a9821dcf774bd6d2e0e3335eb0e3d987722912bd14435b15eadfe9263af2066b

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
Size 243KB
Sample260530-ntmllsbs8s
SHA256 a9821dcf774bd6d2e0e3335eb0e3d987722912bd14435b15eadfe9263af2066b
MD5 f5094623e41270a370b576e098748f10
SHA1 71eb31d4de003c55aa06d410328a8e1e5a8ebaf8
SHA512 0beab9544e10e9122602969d729f1456a40997ee3b5047e03bc34208c82930d5b078072508e90168aea7c8123c2c96743a8b30611431efb80f36aa71e18b6c37
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:PvMsLaOa3lLNngoqRttA72
TLSH
T12B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2576	CP.exe
1776	ezwrpjhbuo.exe
5428	CP.exe
5700	CP.exe
3140	i_ezwrpjhbuo.exe
1584	bwurljebwu.sys
4060	CP.exe
2308	rmgeywrojh.exe
4512	CP.exe
4788	CP.exe
5052	i_rmgeywrojh.exe
5800	wrojhbywro.sys
4208	CP.exe
6124	dbvtolgeyw.exe
4476	CP.exe
5672	CP.exe
4884	i_dbvtolgeyw.exe
4772	nlgeywqoig.sys
1060	CP.exe
3260	dbwqoigsql.exe
2604	CP.exe
2748	CP.exe
5568	i_dbwqoigsql.exe
5952	idbvqnigay.sys
1640	CP.exe
5392	vqnigaysql.exe
5036	CP.exe
3644	CP.exe
1348	i_vqnigaysql.exe
2044	sqnigaysqk.sys
1592	CP.exe
4896	lfdxspnifa.exe
4760	CP.exe
2116	CP.exe
124	i_lfdxspnifa.exe
2384	sqkicavsnk.sys
3768	CP.exe
1632	axsqkicxvp.exe
5024	CP.exe
2012	CP.exe
864	i_axsqkicxvp.exe
4692	fcausmkicx.sys
5136	CP.exe
4612	rpnhfzpjhc.exe
2180	CP.exe
5076	CP.exe
5440	i_rpnhfzpjhc.exe
5640	zusmkecwup.sys
1504	CP.exe
5408	mhezxrpjhb.exe
4556	CP.exe
2696	CP.exe
932	i_mhezxrpjhb.exe
5756	pjezwrpjhb.sys
2572	CP.exe
5828	ezwrojebzt.exe
2468	CP.exe
5952	CP.exe
3392	i_ezwrojebzt.exe
3844	pjhbztrmje.sys
1960	CP.exe
5132	wqojgbztrl.exe
856	CP.exe
1296	CP.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_2082356042\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\passwords.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_243432224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_243432224\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_2082356042\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\us_tv_and_film.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwqoigsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwqoigsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxspnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxspnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpkez.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5984	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4884	ipconfig.exe
4624	ipconfig.exe
4460	ipconfig.exe
5448	ipconfig.exe
908	ipconfig.exe
2220	ipconfig.exe
3264	ipconfig.exe
4596	ipconfig.exe
3156	ipconfig.exe
4220	ipconfig.exe
1544	ipconfig.exe
4696	ipconfig.exe
3632	ipconfig.exe
5524	ipconfig.exe
5612	ipconfig.exe
2080	ipconfig.exe
1584	ipconfig.exe
5096	ipconfig.exe
964	ipconfig.exe
1968	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4255883113"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256639"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134246148918001943"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{C7A0E0D3-96DE-460A-935A-977A2E6AEBE5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	i_ezwrpjhbuo.exe
Token: SeDebugPrivilege	5052	i_rmgeywrojh.exe
Token: SeDebugPrivilege	4884	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	5568	i_dbwqoigsql.exe
Token: SeDebugPrivilege	1348	i_vqnigaysql.exe
Token: SeDebugPrivilege	124	i_lfdxspnifa.exe
Token: SeDebugPrivilege	864	i_axsqkicxvp.exe
Token: SeDebugPrivilege	5440	i_rpnhfzpjhc.exe
Token: SeDebugPrivilege	932	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	3392	i_ezwrojebzt.exe
Token: SeDebugPrivilege	1268	i_wqojgbztrl.exe
Token: SeDebugPrivilege	1168	i_wtolgeywig.exe
Token: SeDebugPrivilege	864	i_nljdbvtnlg.exe
Token: SeDebugPrivilege	4772	i_davtnlfdxv.exe
Token: SeDebugPrivilege	3392	i_snkfcxvpnh.exe
Token: SeDebugPrivilege	3744	i_smkfcxupfz.exe
Token: SeDebugPrivilege	1860	i_mhfzxrpkez.exe
Token: SeDebugPrivilege	2952	i_wuomhezxrp.exe
Token: SeDebugPrivilege	5592	i_rljebwtrlj.exe
Token: SeDebugPrivilege	2072	i_trojgbztrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 6136	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	81
PID 6136 wrote to memory of 4080	6136	iexplore.exe	82
PID 4080 wrote to memory of 4456	4080	msedge.exe	83
PID 4080 wrote to memory of 5984	4080	msedge.exe	84
PID 4080 wrote to memory of 1696	4080	msedge.exe	86
PID 4080 wrote to memory of 1696	4080	msedge.exe	86
PID 4080 wrote to memory of 5236	4080	msedge.exe	85
PID 4080 wrote to memory of 5236	4080	msedge.exe	85
PID 4080 wrote to memory of 5236	4080	msedge.exe	85
PID 4080 wrote to memory of 3956	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	88
PID 4080 wrote to memory of 3956	4080	msedge.exe	87
PID 4080 wrote to memory of 3956	4080	msedge.exe	87
PID 4080 wrote to memory of 3924	4080	msedge.exe	88
PID 4080 wrote to memory of 3924	4080	msedge.exe	88
PID 4604 wrote to memory of 2576	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	91
PID 1776 wrote to memory of 5428	1776	ezwrpjhbuo.exe	94
PID 4080 wrote to memory of 1844	4080	msedge.exe	97
PID 4080 wrote to memory of 1844	4080	msedge.exe	97
PID 4080 wrote to memory of 6028	4080	msedge.exe	98
PID 4080 wrote to memory of 6028	4080	msedge.exe	98
PID 4080 wrote to memory of 676	4080	msedge.exe	99
PID 4080 wrote to memory of 5212	4080	msedge.exe	101
PID 676 wrote to memory of 3304	676	msedge.exe	102
PID 4604 wrote to memory of 5700	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	105
PID 4604 wrote to memory of 4060	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	109
PID 2308 wrote to memory of 4512	2308	rmgeywrojh.exe	111
PID 4604 wrote to memory of 4788	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	114
PID 4604 wrote to memory of 4208	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	118
PID 6124 wrote to memory of 4476	6124	dbvtolgeyw.exe	120
PID 4604 wrote to memory of 5672	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	123
PID 4604 wrote to memory of 1060	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	127
PID 3260 wrote to memory of 2604	3260	dbwqoigsql.exe	129
PID 4604 wrote to memory of 2748	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	132
PID 4080 wrote to memory of 6128	4080	msedge.exe	134
PID 4080 wrote to memory of 4696	4080	msedge.exe	135
PID 4080 wrote to memory of 4448	4080	msedge.exe	136
PID 4604 wrote to memory of 1640	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	139
PID 5392 wrote to memory of 5036	5392	vqnigaysql.exe	141
PID 4604 wrote to memory of 3644	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	144
PID 4604 wrote to memory of 1592	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	148
PID 4896 wrote to memory of 4760	4896	lfdxspnifa.exe	150
PID 4604 wrote to memory of 2116	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	153
PID 4604 wrote to memory of 3768	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	157
PID 1632 wrote to memory of 5024	1632	axsqkicxvp.exe	159
PID 4604 wrote to memory of 2012	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	162
PID 4604 wrote to memory of 5136	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	166
PID 4612 wrote to memory of 2180	4612	rpnhfzpjhc.exe	168
PID 4604 wrote to memory of 5076	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	171
PID 4080 wrote to memory of 4072	4080	msedge.exe	173
PID 4080 wrote to memory of 4072	4080	msedge.exe	173
PID 4604 wrote to memory of 1504	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	178
PID 5408 wrote to memory of 4556	5408	mhezxrpjhb.exe	180
PID 4604 wrote to memory of 2696	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	183
PID 4604 wrote to memory of 2572	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	187
PID 5828 wrote to memory of 2468	5828	ezwrojebzt.exe	189
PID 4604 wrote to memory of 5952	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	192
PID 4080 wrote to memory of 1312	4080	msedge.exe	196
PID 4080 wrote to memory of 1312	4080	msedge.exe	196
PID 4604 wrote to memory of 1960	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	197
PID 5132 wrote to memory of 856	5132	wqojgbztrl.exe	199
PID 4604 wrote to memory of 1296	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	202
PID 4604 wrote to memory of 1216	4604	2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe	206
PID 5792 wrote to memory of 1004	5792	wtolgeywig.exe	208

C:\Users\Admin\AppData\Local\Temp\2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_f5094623e41270a370b576e098748f10_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x36c,0x7ffe7345c188,0x7ffe7345c194,0x7ffe7345c1a0
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,10273803583213670412,10368855939923503028,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
      4⤵
      System Time Discovery
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,17890818303338625636,7345453590298777318,262144 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:2
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,1086891930044677632,4977190065288222725,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:13
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,2521513008666594819,6688022481859683656,2097152 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,1659004893225770803,15085731377071693537,2097152 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,7699006325108349600,10839405226023641280,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,725521326442465106,8275953199206120631,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,11980364188007641216,14536397592363987427,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7423398846663442603,3212580312583475725,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7423398846663442603,3212580312583475725,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10113995032967433990,9060621925546107966,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,13034882124097203879,4599489821618306115,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,15598296081142827680,18371221315512288337,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,9043399468019085248,2943383836932298754,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:14
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,3075379492755177759,12639665441315886698,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,7437329843973406421,9058235458344053379,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,4770359291873875965,10245104037129816488,262144 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=872,i,1494915356626522888,10506673946539036283,524288 --field-trial-handle=2552,i,5360588454081272979,17868816756492490913,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbuo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2576
- - C:\Temp\ezwrpjhbuo.exe
    C:\Temp\ezwrpjhbuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5700
- - C:\Temp\i_ezwrpjhbuo.exe
    C:\Temp\i_ezwrpjhbuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4060
- - C:\Temp\rmgeywrojh.exe
    C:\Temp\rmgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\i_rmgeywrojh.exe
    C:\Temp\i_rmgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5672
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwqoigsql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1060
- - C:\Temp\dbwqoigsql.exe
    C:\Temp\dbwqoigsql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwqoigsql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\i_dbwqoigsql.exe
    C:\Temp\i_dbwqoigsql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1640
- - C:\Temp\vqnigaysql.exe
    C:\Temp\vqnigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3644
- - C:\Temp\i_vqnigaysql.exe
    C:\Temp\i_vqnigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxspnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1592
- - C:\Temp\lfdxspnifa.exe
    C:\Temp\lfdxspnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxspnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2116
- - C:\Temp\i_lfdxspnifa.exe
    C:\Temp\i_lfdxspnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\axsqkicxvp.exe
    C:\Temp\axsqkicxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_axsqkicxvp.exe
    C:\Temp\i_axsqkicxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpnhfzpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5136
- - C:\Temp\rpnhfzpjhc.exe
    C:\Temp\rpnhfzpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpnhfzpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\i_rpnhfzpjhc.exe
    C:\Temp\i_rpnhfzpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrojebzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Temp\ezwrojebzt.exe
    C:\Temp\ezwrojebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrojebzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5952
- - C:\Temp\i_ezwrojebzt.exe
    C:\Temp\i_ezwrojebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1960
- - C:\Temp\wqojgbztrl.exe
    C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1296
- - C:\Temp\i_wqojgbztrl.exe
    C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeywig.exe ups_run
  2⤵
  PID:1216
- - C:\Temp\wtolgeywig.exe
    C:\Temp\wtolgeywig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeywig.exe ups_ins
  2⤵
  PID:1124
- - C:\Temp\i_wtolgeywig.exe
    C:\Temp\i_wtolgeywig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtnlg.exe ups_run
  2⤵
  PID:472
- - C:\Temp\nljdbvtnlg.exe
    C:\Temp\nljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtnlg.exe ups_ins
  2⤵
  PID:4644
- - C:\Temp\i_nljdbvtnlg.exe
    C:\Temp\i_nljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  PID:4568
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  PID:5432
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfcxvpnh.exe ups_run
  2⤵
  PID:4728
- - C:\Temp\snkfcxvpnh.exe
    C:\Temp\snkfcxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfcxvpnh.exe ups_ins
  2⤵
  PID:4192
- - C:\Temp\i_snkfcxvpnh.exe
    C:\Temp\i_snkfcxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxupfz.exe ups_run
  2⤵
  PID:2136
- - C:\Temp\smkfcxupfz.exe
    C:\Temp\smkfcxupfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxupfz.exe ups_ins
  2⤵
  PID:1088
- - C:\Temp\i_smkfcxupfz.exe
    C:\Temp\i_smkfcxupfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpkez.exe ups_run
  2⤵
  PID:4268
- - C:\Temp\mhfzxrpkez.exe
    C:\Temp\mhfzxrpkez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpkez.exe ups_ins
  2⤵
  PID:4856
- - C:\Temp\i_mhfzxrpkez.exe
    C:\Temp\i_mhfzxrpkez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run
  2⤵
  PID:496
- - C:\Temp\wuomhezxrp.exe
    C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins
  2⤵
  PID:3048
- - C:\Temp\i_wuomhezxrp.exe
    C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtrlj.exe ups_run
  2⤵
  PID:4804
- - C:\Temp\rljebwtrlj.exe
    C:\Temp\rljebwtrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtrlj.exe ups_ins
  2⤵
  PID:4968
- - C:\Temp\i_rljebwtrlj.exe
    C:\Temp\i_rljebwtrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgbztrl.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\trojgbztrl.exe
    C:\Temp\trojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgbztrl.exe ups_ins
  2⤵
  PID:2436
- - C:\Temp\i_trojgbztrl.exe
    C:\Temp\i_trojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1912

C:\Temp\bwurljebwu.sys
C:\Temp\bwurljebwu.sys
1⤵
- Executes dropped EXE
PID:1584

C:\Temp\wrojhbywro.sys
C:\Temp\wrojhbywro.sys
1⤵
- Executes dropped EXE
PID:5800

C:\Temp\nlgeywqoig.sys
C:\Temp\nlgeywqoig.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\idbvqnigay.sys
C:\Temp\idbvqnigay.sys
1⤵
- Executes dropped EXE
PID:5952

C:\Temp\sqnigaysqk.sys
C:\Temp\sqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\sqkicavsnk.sys
C:\Temp\sqkicavsnk.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\fcausmkicx.sys
C:\Temp\fcausmkicx.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:5640

C:\Temp\pjezwrpjhb.sys
C:\Temp\pjezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:5756

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
- Executes dropped EXE
PID:3844

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
PID:3504

C:\Temp\yvqoigaytq.sys
C:\Temp\yvqoigaytq.sys
1⤵
PID:2036

C:\Temp\nlfdxvqnig.sys
C:\Temp\nlfdxvqnig.sys
1⤵
PID:2852

C:\Temp\kicavsnkfd.sys
C:\Temp\kicavsnkfd.sys
1⤵
PID:2064

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
PID:5012

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
PID:1204

C:\Temp\kezxupmhez.sys
C:\Temp\kezxupmhez.sys
1⤵
PID:2548

C:\Temp\gezwrpjhbz.sys
C:\Temp\gezwrpjhbz.sys
1⤵
PID:4812

C:\Temp\eztrljdbwt.sys
C:\Temp\eztrljdbwt.sys
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicxvp.exe

Path C:\Temp\axsqkicxvp.exe
Size 243KB
SHA256 999898f5b2434b99ba4594a49bdbb1e485395fe678aac6b55a962e8ee141baf3
MD5 31dcf97bce2ae46f3a679477c8ff121e
SHA1 05e6dfc76824484eef5b9600a4fc38caa4ff7291
SHA512 cbcb2751321f0e6e34012df7c94585d325e2bac2107203ad95bd18a286b570c6f6b84afdfeace9d9feeae36aba8726d7a29afb6d7ce1cdb6e94a3de4d1b0a329
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:qvMsLaOa3lLNngoqRttA7t
TLSH
T11F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwurljebwu.sys

Path C:\Temp\bwurljebwu.sys
Size 141KB
SHA256 6106782f3aa88e19d7bbd06fc614355466622723ce958a7a41061f42c292f820
MD5 03cc94ace37d4d99f5cf009239091f6d
SHA1 f97df1aa5ccb44700c9fd670bf20a1307cb6903d
SHA512 694f767553e78bceb82308bfab8d51026c0d2cb287fe910cc68c9626ddb36758831b8926d60b89cc56ec614929390c936edf31d10f7605f19fe41f52e35b078e
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.exe

Path C:\Temp\dbvtolgeyw.exe
Size 243KB
SHA256 4384db496a889b39e15031aecaaaacccd7c0ff5ff545d641483431b30a91b2b7
MD5 db45db4e22116477e8457a3e56cf72cf
SHA1 8ce347176e8edc7c8fc97e35a8b8f8620f12ced1
SHA512 e149e8bb032f9440a281fde1b17e1874e7e83cfca1412f2ef35faa69b3624a06ffaf467f189426450de91c836f3ca2bfb10d6d0c00d52df03c99e912316a4843
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:svMsLaOa3lLNngoqRttA7P
TLSH
T141345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwqoigsql.exe

Path C:\Temp\dbwqoigsql.exe
Size 243KB
SHA256 7c52a2046ed46fdaa074a1503414b2d1c7cfa2e6202519a0c7dfd30ce7d88cf1
MD5 42532613eebbe9cfb741e352ffee5024
SHA1 5d747a28162e893f100e4144004f305337c68f4c
SHA512 1ef7c9c6b8cf952381c791ca22474d323ff30e5cda4bf59bf160c7b67b3d89a5029412e4e9f24cad95d6cc7159a9d75252208e3ed99637d1233b17d08d1d7cbc
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:2vMsLaOa3lLNngoqRttA7F
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbuo.exe

Path C:\Temp\ezwrpjhbuo.exe
Size 243KB
SHA256 ec1e234e0f59b1642d888efc8066a32c150ed1e1a7d1266fe2c3436375c2c8a2
MD5 64b8d0423033301292f1f8a30034467b
SHA1 347ebaf0274ab0fff400cb159ec36a4c764109e6
SHA512 50ac21166cd91d9cc175a2b4bf3ce88a81c0ae18b7599949be98d3308d0cbfceb4e51855a7ea9f36a6d07bb752565293b332de6655076aad3021be008fe638a9
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:pvMsLaOa3lLNngoqRttA74
TLSH
T1DB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtolgeyw.exe

Path C:\Temp\i_dbvtolgeyw.exe
Size 243KB
SHA256 9cdf98bfb88896a6ea0ad8e798db1113660d3ef763d5a7a78aa58a94a691506b
MD5 ea02d9399b3013c959c20a6a34604cf6
SHA1 897e6c5b0a55c8e15197070053e3e5e052bee85e
SHA512 ea012ff67efe095a0926a9392c129153760f66a555f0775f74994bb8d5c805eb1c420c205e8d6e4f78e9d83347fb7d7ef52b15db81786ca1f54f8f2409b26581
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:pvMsLaOa3lLNngoqRttA7g
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwqoigsql.exe

Path C:\Temp\i_dbwqoigsql.exe
Size 243KB
SHA256 a10e073e0b3dec0ff30d128dc68b0e1e411fb0be525f2403e706628dc7359da4
MD5 dbe979a028c16fe915731da0c690b3b5
SHA1 bca90dc8d3166858842b513abf1603965ba4524d
SHA512 2141dba03bfd3689cfc2c48ef5d1565430c90155b320e83d445217ac80d337f62e629f73435b0dfb5b1bb54280b15accdbcf53ef838bb9e050c6cb9d1f5df1eb
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:QvMsLaOa3lLNngoqRttA73
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwrpjhbuo.exe

Path C:\Temp\i_ezwrpjhbuo.exe
Size 243KB
SHA256 73db4ceaee3e61e7b32e8e9d1c02e3f6c6339729a6f01e358595df0ae4d876af
MD5 be2cb068d8fa0a47bab9d528e64d9d5f
SHA1 3349e19ab9dec1c65416dc2cca57e09c52604b3d
SHA512 92c5bb6d2810c3304d1416521db09294103a4c0898b8c63d85dbeb980ca3c1e1c81197e2441c8456bc203a9441ea254ac913c17f647ca5edbd99f138a45d3e4e
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:NvMsLaOa3lLNngoqRttA7c
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxspnifa.exe

Path C:\Temp\i_lfdxspnifa.exe
Size 243KB
SHA256 ded5f077b99d085e60e018a6fb362e7deb84ac9dbdb8e0bf28201d42e0c864be
MD5 60ed4db7a39ac3933d0824c9b501ebcf
SHA1 76f55c2792470d19c997d0edf4d055ccebe09863
SHA512 2bfe844c489e3f03a0f7bf7eb7ad36df75d969896758f1c76ed1424b0d09216d9ecec43d892660a2962f2346f83bda5f3f77fbc0dcb753d92415aa97c1139784
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:FvMsLaOa3lLNngoqRttA7g
TLSH
T1E0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmgeywrojh.exe

Path C:\Temp\i_rmgeywrojh.exe
Size 243KB
SHA256 002e80084b7531e385a91cc6bf12fef978a8d107330d614493181fac44c343f8
MD5 aaa3204917446549b0fd326aaf31d108
SHA1 4a4d43dbccc3d463d483371f241d5e9180c3db9d
SHA512 e581f0ee87cf45cc0ed3c847f1aaf354a3738177e6b186a0424cb645d270fbf4703130279a08ef8ed126a7db31594dc946e8885b3b8ea56a4e66d516bb174627
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:MvMsLaOa3lLNngoqRttA7j
TLSH
T1E1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnigaysql.exe

Path C:\Temp\i_vqnigaysql.exe
Size 243KB
SHA256 5c72d1cb6806d727bab44f8e520d1ff3dee2bb89002423f605fd1e86fc06ff58
MD5 553a479b57a4ee754bcde69c838f7833
SHA1 4bfe067070d37860a4cee5c283d3898448dbec0c
SHA512 f071531f692448e77b80457b3b081efbae6682ec98665e1c5a8711fa568d234c4f040816c4ffad276a339abddb5c575301a41846944d1fddaca3e1a8aa9ac220
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:1vMsLaOa3lLNngoqRttA7E
TLSH
T1EF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvqnigay.sys

Path C:\Temp\idbvqnigay.sys
Size 141KB
SHA256 dbd9c71fd8692d66ac38f1bd050291a26a6e8fad16b9a0aa433f9f05ba51ad1f
MD5 8fbbcb8f2f48b70a85afaf8520301a41
SHA1 b24eb95b9c71da2ca3f7f2f7bedfa2563f4b1955
SHA512 8da9007fdb4e9b15c274d0d4b0f460c5438d62f75f71045538f0aac76524ef12ca190ecd2eefdfadd989ff64d3c9d6e3023ad5b226efe4361a8dd4be7e5895a4
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxspnifa.exe

Path C:\Temp\lfdxspnifa.exe
Size 243KB
SHA256 dfe1577ef64e564b8207d6781800a200aac1d843dad837c67dd26abe04498153
MD5 1496426956585cc4368f06c62e845535
SHA1 5c0c8f627af39de0b1e57596f1904e2887da3ff7
SHA512 49895ce71670e084e5958831f0faaaa8c084c57beec86d56c4085a0f18bb82633d851ee656f0d71ec2f66769a64dfa084bd528eca99523f0582629c6ec6d9e83
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:DvMsLaOa3lLNngoqRttA7O
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgeywqoig.sys

Path C:\Temp\nlgeywqoig.sys
Size 141KB
SHA256 d5da09850ee421163b627610ad5d09dbdf11ff6930f9056993790b75feb6c14d
MD5 8628a744fe71cf7c5d1a19903618d640
SHA1 5ae2368ff818911b3e453cf5e5c7a478c435ed87
SHA512 ec2b46d6553d383bf6b2d31a51493a3663ffa731716b40bd5a2736255b20008c6660ef399ab2dd49ab7cf318997a0550353ec8acd3976cac1829e7c0163f5432
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmgeywrojh.exe

Path C:\Temp\rmgeywrojh.exe
Size 243KB
SHA256 2f6c4c8bb6c1a9a77b347504c639f286fe862432b8ff46f8de367512b07f76f3
MD5 be32de90ace9cc7578de46335d406c17
SHA1 2eb621b41b709d11171aeae5242d821220e9aa1e
SHA512 a7a905f5020c675a2d01723488b75ca7438d7a9c03accc0cdd7eb5a46310c3b7ce81d0fd4da0a7492f957dd0353a9986dc6017206643dc91e4af742b1bf87221
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:2vMsLaOa3lLNngoqRttA7d
TLSH
T158345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.sys

Path C:\Temp\sqkicavsnk.sys
Size 141KB
SHA256 8075a97b1b94226311e7f5f58e5cad88e6bcc27a7b4b9b0f1e60c42aa2bc6476
MD5 5d5a5ae12a91cbcaf58d296fae4304dd
SHA1 8a3b9159bfcfc36dd3f0e799d0420a99cf93e58d
SHA512 e37fe06e94d40184504c3690a3bf872fdb0a5091d7e3dea1c95acd346a79b382bd334a4354e0fbca22b55fe1ee3356fa654170a6fae530203863f6372739b6b1
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqk.sys

Path C:\Temp\sqnigaysqk.sys
Size 141KB
SHA256 391671b0fe944601034b70709274694e2ff7be049a95b760411ad6b9d83a54d1
MD5 319f4f603a98f02baa051f870e67ba88
SHA1 3f79171c9f04d1c4f04116dde4b758e59a93ec28
SHA512 480f8360efc4b922516eac43350441fff1765a926bd295c11a3240678153ac0b1192610cc4cc244de3268c7a4ee95fc5504cca8f053620ea76f9efd63068db98
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F6E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysql.exe

Path C:\Temp\vqnigaysql.exe
Size 243KB
SHA256 3b350f2e2772b997adda9470c4a8eca589b43b47d462b0d659798aaed2cf4255
MD5 e2a7ef76cd1c74ec1235b0bbd755ca63
SHA1 57cb7702213f666f547d2f884a7417ccdb0b1ea3
SHA512 cf353fbe6047763cb1cdc20aacd7d69ad85dbec37f95323d43717dcd66cb6e9ca4234c989ad92e86abdaab581222fc8232841a3bb0862e7d9c4212fc7e9695f5
SSDEEP 3072:P/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Bv:yvMsLaOa3lLNngoqRttA7V
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbywro.sys

Path C:\Temp\wrojhbywro.sys
Size 141KB
SHA256 9611d672fa4971b35640622997e81309ece74d5d61b8a19f86624d16cd82f7ca
MD5 f9010ebb7c68e11dbec5ac00f08c852e
SHA1 9af77670f29314c3083dec1b05bc30ab90e5f5ab
SHA512 a1c58189b92c916c1c3e130fa2c17863f339c595236b10950c0f554992ddfc87ac6502caaed8800f6fa86285c0bfb56d755689e3258f5ea23490e24b30ab8a5f
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 22ab549fc55d24b04350a11b4c1264d4bca875fe72b1957345e4801b1ab6fee7
MD5 e6ff7c2499cc885b6de522d4a048fbf5
SHA1 9b4982a87212952577970dfd3a449c42c90b3745
SHA512 6b6a628f084d6264506020169c48c986d3f044516ef53d68495dda0f28f567829f5ef3f05b5332b1241578d56e9453e01d7319067d242c8df5f3b3f4960a729a
TLSH
T17EF0F9AAC930AC2728FD0B1970A51B4AE75113572780985B3B3D520C8FB163B468681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 29cd591f7ec3b08fd8c6fd8262f8b1d1f7ec9e6156f3dd899c7c4f1ad131d40b
MD5 52aa19d6e34c0dbd3b6c908845e2f06c
SHA1 d388c76b947bb07d9bbac310d06781677b36a48e
SHA512 fca1979ad1a9aea7a06cb1e747f14885e1c8827a8f9356ecb310aaa73663a10ee73d83e92f80b61148daf58f9870591d83201f6394d3c84a8acf7c9df57eb845
TLSH
T1F74190F7C7E8856DC90196F0B6187E1BCE2D0914432C7D5A85E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

cbd1766b-9e08-4fe4-96df-a22d5ce6d683.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cbd1766b-9e08-4fe4-96df-a22d5ce6d683.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e6e6c87a-9fdf-433b-91bd-4c4b59eedd2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6e6c87a-9fdf-433b-91bd-4c4b59eedd2c.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3929fc4beedeae7da7bb6281ba332a75b2cd8747f8f7234aa38b0558f8b69159
MD5 10ea6d0c3cfe8fc7da93ea8539260202
SHA1 0d4afa148161cf40d338fba9dafaeafccdd7e630
SHA512 b709877997e228c98a9183416530205c728beec5e43bad9c1a1f47f30d88a043be611229a1779cc1f1ec09bd87b8828a408077e337f8a24a0aa3d42d15ae03ed
SSDEEP 192:sxZZkRgyMqZjK1Ml8McM/fu/s8beCxE0CXUyynDCzodpZS/W6+WNseE/Y0dqcc1j:sxZqp0M/f2s8beC60Ly85M/b6/5p8jn
TLSH
T19D62E816AA3859778DDBD209FA457F63D3F9152392404E449AFCCF1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6662700910ad05865f4c228375c073f72b99ef752459e25882513b1789a5e1e9
MD5 5ddc2e080f61ab67b0f05b3c1dc7c25c
SHA1 995dff54bea5d5f8d07581d7020abeeec9086e17
SHA512 e37af25c7d1b53a2b2e5a1b4cabcedd1aa78c751ab2e146caeef3dff0057382b16e53266952d99412d32f049094b1279f7c9d6638f8735fdf8fa23322e5c6f0b
SSDEEP 192:sxZZkRgyMqZjK1Ml8UQ/cM/fu/sXeJUE0CXUyynDCzodpZS/W6+WNseE/Y0dGccv:sxZqpqUM/f2sXeZ0Ly85M/b6/5p8pT
TLSH
T1E072F916AA38497B8DDBD219FA457F53D3F9052292404E4499FCCF1C04E66ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 5b7eb819a7137fb0e6443b545ef4f3ba0a351bb473bdac596b9907f17590ee39
MD5 1213bdc86f5eb7f55891e1f5193c9980
SHA1 cab7b4412122aae0f48e0e2f5a29a3dedd79f496
SHA512 b30d9a9154f62fc23aa7a0b8e55571bb4df1c135a9f5e59ed2fc4eb14ac53ab35b84cd73a8358cc7e64cd1efc2526bb859f8eaad018c50a6a1dbcc103dad5ae5
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3K3pQLls:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKK3pj
TLSH
T1C7031B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF551B4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ec185a80b51fa0e0edd3e896734bad396b43b668ea78704cc23796b66714f78f
MD5 650e136310139353dbf81a65b4686fa5
SHA1 4fc198f9b69d34b7eae3740420a46b2979a51ad4
SHA512 af4eae6921768ece599d641b3006158c59c259db4c49e707e25ca25028c652716a7da27274ae12d1fee4a30b8678dda7152bb3e754272e8ce10f3c9e9503f5a4
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv72j6zYXDp1j:AFBHhTofhno2mB21q3Llbfe3sLDdeEpI
TLSH
T120B28E52717B12023C3D291CA7A29B370E8272A3345CA56F77B900BA4E67E615DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0799b613f3b3ae0c0cfd11d70a20e7364fa99f9d913a4e1415ce95af64778d95
MD5 23384345028b90a70242ae5a4691e079
SHA1 85377473e0659d45fe139c1062d6626638b7f048
SHA512 48a04afc370f53de84cf632e25a70c1dade3af1a175dc2051e5c181b02bac1d0db6a1a8233ebc428cc5339cd544203893cc3c8abaec69362e7b1f6c57c101336
SSDEEP 768:2FKjZbw3hwg3Moug95vTwrmvUSbQAEG0Oy:/83n5kKvUS05
TLSH
T1E4E2C4F198E78977E8AE5B87A33E2E42AAFCC15374485990B7C44D1DCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8dee3de410351b4200dbcdedcfe66d10a75da94e4fc289e341d6b1550ecd1641
MD5 51781bb7d68f3ddf838149436b494805
SHA1 7c9b75aef74889dd299fd63ee1a389f8742a505c
SHA512 eb45531340a05a27eda2732a794e811acd6535a1097da69e034e89e8a4798d69bdc1949bc6f2f78ab027e74e3800f43d9fbdcea2f387c2a6e37a5be24e71151e
SSDEEP 768:jFccps3/wgv0Ooug95vTwRmLhkoFYS/fz:zs3FM5kMLhkoae
TLSH
T169B25B32ECA4DABBECE64F89F74A7A07EEE00163858889D4DAD80D5D00DB1DD1747C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5061bc470dd443174fcad392d30fe573edc7774b859db675e2f3aedd4ad47200
MD5 c8dbbbf63b817d3e903bdcfb4da74135
SHA1 3ad907199215c385f7f515514f1f6ef858a71c13
SHA512 d1a316eed8e0092e0e76839d997ff86fd302749aef54d3bc68fcd131a3278fd5d358d73a8849259a2e9622d01d76efb0862991a7b43cdd6ae7795ae53eec6637
SSDEEP 768:cFAjZbW3hwgwMoug95vTw/mvUSbQAEG0Oy:hK3s5kOvUS05
TLSH
T1DFD26C32D864DEBBADE75B99F71A3643AFE4019389885ED4DAC84D1E00C71DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3220974d27e4312cbbfce4c7596240bcf39201c76f0c1dfb9917192eebe8afee
MD5 004402a03088902e3ecb5fe133da3e6c
SHA1 6899f12f7dc5ab59c663a476c71df78b302d6608
SHA512 1b4ee4c31ec96c0de8051e0de5d530a8e77da74f71f48f77ae3989b184fbed500ea622b72ed73aa51abc00ad028519411a87383a36f37457056455f8792d7786
SSDEEP 768:xFKjZbb3hwgxMoug95vTwtmvUSbQAEG0Oy:Cn355kIvUS05
TLSH
T1CFD26C32D864DEBBADE75B99F71A3643AFE401A388885ED4DAC84D1E10C72DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 fdb214ba88751a68b6590e27ca50caf356a3102e2cdc8b17a4e56fff7dd5204d
MD5 d19866921bc81e0170aabc1e698f5377
SHA1 2d422a3f7c16fdef17275a9b34536790f02829c5
SHA512 39a14b9f3077e040e6b123fac6bb5d37db0f8210bd67a89a70d992cfa1b6cea0436aca5f61fa246da80d3cdb9a237d612a00e02b9adfc89580adb749982c29c8
SSDEEP 384:y5kiF9CcmyWCs38Ne8TUNTUlIRzycCUdjf+8oug9FfggF1wKwmvXECHy/7Igj:cFccps3hwgAMoug95vTwDmvXE/
TLSH
T1BBB24B32E864CEB7ECE65B99F75A3643DEE0416385888ED4DAD84E1D10CB1DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6c288a13f9c4dea9d16f42afe622eecd7f61f79c1f6998c8df2249009c1a87ea
MD5 b82c6a03769d35961e2ea19b1a1e36b7
SHA1 5415c1dd203d9a9a8932037ec433d544f770ed2b
SHA512 52334093ae4910cf382f93133794700a53ce2d30d1b4edbb3c161cc0eddeaaf341658bd441fca0b107a0a5c54bf28ca65def3b20ebc7da0475ac1f23b4918eec
SSDEEP 768:cFKjZbm3hwgEMoug95vTwtmvUSbQAEG0Oy:hS3Q5kIvUS05
TLSH
T19FD26C32D864DEBBADE75B99F71A3643AFE4019389885ED4DAC84D1E00C71DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 852f07dc6fac5879f2c1ff2a0b6a283900e23a829baf17ff4ed85346017c2d0d
MD5 05b488470fd37895762e33277dda6890
SHA1 bb9be160896c53601ebce78c7a25fab472f1e939
SHA512 14480bcd70d3fe14fb88f5be54c4ebfa62cd52afc0e545037d5b7ed422123b6868c5746185bb2b1a43b9df0cf4b9008e351288c7e052dce44d4e83e5dd4924d5
TLSH
T1B43143E16D3C2AD1D0BE0EAF649738FC81E8D326F4A8717D6448EDD8063920D654187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 e1b7124ea5b99168a7c0f38255c1d9b159f6dcd7ad58dfe2b36c7aa7151cc161
MD5 5cdd109a8040e21bbe10ad59dd44c01d
SHA1 4e86f63587bb4df574e3437cacd33d832190f6cc
SHA512 0fa11b508cbef9eea983adfd9eea4912917fa47be8d30cd5c27d91259af6bf5d442d54849081f1178000d89d6a8855095ca78db53956fbbc9c0313763fc44589
TLSH
T1E24130E15C3D29C1E0BE0EAF645B38FC91ECC32AF4A4307D2848EAD8467960D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5655401b6b36a02b55bb76bdc12c0acfa43b40f2a605775c1ddc44de43886440
MD5 bd71ec2021a54c728b3aea4bf20a904f
SHA1 0c8bdcad2de6a5b3db3367a83237f79880ffb25f
SHA512 852b942fa636392233eab2387b499a96249a8c7e0f4444050ab51168a498ea7f2c804fe7eed86d6cf55989972f763351547889444a97826172dab2e59fb5f491
TLSH
T1B43111E15D7D29C1E0BE0EAF644738FC95ECD32AF4A830796848EED8463920D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_1752602302\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_2082356042\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_243432224\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4080_243432224\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-455-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1584-164-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2036-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2548-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2852-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3504-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3984-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4692-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4772-219-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4812-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5640-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5756-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5800-220-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5800-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5952-241-0x0000000000010000-0x0000000000083000-memory.dmp

Download