: SeDebugPrivilege	880	i_dywqoigays.exe
Token: SeDebugPrivilege	5680	i_aysqlidbvq.exe
Token: SeDebugPrivilege	2328	i_vsnkfdxvqk.exe
Token: SeDebugPrivilege	2244	i_xspkicausm.exe
Token: SeDebugPrivilege	2696	i_nhezxrpjhc.exe
Token: SeDebugPrivilege	3436	i_pmhfzuomhe.exe
Token: SeDebugPrivilege	2372	i_jebwuomhbz.exe
Token: SeDebugPrivilege	5192	i_bztrljdbwt.exe
Token: SeDebugPrivilege	4556	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	4016	i_tqoigaytql.exe
Token: SeDebugPrivilege	1480	i_pnifaysqki.exe
Token: SeDebugPrivilege	5296	i_hfzxvpnifa.exe
Token: SeDebugPrivilege	5684	i_ausmkhcxup.exe
Token: SeDebugPrivilege	992	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	1716	i_pjhbztrmje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 5560	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	79
PID 5560 wrote to memory of 4828	5560	iexplore.exe	80
PID 4828 wrote to memory of 2488	4828	msedge.exe	81
PID 4828 wrote to memory of 1392	4828	msedge.exe	82
PID 4828 wrote to memory of 3748	4828	msedge.exe	83
PID 4828 wrote to memory of 3748	4828	msedge.exe	83
PID 4828 wrote to memory of 3748	4828	msedge.exe	83
PID 4828 wrote to memory of 2844	4828	msedge.exe	84
PID 4828 wrote to memory of 2844	4828	msedge.exe	84
PID 4828 wrote to memory of 1432	4828	msedge.exe	86
PID 4828 wrote to memory of 4120	4828	msedge.exe	87
PID 4828 wrote to memory of 1432	4828	msedge.exe	86
PID 4828 wrote to memory of 1432	4828	msedge.exe	86
PID 4828 wrote to memory of 4120	4828	msedge.exe	87
PID 4828 wrote to memory of 4120	4828	msedge.exe	87
PID 4828 wrote to memory of 4912	4828	msedge.exe	89
PID 4828 wrote to memory of 4912	4828	msedge.exe	89
PID 4828 wrote to memory of 4912	4828	msedge.exe	89
PID 4828 wrote to memory of 1888	4828	msedge.exe	90
PID 4828 wrote to memory of 1888	4828	msedge.exe	90
PID 4828 wrote to memory of 1888	4828	msedge.exe	90
PID 2424 wrote to memory of 1148	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	91
PID 2628 wrote to memory of 4052	2628	snhfzxrpkh.exe	94
PID 2424 wrote to memory of 3192	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	97
PID 4828 wrote to memory of 3284	4828	msedge.exe	99
PID 4828 wrote to memory of 2176	4828	msedge.exe	100
PID 4828 wrote to memory of 3284	4828	msedge.exe	99
PID 4828 wrote to memory of 2176	4828	msedge.exe	100
PID 4828 wrote to memory of 1104	4828	msedge.exe	102
PID 4828 wrote to memory of 5728	4828	msedge.exe	103
PID 1104 wrote to memory of 1364	1104	msedge.exe	104
PID 2424 wrote to memory of 1968	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	109
PID 5152 wrote to memory of 4904	5152	cwrpjhczur.exe	111
PID 2424 wrote to memory of 2840	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	114
PID 2424 wrote to memory of 5872	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	118
PID 5460 wrote to memory of 5200	5460	urmjecwuom.exe	120
PID 2424 wrote to memory of 4604	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	123
PID 2424 wrote to memory of 4012	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	127
PID 6108 wrote to memory of 760	6108	rojgezwqoj.exe	129
PID 2424 wrote to memory of 448	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	132
PID 4828 wrote to memory of 2236	4828	msedge.exe	134
PID 4828 wrote to memory of 6076	4828	msedge.exe	135
PID 4828 wrote to memory of 1480	4828	msedge.exe	136
PID 2424 wrote to memory of 2260	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	139
PID 2004 wrote to memory of 5208	2004	omdbywqojg.exe	141
PID 2424 wrote to memory of 2924	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	144
PID 2424 wrote to memory of 3564	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	148
PID 5972 wrote to memory of 5248	5972	dywqoigays.exe	150
PID 2424 wrote to memory of 5892	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	153
PID 2424 wrote to memory of 5736	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	157
PID 5648 wrote to memory of 3448	5648	aysqlidbvq.exe	159
PID 2424 wrote to memory of 3404	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	162
PID 2424 wrote to memory of 5592	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	166
PID 3896 wrote to memory of 5732	3896	vsnkfdxvqk.exe	168
PID 2424 wrote to memory of 5260	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	171
PID 4828 wrote to memory of 5896	4828	msedge.exe	175
PID 4828 wrote to memory of 5896	4828	msedge.exe	175
PID 2424 wrote to memory of 3312	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	177
PID 6024 wrote to memory of 3772	6024	xspkicausm.exe	179
PID 2424 wrote to memory of 2164	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	182
PID 2424 wrote to memory of 5976	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	186
PID 2956 wrote to memory of 2200	2956	nhezxrpjhc.exe	188
PID 2424 wrote to memory of 2816	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	191
PID 2424 wrote to memory of 908	2424	2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_67602f37c42acff14c4c294778707994_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ff9d95fc188,0x7ff9d95fc194,0x7ff9d95fc1a0
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,17160905722612003917,11182117716102784672,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
      4⤵
      System Time Discovery
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9838571465757761862,10475642876888968424,262144 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,7123810264945006112,6405756210758552407,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:13
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12063482568393587516,12301351405010923274,2097152 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2114190638746007979,14186700573604586482,2097152 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4812,i,14439115172782531888,12140317119406568384,2097152 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4744,i,16802127247787205705,15776011341088185554,2097152 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,6823543152045131558,16368294945762595742,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,17931039206977185002,1773007730526931084,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,18420859680589929091,4538141866774003383,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,8677110753438388528,7622840689629971451,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,18420859680589929091,4538141866774003383,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,18337131043169068113,12148412467135531913,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2685806059659822573,8546106381310611961,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,1022500859499839397,12525343637439111416,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,8280508888977963900,11026952028692397029,524288 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3476,i,11889037081646774994,15423687016718809667,262144 --field-trial-handle=2248,i,3641049664802423103,2752232414595703092,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1148
- - C:\Temp\snhfzxrpkh.exe
    C:\Temp\snhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Temp\i_snhfzxrpkh.exe
    C:\Temp\i_snhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwrpjhczur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\cwrpjhczur.exe
    C:\Temp\cwrpjhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwrpjhczur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\i_cwrpjhczur.exe
    C:\Temp\i_cwrpjhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5872
- - C:\Temp\urmjecwuom.exe
    C:\Temp\urmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\i_urmjecwuom.exe
    C:\Temp\i_urmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgezwqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Temp\rojgezwqoj.exe
    C:\Temp\rojgezwqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgezwqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:448
- - C:\Temp\i_rojgezwqoj.exe
    C:\Temp\i_rojgezwqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omdbywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2260
- - C:\Temp\omdbywqojg.exe
    C:\Temp\omdbywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omdbywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2924
- - C:\Temp\i_omdbywqojg.exe
    C:\Temp\i_omdbywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqoigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\dywqoigays.exe
    C:\Temp\dywqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqoigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5892
- - C:\Temp\i_dywqoigays.exe
    C:\Temp\i_dywqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidbvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5736
- - C:\Temp\aysqlidbvq.exe
    C:\Temp\aysqlidbvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidbvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\i_aysqlidbvq.exe
    C:\Temp\i_aysqlidbvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5592
- - C:\Temp\vsnkfdxvqk.exe
    C:\Temp\vsnkfdxvqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\i_vsnkfdxvqk.exe
    C:\Temp\i_vsnkfdxvqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3312
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2164
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhezxrpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5976
- - C:\Temp\nhezxrpjhc.exe
    C:\Temp\nhezxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhezxrpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2816
- - C:\Temp\i_nhezxrpjhc.exe
    C:\Temp\i_nhezxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzuomhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:908
- - C:\Temp\pmhfzuomhe.exe
    C:\Temp\pmhfzuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzuomhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4384
- - C:\Temp\i_pmhfzuomhe.exe
    C:\Temp\i_pmhfzuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomhbz.exe ups_run
  2⤵
  PID:236
- - C:\Temp\jebwuomhbz.exe
    C:\Temp\jebwuomhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomhbz.exe ups_ins
  2⤵
  PID:5088
- - C:\Temp\i_jebwuomhbz.exe
    C:\Temp\i_jebwuomhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  PID:4816
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  PID:6136
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  PID:4968
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  PID:2588
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqoigaytql.exe ups_run
  2⤵
  PID:3172
- - C:\Temp\tqoigaytql.exe
    C:\Temp\tqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqoigaytql.exe ups_ins
  2⤵
  PID:4376
- - C:\Temp\i_tqoigaytql.exe
    C:\Temp\i_tqoigaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysqki.exe ups_run
  2⤵
  PID:5656
- - C:\Temp\pnifaysqki.exe
    C:\Temp\pnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysqki.exe ups_ins
  2⤵
  PID:2864
- - C:\Temp\i_pnifaysqki.exe
    C:\Temp\i_pnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxvpnifa.exe ups_run
  2⤵
  PID:4140
- - C:\Temp\hfzxvpnifa.exe
    C:\Temp\hfzxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxvpnifa.exe ups_ins
  2⤵
  PID:5072
- - C:\Temp\i_hfzxvpnifa.exe
    C:\Temp\i_hfzxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkhcxup.exe ups_run
  2⤵
  PID:3272
- - C:\Temp\ausmkhcxup.exe
    C:\Temp\ausmkhcxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkhcxup.exe ups_ins
  2⤵
  PID:620
- - C:\Temp\i_ausmkhcxup.exe
    C:\Temp\i_ausmkhcxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run
  2⤵
  PID:8
- - C:\Temp\upmhfzxrpj.exe
    C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
  2⤵
  PID:2804
- - C:\Temp\i_upmhfzxrpj.exe
    C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmje.exe ups_run
  2⤵
  PID:844
- - C:\Temp\pjhbztrmje.exe
    C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmje.exe ups_ins
  2⤵
  PID:3064
- - C:\Temp\i_pjhbztrmje.exe
    C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4280

C:\Temp\usmhczusmk.sys
C:\Temp\usmhczusmk.sys
1⤵
- Executes dropped EXE
PID:3200

C:\Temp\ecwrpjhbzu.sys
C:\Temp\ecwrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:5668

C:\Temp\bwtomgeywr.sys
C:\Temp\bwtomgeywr.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\nlgdyvqoid.sys
C:\Temp\nlgdyvqoid.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\caysqkicav.sys
C:\Temp\caysqkicav.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
- Executes dropped EXE
PID:6052

C:\Temp\hcxupnhfzx.sys
C:\Temp\hcxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\uomhezwrpj.sys
C:\Temp\uomhezwrpj.sys
1⤵
PID:3284

C:\Temp\jgbztrljeb.sys
C:\Temp\jgbztrljeb.sys
1⤵
PID:5692

C:\Temp\ojgbytrljd.sys
C:\Temp\ojgbytrljd.sys
1⤵
PID:3808

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
PID:5728

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
PID:1808

C:\Temp\dxnhfaxspk.sys
C:\Temp\dxnhfaxspk.sys
1⤵
PID:1088

C:\Temp\vpnhfaxsnh.sys
C:\Temp\vpnhfaxsnh.sys
1⤵
PID:1012

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:5352

C:\Temp\zuomhezwrm.sys
C:\Temp\zuomhezwrm.sys
1⤵
PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqlidbvq.exe

Path C:\Temp\aysqlidbvq.exe
Size 243KB
SHA256 8d5f3ddc73a408482fdea429ce2b11deff5f7a23bdae57dade8d0f5410a02bf2
MD5 327316199cb76f2ba35cc325cbed928d
SHA1 a98590a9917c3f7fbbef8fed1aaaf538d9ec2321
SHA512 c9b8194d98fd7d00c1be4b77b0aaf2c7c814787076d5c6287f1dc6af6468db9d687745f6bd2902dcbb5ba064e084901ddeb2b85e4292031b0dd430a2acb0b125
SSDEEP 3072:c2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:cwD99LB68zowa3lLNngoqRttA7Q
TLSH
T138345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywr.sys

Path C:\Temp\bwtomgeywr.sys
Size 141KB
SHA256 6da9255185c0392d4db9f43ed37d2bc9380deb22be22f60117166de497246d8e
MD5 899da0c83189309cdc678200146b4825
SHA1 1a0c649a43dd4859c324c94a262fa3cc364c825b
SHA512 b4dc74632b8fc67b6b3ddef88d0dcf7df5ba20cd1d2c4adc121603e66258232c6f183ea35d0bc75dbb3d2c3322936bcdb32f7cf91022c7ca76120b654c4e243d
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwrpjhczur.exe

Path C:\Temp\cwrpjhczur.exe
Size 243KB
SHA256 2178f78e634dea08e31cf758eacb72fa4917f9661c3f44b4f8bbd2960b1a118d
MD5 4329e1be0b014a1f0cffa361f16fde8d
SHA1 db6e1abd3aa75d45ddfa3cc2a992edb90bb9d4bb
SHA512 e097c4338a9d2bb59041f9053fa636a495b9ac1cb792ca1a952fa4afd990535f76cdb38452ccebc17f22a1aebb28b2a5f0d94550f4a06ce48ffafd39d513e22d
SSDEEP 3072:D2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:DwD99LB68zowa3lLNngoqRttA7r
TLSH
T101345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigays.exe

Path C:\Temp\dywqoigays.exe
Size 243KB
SHA256 7f8494a7d405f6ec475736432966a67bafb5bccbab6427cb94b29a048e490efa
MD5 9cddf1934afb76be608c4d5fec2912d9
SHA1 0e794dfa577e0d6717474432d1050e3004fa98ec
SHA512 47cfbb3b10a51928267e49debd1cb89f1bcef9da9e8ea09147e4e6f74d612e855b140d2f2543355caa433087e730236b79097fb094cd67b3e0d617e211c2e0e9
SSDEEP 3072:q2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:qwD99LB68zowa3lLNngoqRttA7m
TLSH
T1EB345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwrpjhbzu.sys

Path C:\Temp\ecwrpjhbzu.sys
Size 141KB
SHA256 b3e3dce41bd830062289b474693134ed6fe86b3eb5acbcae45c5f5ad72c1af3d
MD5 d974667159ffc2ad5bab70cc944f0473
SHA1 4eb54c8c8aded90403baa7314bbdc1e5fdd0172f
SHA512 cebd3ceea46f8780e1ef4408ea26e42626931cb7839cb7e33a0155ec5adae66afe0957dc73247c74d90324ec48e62664ff5e585ff6b0d4c3aa8d223c5b3c1598
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T158E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwrpjhczur.exe

Path C:\Temp\i_cwrpjhczur.exe
Size 243KB
SHA256 fcae06b9d97147f469096987b2f331aa92b3f2bb38901069df33c26f85f03fee
MD5 9d5f336184ad9ce1e791b469e045190e
SHA1 1cb615b2e01975cd9aca7cb07c7fa834d5552e0b
SHA512 292d15733e2e14645527bf5932347a32143951cf018fdaf274d020baae8a65edbf212e193740d118506d053f5bf4c03fec5cdfd988fead76adc74c3d509ee29c
SSDEEP 3072:y2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:ywD99LB68zowa3lLNngoqRttA7K
TLSH
T105345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7683F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigays.exe

Path C:\Temp\i_dywqoigays.exe
Size 243KB
SHA256 3f7820af41b3af585aa583d78d97550269b8c5980b1de0ddeccfd3139ba8b5de
MD5 7bbb854b60f88b0c3a4eb277784fbb1a
SHA1 4e9994967a7d99f1e6a0fb2c3b9bbeaa293a8645
SHA512 5fcef412fa5627798eb5e4b087fc3f22f0a7cd5d91064556d46d855869295d362f4a9fe4ba09aefcac9777d3c756d54d80805598ee0e3da665db6dd40c981efc
SSDEEP 3072:P2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:PwD99LB68zowa3lLNngoqRttA7T
TLSH
T198345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omdbywqojg.exe

Path C:\Temp\i_omdbywqojg.exe
Size 243KB
SHA256 797a63d026bb26039129c7668c7215254ec89aeb22b21ae12a3d5d2914df5fd4
MD5 72e34816c425138812935fada4857cd9
SHA1 6d34b5826b05602e864066fe95cb3d7614f22f0b
SHA512 bdf7952c0f492cdfee42f582a67612bdf80466bbc8276e3ba079915dd6369588866ce092ebf2a8029b2f7badfed24419c5035927d5b02aa98c719f79386a407e
SSDEEP 3072:C2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:CwD99LB68zowa3lLNngoqRttA7K
TLSH
T16B345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgezwqoj.exe

Path C:\Temp\i_rojgezwqoj.exe
Size 243KB
SHA256 1c869af064a723631945ff7c1deebbe036de4ba0bb8acc73f6da68f585067a48
MD5 00cda00512e370f47cc81d077f0f2b2c
SHA1 6080d45c6d6d15779b0b3ab41b839dc35c1d58f1
SHA512 6e8f3759f24d338aa5bf6a56037d21379b847729b38dff7b8cb6e8d4d2bdb9ae50c3804246cac0fb991cb7beb2f77963fa1a4a5179539e9a9d93c7c5c807c6ef
SSDEEP 3072:l2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:lwD99LB68zowa3lLNngoqRttA7p
TLSH
T110345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snhfzxrpkh.exe

Path C:\Temp\i_snhfzxrpkh.exe
Size 243KB
SHA256 5caee9de2cc98078dd3556fa3e4ba394c3ecdde796c6f5b15d353772bfac9371
MD5 a06e9f6d03073cfc1beca7bcc20943c5
SHA1 026ca69b5996d5a20eb5e42243c50a90340ee24f
SHA512 bdbeaba2a7c4de789fc54d3ec6f00d7b3715963763c64eded25f55f9ee7d66a4a2f6f2f930395aff2f46600ae51d6c5e74bb317a307a559411be6ff46ad4b856
SSDEEP 3072:K2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:KwD99LB68zowa3lLNngoqRttA7O
TLSH
T1C0345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmjecwuom.exe

Path C:\Temp\i_urmjecwuom.exe
Size 243KB
SHA256 f5d0ffdfaca364d1053b780ce73c3cf34c831c4c4ef3b75983019586c040d6f3
MD5 92e136aa2daadedca413ae223b0384c3
SHA1 cc2dfa22a9ca850261eabe81ba9c803ea4b8d6c5
SHA512 1cfda9132f2648b2d86ccaa8852aecb3fbb96ea1c32d649b631b9053750c658ae45c773df48ba4926458caac0a39c3a3666d3c9593dc14e18bc52fdbff61e7df
SSDEEP 3072:l2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:lwD99LB68zowa3lLNngoqRttA7V
TLSH
T1DE345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoid.sys

Path C:\Temp\nlgdyvqoid.sys
Size 141KB
SHA256 bd426e3c9833502eec6c46a0f7f251734fe0aa4e2454a3c1032e987cfe0afd3b
MD5 dfa1d9854772a8aca9253366298e0d64
SHA1 52c451eae49227cf89e989acd6b1687bea726f70
SHA512 dedf05a7539ea6bef0183e1f97a5063671ce7e0a9ff5245504ca9dfc00e0aa2aae7894735335f80cb0682c05b81d7406ce3e785477359177315384be29b02f73
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omdbywqojg.exe

Path C:\Temp\omdbywqojg.exe
Size 243KB
SHA256 9ee0a1e494409f7dfca0693dfbcd48409d14c6196c62da9cfa9fcd3ad27b21e0
MD5 65f64f9ebbaf5c1e10fc72965f8e0ac4
SHA1 3948e4a1fae036cc5968eecdb2dfd30a865c7ebb
SHA512 2be61ff6bca3813585247750ed547165d8ab71b6b00500954153f730834f79aa478e63535bef993b2b0b87f2ee5d3b24d04765903e980021ebdcb9835eb82568
SSDEEP 3072:K2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:KwD99LB68zowa3lLNngoqRttA7W
TLSH
T1B2345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgezwqoj.exe

Path C:\Temp\rojgezwqoj.exe
Size 243KB
SHA256 c6cfef518dd1c2502be46382935d71a3953a33d835a02063b677e53248a10f70
MD5 ed72cfcd1e96206553495437a166345a
SHA1 05b39f806112d2772e544a7e97c0ae36053cf812
SHA512 ccd248755f7440bd3c387ff0aaa6f3a81e8458159876f3a7366f1829158a6dfa92620fe8d0b92777dc7d85c2a074b8962f0cd15ef1c5205353bb0ae3fefb0aa9
SSDEEP 3072:f2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:fwD99LB68zowa3lLNngoqRttA7L
TLSH
T1F1345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snhfzxrpkh.exe

Path C:\Temp\snhfzxrpkh.exe
Size 243KB
SHA256 b908d3bc8f652e64557633f401a17f545a35784579cb7cc23ccfb040ad77aa1a
MD5 792936ed6ccb2c1f75d924df6a655363
SHA1 a051de724e622a90e33fe2baa181dc26d6a039d2
SHA512 15a6ae0e67ebcfbd698de46201c9c33b74a7fba14ccc4cb9d6cac3164b1848434d4a8d3f09026d6a3a5401cf3390cc7694c573c882ffbec1ae282f7784398cae
SSDEEP 3072:Y2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:YwD99LB68zowa3lLNngoqRttA78
TLSH
T1C7345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7683F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.sys

Path C:\Temp\tnlgdywqoi.sys
Size 141KB
SHA256 bf64cb289e02317240b6340293240b338d8f6bba4f28f0631fa80c69e7c98706
MD5 77e648cbb4e581caa44b31d751cf2e82
SHA1 9a154b2c571223c20f863ccbd927244b0c400cb0
SHA512 61543d287d9a6eef790bb76d3d104e0c106bcf02fcab77b90365aa09db03ebafdbf9e3728d5c60b3aa372a2f761fe4c275e7678d0f5c7535f5a7bab6a0376e0f
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.exe

Path C:\Temp\urmjecwuom.exe
Size 243KB
SHA256 39c2b10e215c11d27c5b72523dbbbce58349b37e50e6d429616d12fad8630ba1
MD5 fd2b0e239c8dc253136b7eaabf42e722
SHA1 52ea4cddc4e7b2f10a1944b6fa8a03b6c39ee7d6
SHA512 e6239e4c1e8db329a604dc8e318732c1bdebe9082d929e798b280e22a68036537af518f5698513af32590c874246a229bc05b9afa4a973050ef6bc69dc78a04b
SSDEEP 3072:92z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:9wD99LB68zowa3lLNngoqRttA7h
TLSH
T18C345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmhczusmk.sys

Path C:\Temp\usmhczusmk.sys
Size 141KB
SHA256 bc740616a8888db6d238ad57384b8c07ff6577d2e4a216dab13fb9a023140bc0
MD5 55a0ce073df82e1c7ae637ab5003d823
SHA1 46ca7af3f5f93b85180d694b80f0aa359a2f4fcb
SHA512 c6e2834501d46e91c62b72a8c840b8b83a760d2d854873716af5c9489c6736ddc465873c46d4f3501ef461010a814bef39e8f395ce33f14aff442fd5e10e2093
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywqo.sys

Path C:\Temp\wtolgeywqo.sys
Size 141KB
SHA256 29d6d4d4e7929fc4eae190d758124db8bd43093ea69466296a5a13a2a3219db7
MD5 8cd080448c3c9731f4a77b80cc982087
SHA1 28b6f2a8a70504ef348bbc4863453444927c0679
SHA512 9fd88bcf1e915d4daaa3cb242c29abb96c95a5807aa2070388a27503fc5c665df774c42c55ff50c2da92a656c366668628f60524bc120cb50c07a04fd35272ca
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T192E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 5c16ceebf152e3871dacc1e22b6c37be529b0b428ca739595aa9be1280ca6634
MD5 d40f2c22c4c303b6b9507fa18f318878
SHA1 7807ba3edfa2c221648252655d9f543f4949f73d
SHA512 ec2e59820a4dd01d6dc209f747b923efc6f4551dfca04d70a91252b964f41894f04f63af544add069c632da4e81f521a8102f3f17a76e1b6fb54c52dbd67be77
TLSH
T179F028B6C9219C2B08FE0B2934A51B07E755136B2B40885F3B3D830D8FB463F469A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 00726e5e7620993014303171de529af6c5e14ae5fd036646c787e63f7e43b2fb
MD5 b3ee88140bf19914425dc1e4befd2b78
SHA1 ba1ee4179899c9fdfcc752ef82ae642556b34749
SHA512 d71efd9cffbef89aaa066e979225d0a1fd3e15f8f8aa8b4f4c08ef8bc2712e7e48a72154983112931357d7ad205370d851bcf8ffff0f8a652734b4b2072299e0
TLSH
T1FA417EF7C3E8856D8A0195F0BA18BE2BCE2D0954436C3D5A89E4AF1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 884436b929730ca6129cd674db90947b5d9cc8548c057b5a544138bd75f4e3fb
MD5 55400c66466b37f26d38a5afb335d0ee
SHA1 0e9d7c6d58c9c41f058b601b8fb40efa3a733ae0
SHA512 6ec61311e3004244b4e97871d23a3a53ab59858b602e6d2c24f7388bef20333a77a6f34c27332ed1053c44138d5f4c46c4607d21f898c40769c9f248d4ff8640
SSDEEP 384:sxZPPqzX/fOsP+WV7ord0FX/bN/5moz85:snyzX/f5+WZF/bx5m1
TLSH
T17972E716AA3849778CDBD319FA457B93D7F9156291900E44AEFCCB1C01E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9d1e71495211d7bc2cf9a1a5ffe5ff859fb9aacaa68b8f54c7f5492b8e3b0bd3
MD5 21e2f2367ec9916b2283307b3bd80ae4
SHA1 9762a02a3b3878e2edff6b771c18581de6d50138
SHA512 b68f5cc13c91c8b4ca5df00c2bc40a9dfb7700d0aa49391786e159c1bb9a5105b2f83f34d6e23965f8ab65e542ed7d90865882ec8b787e048283e31e1ed4ff56
SSDEEP 384:sxZPP0X/fOsv+5V7ord0FX/bN/53ojJYf:snsX/fR+5ZF/bx53lf
TLSH
T15862E7166A3859778CDBD309FA457B53D7F9166392800E44AEFCCB1C01E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f3984f5f8586b03cf5ee97be049d5af5b16b926ab2aae249926ec4b5ae4733fd
MD5 cb41e43bc15e8cc37062d811e9b670ea
SHA1 5bccbd4fe62f86096a3bf1e4175d64e325c0f68c
SHA512 c655a0ff140e3a23400b84245a36f3bbad9e135c573e5d1dd6450212fcfbd4821a026c42717f930317097895b7b5229abb9e77b34b2e5abd9583f870aa864bd2
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3VGq9LlH:XwZh38Dv2SkEnZFWRm6GQFmu1jaKVGqn
TLSH
T171030A3B280CCB7E4F844E9CED267F8A6EE8028B5698895447FA494C03C66EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 c1a6b170f0579876e79ecb8a55fd63b0763a49136c50b1e7428608fbe59b82d0
MD5 784a20a7f1b11e9dd08053e85977a63b
SHA1 cf132a3c8646dab73fe683c577b615ca4562e48f
SHA512 1f1da6f43e4ee23059c5dd684280b5a12f97016057ed4b562c1832852ab2a878702e4499702401bd47a79653c452765c79a6514b72b8733656d4ebf6fd2f5811
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlVERS:ctGj+BCNC5qFVpKxV4S
TLSH
T16AB27A1632BA02033C3E791D87A597375A42B2633018E93B7BE854B64E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 c4c9cfc089b4ea3645cdbb783ac1e6a5c58af5f1254106a8ea3d4086f8241b05
MD5 ebf85a2d36bfa5fb2500cb71c0309adc
SHA1 edd5ade935a12e2ca8dad4e42d1264b7623ebdf1
SHA512 614d3a50eddaf6c04e59df413c43112f429a3425b6a69fcdaff09785926a2847176683ec0b23a66e3483e3d7932dad9324006877712258c16d8167101d0036e9
SSDEEP 768:MFccps3nwg4EUzOoMrnG9LHbWS4I8p0Qg:Ms3aEnzG1HK1I8p0Z
TLSH
T1ACB25C32EC98CAA7FDEB4F99E74F7603DEE0516385889AD4DAD85D0C008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0765f56cb04b9fe6d2c5d0f0e1712243a09ff5f000f2a53b8d974360a937d5dc
MD5 8843d00b40957df601e4470f98b09798
SHA1 885e2949771e76a2d4e43fa96e67d5dfdd0971ba
SHA512 4dc54f38fc3f66ff3543ddc8cd681f4fb66e4ebcf83a4390002ab3ad3fc31f4e20d1caf1b67ed1503963490e2054e850587f4e7f67255a34aa0837ff56314386
SSDEEP 384:n6iF9CcmyWCA8NU8TUNTUlIRHrk6y2wu1zCfbLoMrnJNPcN9LHbVX20qXXyty/7c:xFccpAjwgyIfOoMrnG9LHb120qXXQ9
TLSH
T1BFB23B32ECA9CEA7ADDB5B99E74E3653DDE011B389889AD4D5D84E1C008718D170FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5d761ca019b9fe7736293a36b75b7fedce434023eff8c94845665d110f2fc679
MD5 81934280f95ee40d353f44526395881f
SHA1 c4ba54ef99f3397274f374e36cbfd2d031869c5c
SHA512 eb3c010690024ba6438e959f55c563185403b380abe26fc2c2633592cc6d256bc5c1c2726720cdee0e55fb77060ee9cf6a9e3d32b5aa9de67969ea296286cf20
SSDEEP 768:nFKjZbWjwgyGfOoMrnG9LHb1JtqXsYkPToN:MK8jzG1HrMsYkboN
TLSH
T1FBD24C32DC69CEA7EDEB9F95E35E7643EEE401A389885EC4D9D84E1D008719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5565dadd9afeff5b1c91c05d73477a44a7a651cc58a9d7e815a19a6790c437e8
MD5 b34b6c8865251c8878197ddb297263e0
SHA1 8476d90d1f8ebca4fc57f13b7f79245b90274e8c
SHA512 cf21bc044c29f56e4dcda13a73e07893d91fa8e3b582bdd7da1ec45a0102bd86b6a8a32ab32b5f888d5b581099d0b318bcf8fb7d24c2d9da2331f4faf8297dd4
SSDEEP 768:DFKjZb7mjwgy5AHpR4EjMrnG9LHb1p3qXsYkPToN:Ivm88izG1Hb6sYkboN
TLSH
T125D24B329C58CE67AEEB9E95E21E7653EEF401A399885FC4D9D84E1D008729D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8cb421e46b3b9c1aaca6d760494b4f76781c5051fa775c08a0ce66f1582896cf
MD5 e90734f69d388e752eeb2f069b32f7b8
SHA1 3b8663e15933190bf12abcb04aa8cc7b0bc9d9c6
SHA512 24dc7706d0f132c3d163e5258c75269f3a3c00b7b0a640cf1ce327e4e2d3b144efe92e3c5df68eb60b4453d1d27569e2b83735f2f997a16231f267ef6a99fdeb
SSDEEP 768:xFKjZb4jwgybyfOoMrnG9LHb1JtqXsYkPToN:CM8bPzG1HrMsYkboN
TLSH
T1DCD24C329C69CE67EDEB9F95E35E7643EEE401A389885EC4D9D84E1D008719D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1012-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-220-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1808-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-160-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3284-359-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3808-384-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4396-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-233-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5536-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5668-192-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5692-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5728-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download