3fee38dc03e53325c0c227d2b8377eb4bea27eba4c4858bcd7b0084df5894bbe

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe
Size 243KB
Sample260629-vmvrzaat5v
SHA256 3fee38dc03e53325c0c227d2b8377eb4bea27eba4c4858bcd7b0084df5894bbe
MD5 31cd00f0bf9e95117632a62bbf6afa27
SHA1 f612a59b682fa4c974bc38c4d669e743ec97db17
SHA512 39aea13ef103d7071dc2b199bb660bea1fd7dd3859e61c22bbeef130c990933fc6a6b4070bfa461ef5c367f83194eabb21862d78a03a3ee4cb656f4916e652db
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:cvMsLaOa3lLNngoqRttA7b
TLSH
T163345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1676	CP.exe
1352	gbytrldbvt.exe
1504	CP.exe
5708	CP.exe
2280	i_gbytrldbvt.exe
5004	gaywqoigay.sys
108	CP.exe
248	davtnlfdyv.exe
1096	CP.exe
3632	CP.exe
4576	i_davtnlfdyv.exe
2528	dxvqnifdxv.sys
7136	CP.exe
6624	xvqnifaysq.exe
4876	CP.exe
2312	CP.exe
4712	i_xvqnifaysq.exe
3744	kifaxvpnhf.sys
5176	CP.exe
3372	hfaxvpnhfa.exe
2404	CP.exe
6240	CP.exe
6656	i_hfaxvpnhfa.exe
5484	ausmkecxup.sys
6768	CP.exe
1808	xspkhcausm.exe
2036	CP.exe
6664	CP.exe
5324	i_xspkhcausm.exe
4068	caurmkhczx.sys
5116	CP.exe
3532	ezwusmkhcz.exe
6292	CP.exe
2728	CP.exe
2552	i_ezwusmkhcz.exe
6016	xuomhecwur.sys
1380	CP.exe
5108	rmjhbztrmj.exe
3944	CP.exe
4124	CP.exe
5064	i_rmjhbztrmj.exe
5676	pjhbztrmje.sys
6760	CP.exe
3904	omgezwrpjh.exe
2220	CP.exe
5688	CP.exe
5312	i_omgezwrpjh.exe
4756	tqojgbywqo.sys
5796	CP.exe
6324	wtrljdbvto.exe
352	CP.exe
4840	CP.exe
2040	i_wtrljdbvto.exe
1552	aywqolgdby.sys
6796	CP.exe
4236	bvtqlidbvt.exe
6748	CP.exe
6340	CP.exe
2664	i_bvtqlidbvt.exe
5640	nljdbvtnlg.sys
4532	CP.exe
5556	dbvtnlfdxv.exe
6168	CP.exe
920	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
464	msedge.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_677056066\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_677056066\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_2113648787\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\male_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_544302957\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_544302957\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_2113648787\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_1270251969\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_677056066\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_677056066\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_1714360176\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_1714360176\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\surnames.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_1270251969\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping464_500184429\passwords.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrldbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrldbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvpnlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcaxsqkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcaxsqkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwusmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvpnlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	licavsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2944	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 21 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1736	ipconfig.exe
1144	ipconfig.exe
4832	ipconfig.exe
3104	ipconfig.exe
6532	ipconfig.exe
2788	ipconfig.exe
4524	ipconfig.exe
1056	ipconfig.exe
3124	ipconfig.exe
2760	ipconfig.exe
6676	ipconfig.exe
6220	ipconfig.exe
5008	ipconfig.exe
6908	ipconfig.exe
5492	ipconfig.exe
4464	ipconfig.exe
6152	ipconfig.exe
5228	ipconfig.exe
5392	ipconfig.exe
5604	ipconfig.exe
4804	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{B0B6720E-1912-48BE-8C69-1BC009DDA331}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
464	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2280	i_gbytrldbvt.exe
Token: SeDebugPrivilege	4576	i_davtnlfdyv.exe
Token: SeDebugPrivilege	4712	i_xvqnifaysq.exe
Token: SeDebugPrivilege	6656	i_hfaxvpnhfa.exe
Token: SeDebugPrivilege	5324	i_xspkhcausm.exe
Token: SeDebugPrivilege	2552	i_ezwusmkhcz.exe
Token: SeDebugPrivilege	5064	i_rmjhbztrmj.exe
Token: SeDebugPrivilege	5312	i_omgezwrpjh.exe
Token: SeDebugPrivilege	2040	i_wtrljdbvto.exe
Token: SeDebugPrivilege	2664	i_bvtqlidbvt.exe
Token: SeDebugPrivilege	5920	i_dbvtnlfdxv.exe
Token: SeDebugPrivilege	5040	i_yvpnlidavs.exe
Token: SeDebugPrivilege	3568	i_hfcaxsqkhf.exe
Token: SeDebugPrivilege	5492	i_czusmkecxu.exe
Token: SeDebugPrivilege	1940	i_pjhczusmke.exe
Token: SeDebugPrivilege	5476	i_czurmkecwu.exe
Token: SeDebugPrivilege	2832	i_omgeywrojg.exe
Token: SeDebugPrivilege	2856	i_bvtoljdbvt.exe
Token: SeDebugPrivilege	6680	i_olgdbywqol.exe
Token: SeDebugPrivilege	4744	i_ayvqnigays.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 2948	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	89
PID 2948 wrote to memory of 464	2948	iexplore.exe	90
PID 464 wrote to memory of 868	464	msedge.exe	91
PID 464 wrote to memory of 800	464	msedge.exe	93
PID 464 wrote to memory of 2944	464	msedge.exe	94
PID 464 wrote to memory of 800	464	msedge.exe	93
PID 464 wrote to memory of 800	464	msedge.exe	93
PID 464 wrote to memory of 5296	464	msedge.exe	95
PID 464 wrote to memory of 5296	464	msedge.exe	95
PID 464 wrote to memory of 5144	464	msedge.exe	96
PID 464 wrote to memory of 3200	464	msedge.exe	97
PID 464 wrote to memory of 5144	464	msedge.exe	96
PID 464 wrote to memory of 5144	464	msedge.exe	96
PID 464 wrote to memory of 3200	464	msedge.exe	97
PID 464 wrote to memory of 3200	464	msedge.exe	97
PID 6108 wrote to memory of 1676	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	98
PID 1352 wrote to memory of 1504	1352	gbytrldbvt.exe	101
PID 464 wrote to memory of 6428	464	msedge.exe	102
PID 464 wrote to memory of 6416	464	msedge.exe	103
PID 464 wrote to memory of 6428	464	msedge.exe	102
PID 464 wrote to memory of 6416	464	msedge.exe	103
PID 464 wrote to memory of 3520	464	msedge.exe	107
PID 6108 wrote to memory of 5708	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	110
PID 6108 wrote to memory of 108	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	114
PID 248 wrote to memory of 1096	248	davtnlfdyv.exe	116
PID 6108 wrote to memory of 3632	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	119
PID 6108 wrote to memory of 7136	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	123
PID 6624 wrote to memory of 4876	6624	xvqnifaysq.exe	125
PID 6108 wrote to memory of 2312	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	128
PID 6108 wrote to memory of 5176	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	132
PID 3372 wrote to memory of 2404	3372	hfaxvpnhfa.exe	134
PID 6108 wrote to memory of 6240	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	137
PID 464 wrote to memory of 5616	464	msedge.exe	139
PID 464 wrote to memory of 6140	464	msedge.exe	140
PID 464 wrote to memory of 5972	464	msedge.exe	141
PID 6108 wrote to memory of 6768	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	144
PID 1808 wrote to memory of 2036	1808	xspkhcausm.exe	146
PID 6108 wrote to memory of 6664	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	149
PID 6108 wrote to memory of 5116	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	153
PID 3532 wrote to memory of 6292	3532	ezwusmkhcz.exe	155
PID 6108 wrote to memory of 2728	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	158
PID 6108 wrote to memory of 1380	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	162
PID 5108 wrote to memory of 3944	5108	rmjhbztrmj.exe	164
PID 6108 wrote to memory of 4124	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	167
PID 6108 wrote to memory of 6760	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	171
PID 3904 wrote to memory of 2220	3904	omgezwrpjh.exe	173
PID 6108 wrote to memory of 5688	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	176
PID 464 wrote to memory of 2280	464	msedge.exe	180
PID 464 wrote to memory of 2280	464	msedge.exe	180
PID 6108 wrote to memory of 5796	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	182
PID 6324 wrote to memory of 352	6324	wtrljdbvto.exe	184
PID 6108 wrote to memory of 4840	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	187
PID 464 wrote to memory of 6592	464	msedge.exe	189
PID 464 wrote to memory of 6592	464	msedge.exe	189
PID 6108 wrote to memory of 6796	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	192
PID 4236 wrote to memory of 6748	4236	bvtqlidbvt.exe	194
PID 6108 wrote to memory of 6340	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	197
PID 464 wrote to memory of 5980	464	msedge.exe	199
PID 464 wrote to memory of 5980	464	msedge.exe	199
PID 6108 wrote to memory of 4532	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	202
PID 5556 wrote to memory of 6168	5556	dbvtnlfdxv.exe	204
PID 6108 wrote to memory of 920	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	207
PID 6108 wrote to memory of 1584	6108	2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe	211
PID 3396 wrote to memory of 3940	3396	yvpnlidavs.exe	213

C:\Users\Admin\AppData\Local\Temp\2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_31cd00f0bf9e95117632a62bbf6afa27_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7fffe0f1c188,0x7fffe0f1c194,0x7fffe0f1c1a0
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15469517754646005544,15288542502456693615,262144 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15127974601303809319,2693236731741193391,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:11
      4⤵
      System Time Discovery
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,2516860655626222677,17252162088863118412,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:13
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13922899811704238741,5613987878095606008,2097152 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,5083682997443977278,7253950043424000544,2097152 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,5259595718216188178,15503471669583735463,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:6428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12669858289658231244,15275269993875422703,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:6416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,1261295945044703021,1344172998678265037,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,1261295945044703021,1344172998678265037,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,12178526688243462059,2091148367693672821,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,16675374673476003702,577537176311101414,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5887889503424734830,865319502551664557,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,17253045110250634916,3956316606469258582,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,8277932408883785385,1650006497607107403,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,13649909505762772469,7661602802701312680,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4319089159610986218,18413321517052557645,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,7391233233698197909,16968737682053770784,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:6304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5108,i,16948786625829815733,16511813971477160149,262144 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,17992987067525576703,5650416888518514753,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17338128198283400314,3902581859106348982,524288 --field-trial-handle=2304,i,6518627780661810724,7749911259372027397,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrldbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1676
- - C:\Temp\gbytrldbvt.exe
    C:\Temp\gbytrldbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrldbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5708
- - C:\Temp\i_gbytrldbvt.exe
    C:\Temp\i_gbytrldbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:108
- - C:\Temp\davtnlfdyv.exe
    C:\Temp\davtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3632
- - C:\Temp\i_davtnlfdyv.exe
    C:\Temp\i_davtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnifaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:7136
- - C:\Temp\xvqnifaysq.exe
    C:\Temp\xvqnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnifaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\i_xvqnifaysq.exe
    C:\Temp\i_xvqnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5176
- - C:\Temp\hfaxvpnhfa.exe
    C:\Temp\hfaxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6240
- - C:\Temp\i_hfaxvpnhfa.exe
    C:\Temp\i_hfaxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6768
- - C:\Temp\xspkhcausm.exe
    C:\Temp\xspkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6664
- - C:\Temp\i_xspkhcausm.exe
    C:\Temp\i_xspkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwusmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\ezwusmkhcz.exe
    C:\Temp\ezwusmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwusmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2728
- - C:\Temp\i_ezwusmkhcz.exe
    C:\Temp\i_ezwusmkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1380
- - C:\Temp\rmjhbztrmj.exe
    C:\Temp\rmjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4124
- - C:\Temp\i_rmjhbztrmj.exe
    C:\Temp\i_rmjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6760
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5688
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5796
- - C:\Temp\wtrljdbvto.exe
    C:\Temp\wtrljdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\i_wtrljdbvto.exe
    C:\Temp\i_wtrljdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6796
- - C:\Temp\bvtqlidbvt.exe
    C:\Temp\bvtqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6340
- - C:\Temp\i_bvtqlidbvt.exe
    C:\Temp\i_bvtqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\dbvtnlfdxv.exe
    C:\Temp\dbvtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:920
- - C:\Temp\i_dbvtnlfdxv.exe
    C:\Temp\i_dbvtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvpnlidavs.exe ups_run
  2⤵
  PID:1584
- - C:\Temp\yvpnlidavs.exe
    C:\Temp\yvpnlidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvpnlidavs.exe ups_ins
  2⤵
  PID:4168
- - C:\Temp\i_yvpnlidavs.exe
    C:\Temp\i_yvpnlidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcaxsqkhf.exe ups_run
  2⤵
  PID:2488
- - C:\Temp\hfcaxsqkhf.exe
    C:\Temp\hfcaxsqkhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcaxsqkhf.exe ups_ins
  2⤵
  PID:2596
- - C:\Temp\i_hfcaxsqkhf.exe
    C:\Temp\i_hfcaxsqkhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecxu.exe ups_run
  2⤵
  PID:5104
- - C:\Temp\czusmkecxu.exe
    C:\Temp\czusmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecxu.exe ups_ins
  2⤵
  PID:1980
- - C:\Temp\i_czusmkecxu.exe
    C:\Temp\i_czusmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczusmke.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\pjhczusmke.exe
    C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczusmke.exe ups_ins
  2⤵
  PID:1044
- - C:\Temp\i_pjhczusmke.exe
    C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecwu.exe ups_run
  2⤵
  PID:2652
- - C:\Temp\czurmkecwu.exe
    C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecwu.exe ups_ins
  2⤵
  PID:2528
- - C:\Temp\i_czurmkecwu.exe
    C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojg.exe ups_run
  2⤵
  PID:1516
- - C:\Temp\omgeywrojg.exe
    C:\Temp\omgeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojg.exe ups_ins
  2⤵
  PID:4428
- - C:\Temp\i_omgeywrojg.exe
    C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtoljdbvt.exe ups_run
  2⤵
  PID:948
- - C:\Temp\bvtoljdbvt.exe
    C:\Temp\bvtoljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtoljdbvt.exe ups_ins
  2⤵
  PID:6260
- - C:\Temp\i_bvtoljdbvt.exe
    C:\Temp\i_bvtoljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbywqol.exe ups_run
  2⤵
  PID:4224
- - C:\Temp\olgdbywqol.exe
    C:\Temp\olgdbywqol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbywqol.exe ups_ins
  2⤵
  PID:5860
- - C:\Temp\i_olgdbywqol.exe
    C:\Temp\i_olgdbywqol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqnigays.exe ups_run
  2⤵
  PID:3772
- - C:\Temp\ayvqnigays.exe
    C:\Temp\ayvqnigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqnigays.exe ups_ins
  2⤵
  PID:2460
- - C:\Temp\i_ayvqnigays.exe
    C:\Temp\i_ayvqnigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\licavsnkic.exe ups_run
  2⤵
  PID:6828
- - C:\Temp\licavsnkic.exe
    C:\Temp\licavsnkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6220

C:\Temp\gaywqoigay.sys
C:\Temp\gaywqoigay.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\dxvqnifdxv.sys
C:\Temp\dxvqnifdxv.sys
1⤵
- Executes dropped EXE
PID:2528

C:\Temp\kifaxvpnhf.sys
C:\Temp\kifaxvpnhf.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:5484

C:\Temp\caurmkhczx.sys
C:\Temp\caurmkhczx.sys
1⤵
- Executes dropped EXE
PID:4068

C:\Temp\xuomhecwur.sys
C:\Temp\xuomhecwur.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\pjhbztrmje.sys
C:\Temp\pjhbztrmje.sys
1⤵
- Executes dropped EXE
PID:5676

C:\Temp\tqojgbywqo.sys
C:\Temp\tqojgbywqo.sys
1⤵
- Executes dropped EXE
PID:4756

C:\Temp\aywqolgdby.sys
C:\Temp\aywqolgdby.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\nljdbvtnlg.sys
C:\Temp\nljdbvtnlg.sys
1⤵
- Executes dropped EXE
PID:5640

C:\Temp\vtnlfdavtn.sys
C:\Temp\vtnlfdavtn.sys
1⤵
PID:2896

C:\Temp\fzxusqkifd.sys
C:\Temp\fzxusqkifd.sys
1⤵
PID:2464

C:\Temp\hfcxupfzxr.sys
C:\Temp\hfcxupfzxr.sys
1⤵
PID:5012

C:\Temp\rmkecwusmk.sys
C:\Temp\rmkecwusmk.sys
1⤵
PID:3776

C:\Temp\wurmjhbzxu.sys
C:\Temp\wurmjhbzxu.sys
1⤵
PID:1740

C:\Temp\ljgbywurmj.sys
C:\Temp\ljgbywurmj.sys
1⤵
PID:6264

C:\Temp\gdbwtomgey.sys
C:\Temp\gdbwtomgey.sys
1⤵
PID:2428

C:\Temp\tolgeywqol.sys
C:\Temp\tolgeywqol.sys
1⤵
PID:2068

C:\Temp\davtqligdx.sys
C:\Temp\davtqligdx.sys
1⤵
PID:1532

C:\Temp\sndxvpnifa.sys
C:\Temp\sndxvpnifa.sys
1⤵
PID:6344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxup.sys

Path C:\Temp\ausmkecxup.sys
Size 141KB
SHA256 22f11c0ba5b71494a60a55e93c606bd3be22bec8e4102a243fb0b8f98686c57b
MD5 5bf4d589418b5923a5716582674360d4
SHA1 3451bb320728f2b29818646d434bdf5309a4f3a6
SHA512 e7d102a9cfff2f33ec203aa7dc844eeb71b98cac21e8f87186874a702597044d7d60fd866de79183d544aa6bb10355d9f2f5bb22beb9c877516e72f8d81cceae
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caurmkhczx.sys

Path C:\Temp\caurmkhczx.sys
Size 141KB
SHA256 04ac2c5bab96f8c4fd40b756ec6a11a1c62df5511308a1329191f1bc7d2623cf
MD5 b39b144f1f4f0dc6969dfd99933ad37b
SHA1 feb55292614ab7a2f78bc31bc52db0d00962a0b8
SHA512 05267ad7376e72cc36edf1be5dc1e5411a143901df31db9c94d045b3e87d9f9151c4f9e1dca1ce66e21093db8d5e07910f7caa80e0b152c09538d0dc2c0848be
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdyv.exe

Path C:\Temp\davtnlfdyv.exe
Size 243KB
SHA256 c92a157aea3d87c1b415cec5fcd039938da81900a6c1e89ae9a06081565022e7
MD5 435db55b5bb2acf66a4a43d8bf9feea6
SHA1 f500c4a4dbbf39a02f283d065582083b21857052
SHA512 5ab1084184c6c221d120532ea0f017f923c393d4a3540a7e0aafa4ca99861fab1091ab3ba80b247e44f9a9843680c10b2d3725e9d61ebe51acd153d2635d7664
SSDEEP 3072:m7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7wb:HvMsLaOa3lLNngoqRttA7q
TLSH
T1C9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnifdxv.sys

Path C:\Temp\dxvqnifdxv.sys
Size 141KB
SHA256 436262c0ae936e074dc86fd57bf5f473b0a9b5ea24fae558a8f4b7de67243812
MD5 4ac8956ad4b87dc1e986d6df913c21b8
SHA1 23a765e075763fb24f2e810165eaf50107007276
SHA512 aa78a29e13368203a427b8a9b353891605165e7fee0f759ceacd0a17164b8e3584a696316ff06a4235f8e33e0752ae2e4c79051650320e82f9578eb7f1d74c2b
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwusmkhcz.exe

Path C:\Temp\ezwusmkhcz.exe
Size 243KB
SHA256 62dc796084980c4fcf6fd3ae87854972bbfe11127d263175b46de7e406e55dd0
MD5 ae0c374faebeb70a655e47709b656756
SHA1 1b51f3c3f4b3b12e1c4dd0c146586331f922a798
SHA512 9afcff069c1be3f627fbb18d2eaeb03e68c8f5359c282bcd8ca4aec6447b8fda5f4ccc7cddb30e3837b34c9fb4df623062e2a57ff43f3797eb4410d4ce99a918
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:BvMsLaOa3lLNngoqRttA7M
TLSH
T1EC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaywqoigay.sys

Path C:\Temp\gaywqoigay.sys
Size 141KB
SHA256 8e57ed00b5c22f929a84c783bcde63afaf93085d03605b36a0a785ae8a41018f
MD5 1aac1ce94c43e7663c0f272270cd8aef
SHA1 2c803cf968e29d95a07918eea14a68f0d5f3e528
SHA512 175b6fb6b39065c70702d7ed8e3b95d4c6ae51d85526caf3b76b06d5175f2309d9ee27bcd8bf84c210b723d7e68dc8af1c15b2dad575b1384e457895a8413c4d
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T100E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrldbvt.exe

Path C:\Temp\gbytrldbvt.exe
Size 243KB
SHA256 42f3e2972c116d0104a07a0021b0a20592fa58e701546e9861e7492b8c3e701c
MD5 13c2fe2b6c690d79d07f7bcf6eb96413
SHA1 8e829e08e23ff4852332c23ac21c8406a10b2e1f
SHA512 517c4843790f4411f2aeeb4263cd72452d99704e26a31086a7a5364c97207af28c643302d98743b1b8489daac5bde44bbe555403c4953278951f8537b6112eaf
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:YvMsLaOa3lLNngoqRttA7n
TLSH
T181345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxvpnhfa.exe

Path C:\Temp\hfaxvpnhfa.exe
Size 243KB
SHA256 7b9294f4f2b6926e879f889c62d825fef8d4f9ca09f325d9fc3ececc7d751d19
MD5 f849a7a3b88e65aecde3e6c171e7a931
SHA1 b4fcf4ba4993717b3250fa45276791d075b030a9
SHA512 852bf57352e8ef96f12e02ef9258a055094d25ffa73d6d17407bedfdf18d03482316dfe3a70ff80135d28db47a4c9b2df25ba32ed284cf30270351aa9e7d5a8e
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:avMsLaOa3lLNngoqRttA79
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdyv.exe

Path C:\Temp\i_davtnlfdyv.exe
Size 243KB
SHA256 81da950e5d1aa2dc1022964cafc1aad54e05f7ffaecd0c0bfc4014f6913f671b
MD5 8768c8062018ab375234cb797922eb9d
SHA1 8ac12ef04132e3b6a116d3c97741f4d72d0ad499
SHA512 059d9ea46ed407a1beeba6dd233b3807f44f18f6da711aa7140c76861bfc1f506a7c15a271fb5d244cc1ea3f67948e3abcfd7e5e1b9db53f4fde581b52126287
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:IvMsLaOa3lLNngoqRttA7X
TLSH
T17F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwusmkhcz.exe

Path C:\Temp\i_ezwusmkhcz.exe
Size 243KB
SHA256 87c6cfbb0298c7de81d67694e3db219e509fddc2386ad8a7ca03ccc6787eaf1a
MD5 5c4fb9c4bc65603eab643f5a907373fb
SHA1 0d4b6c08d2e1af2c5a030e90334f28e6f3b2aacd
SHA512 96630869c1414278fbd69e5e0621a27b35f0788459849a133482d0813ce6b79a68b6e363efd52e0f64930c28ca708ce44dfb86e8ce7a3dc7ca651241b36248cf
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:hvMsLaOa3lLNngoqRttA7Q
TLSH
T142345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrldbvt.exe

Path C:\Temp\i_gbytrldbvt.exe
Size 243KB
SHA256 85216633eb1f08ddf5e93555b17769d90f2d37da23a5584bab73bd6551c6d2ad
MD5 bd0d8bf674207b0fc070492760dc76ca
SHA1 105c35ef25d6d007cb809ac29d7ab78092849a7d
SHA512 672845c7b829a5e8cf28357b36999896cfdab0fe63a3794b1b7a93512eaafbce3c1c59fb7cd328a51989e9f6aa76ef3a50d474477c2d45d2207c62a31a2e98e7
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:jvMsLaOa3lLNngoqRttA7O
TLSH
T18D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxvpnhfa.exe

Path C:\Temp\i_hfaxvpnhfa.exe
Size 243KB
SHA256 c9e021aba9df7e1f2de488b245f768251e75becfcead03d722bf2ce433184d3a
MD5 27451e5784aa63dd993f0536a520068e
SHA1 d73c9ff1ea43b35472e439d20ed67cc2bf524344
SHA512 5e32d225f236d80e5c83afb1607c7d5fd48d80a7b0d3136d6e805a51f41b5801f193299687bd6633d787e75a6d9cd1b9f08e1e9c49fd15fb7886d567940df3e6
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:IvMsLaOa3lLNngoqRttA7v
TLSH
T17C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhcausm.exe

Path C:\Temp\i_xspkhcausm.exe
Size 243KB
SHA256 3ad59a6742b1ff860c0f56ece98f9956027bb40c5f6c24544ef4b58f9cb3abf4
MD5 70d61f7886dd70aa26d26bb57ac7bc92
SHA1 d1a3881a74034c1438d8e4eeba40c6c88925214a
SHA512 40cfe3196a85fa30a41b39d71e84778394dd1ae506e6c49013f55246ef6e4742f50a8b8c55eaf5076afec74220f1a69692f6a4dc93b84a6f3995d275f79b8be9
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:ovMsLaOa3lLNngoqRttA7n
TLSH
T165345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnifaysq.exe

Path C:\Temp\i_xvqnifaysq.exe
Size 243KB
SHA256 703b7abe7ab574a18d38cfb8df27e2e5ae16e011336c927cec9e8af665a27932
MD5 bcaea0a3b4975418bfe2eb1dbc59b5b9
SHA1 467a778aa7916e378eefa58caeadf573b49d4ad4
SHA512 926460c885a0371463509dacd5491a0c1fe9935eb9769bdd9abe04cc81ae081430f9da331db1f1a6ed369aaa6c1642035df8f383c1b922afdf07186ede5c0254
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:VvMsLaOa3lLNngoqRttA7Q
TLSH
T15A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxvpnhf.sys

Path C:\Temp\kifaxvpnhf.sys
Size 141KB
SHA256 19eb6bcea2f7aace1106a82396b604bdf0aecdf7f7d331ededbbeb699caf40b6
MD5 e8ffc180990c516a75fc05dce27f0bae
SHA1 4e4d49bcea09269404d942346f42e27574b545a4
SHA512 8ec9e5595d5db7724a069ad053e47a81f8af012b35f3e81f34a7a502ebc0a0701a2cd3956eca8801a62e2887b724cb63b9bf885c7589dc717124007bf8f0b918
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhbztrmj.exe

Path C:\Temp\rmjhbztrmj.exe
Size 243KB
SHA256 24a1fd7b4d07bdf752816651b15aa1febf1aff5f0c2fb41c8d972c621797bc7a
MD5 bb83e6fc6d37bad9f3bd9823e08ac13d
SHA1 612ee17e194a5c3c20786f668b7c1575fb90c4ea
SHA512 77e356306422ab4f1794b23d14167e486c4c3717b0b0fb3f802b00f8420d829c10fb23691e03edbd75d4543c5ea103b61ac58e91a22dce558b93a9e3b15178ad
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:8vMsLaOa3lLNngoqRttA7T
TLSH
T125345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcausm.exe

Path C:\Temp\xspkhcausm.exe
Size 243KB
SHA256 7d190ae2357938097bb3e9dfeca829d57e40ab1b97e5f406f99cd95c49130ef4
MD5 61cfa735a7ed4eebc7d082aeb0beb8aa
SHA1 76d7881087fa9cba934511de304af1d588336cb9
SHA512 c3a741c374c26375b705eb3d0d0765dbe018005149d08dc3b3b1f14ff3f14c978fc1b33ce95561e7327c40552a340cae0046a9a75480e4d1a3fd01dafa37b442
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:LvMsLaOa3lLNngoqRttA72
TLSH
T179345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xuomhecwur.sys

Path C:\Temp\xuomhecwur.sys
Size 141KB
SHA256 1130103e804216adf6df2b3499278bbaec6a64515dc5257cc090d5f26cc10ce0
MD5 73721c8ff058b3ad8f27beb7b85bd077
SHA1 84e0679aa2d1d527298e8426be4623e129b1864a
SHA512 f0d1fab6b9d4fd36f90dc4d2e84dee227e4e58ab39a6999d5b14ec722e1c39d6e65972348a0847efe8d6a8c7ba8a0a83e2660faee38d877f27c562035db0ba3f
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnifaysq.exe

Path C:\Temp\xvqnifaysq.exe
Size 243KB
SHA256 a528e57d874ba75b49305fdd72a4dfe0db18c045d61c9f39ec4f5cdef9d1e612
MD5 710514051f883d20319bba8de2793da3
SHA1 9f37c62163f568bf0005b7048dbe172bdfd68e5f
SHA512 9e747502b811d2cbef6a01a4fdfdf26706c9db284252490b656bc212498822ada5d6391e14442e595339297cbb8ad4901cd8c025d1538c7bd41bfb4790bccbc2
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:YvMsLaOa3lLNngoqRttA7P
TLSH
T112345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 289fe18d56b9af66d8e07294896387e86aa2df424960f20f7d0fdbac2d191435
MD5 91f3c01be0699e4bc9e2a012b9b6e9ab
SHA1 a420dbd52118f59767c604945b4ef936b1d7e1d7
SHA512 3065aae2218211594f6c1e6dc68b404e64041879a1e9036eda18756077f28033991d9e6fb9ce3d540ee52277f1dae0b032429b6ab4d21fa678d0a0fffacd3ebd
TLSH
T1C151CEF7C3E4856DDA1195F0AA187E2BCE1D0915432C7C5AC9E0AF1B93E3471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9cde68c7982a1efa857b531469d2d045e82607f00151bb5924a1efd2d12cc01a
MD5 715c9d254b27da6e4f629e84d2a0ef27
SHA1 b15e4e2099700ee60da926c57dcb319f68320de9
SHA512 0199c79f63ea9c9ef8680a6b914eb2935c328895327a064db6bb1b7bb57120562a3d3efadbf48320854d472c5986de3372c49a9a9d1e529de61440ac2dbaada6
SSDEEP 192:sxR+R2yMqZjK1Ml8UQlcW/f8srgaAZUBMTzoA8pr+/g6+WNCLw/YUIZGDgIgDRjJ:sxR+rqKW/f8srgaeUBnS/5N/5cdV
TLSH
T10272FA16692499378CD7D219FA85BB93D6F91163A2904E44AEFC8B0C11E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7147a613926646c678ca6c7d1c9f3aa53a3bdb30f087c9c794fe2eb32533fc61
MD5 e2b8f0c53cfb6974efb6688d0e88ad9f
SHA1 3ea4883c6457a87011443b911b4389878c7152bb
SHA512 69bf968aaa82505fd99880ea5bf0f97aaeda0fc7faff90ac1ae4abd0ede0e9345fa1f5dff1ed1b3a83daf923c78a4a47a8d0b7b579915a0071ea71c2cd71c0f7
SSDEEP 192:sxR+R2yMqZjK1Ml8wcW/f8srgaAZUBMTzoA8pr+/g6+WNCLw/YUIZGDgIgjIzJ:sxR+rCW/f8srgaeUBnS/5N/5cju
TLSH
T13572FA066924993B8CD7D219FA85BB53D7F91163E2904E44AEFC8B0C15E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f5a7b1ea94fb38ea16784c7e963e9a0e3a22bacefa8ad012920de00469aa5608
MD5 1649338a9cb1dd848d719d18c5a3c13b
SHA1 65cd0fa8796dc13df56345f84cd4c0a635d5d945
SHA512 9afc1b587b6bcba3475038c3873e20b0919d9ab2380da0dc5ed5b392292e8613fc35f59f8273d7f9774920a64ad1ac696324af4fd0cf2735cdd5a278b192e48e
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsFpuOGirocq:4eOlrME7P6WgSYf9Su1jaPFpTG5V
TLSH
T1EFE2FD3B680CCB7E4F80499CED29BD9A6DE802CF5AD8CD5447EA440C03C66EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 49939ef585055f40876e3d87f828b95ea0f0bfc41597a07c67ec03c996bd6436
MD5 a0cfe45b8aacff146b43b24694e67df3
SHA1 06a2c775ba6109ec1478aae593ff30656be7ab90
SHA512 1ad8f2d7eee1713b0d52e8615a73139f85d09a72d0733c6a58ae6e1dcc66f2fb136534e9090a6340ffcda39ad46fd920f6aa2b089707b9179141fbcfe720db1d
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931IO:UVI1zrZi+JK9ALXEoRJnijX59h0
TLSH
T132B26D5171BB1741383D280E93B9842F1A4630A230DEA97B7B6931E56F67E004FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 373cc2da0d75c6e18d8a2ce275b28231636715da9af02dfd135633c47dabcb42
MD5 428a63ea2b09154347be9af6ae80edfc
SHA1 78836877eee9d2843323e8c1bb2177ebcf13ef14
SHA512 656d2064aceb6201016f749b5d684403801e1440f25b9f96ef32290b3e3d3fae3defc09781d21ae7d3f8106d5a3bb947c0398df9dbe06dcdf2804e16acce37a7
SSDEEP 384:nUiF1tNn/s3n9Sz8NX8TUNTUlIRF/PlcA14ukW2n9cfYGLa1EWRxqNmn15wbAjEB:vF1j+9Kawgb1nevn9fGL+xkmn12bfJ/
TLSH
T10EC24936E8A4DA77ADE38FCAB7097646EEE00267C1D859D8DAD81D4D01D32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 85c98511b39693372512fad905d93ecf9326d377c8110bb1442980482ed7d684
MD5 e11cc4e27a3d86d59c9205e34561f655
SHA1 4c46bcd7b4dc01ac913f2d90c74a39f8518b9e79
SHA512 885bf0a4c15d459624a1340d9952164136e9334fccc0d8a7adb95af10856bae7d86d0f287103dd946761bde8f2ab6d82868679e66f01af1051197ad7b256ca17
SSDEEP 768:CF1j+9nEwgJCevn96GLufWFerOfmn12bfJ7Z:39naGfOsM0yJ7Z
TLSH
T1D6E2B3F198D78932E8DE8B87673D2D469AFCC163B5884994FBD84D0CCC961BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ce7681ddfd77e44335700645e0fc910aed155afd9f18a454b24cc7bc44782655
MD5 cd3edff9d66641c9165a06274dfdcb6a
SHA1 ed9c399f104532abba538d01dbad05c29d7e2314
SHA512 124f28469ac21223d923223d3caa1cdb023277f520fb8dda991a7fee5bffe3509b02ef3cc679251ab58a0e59bee42178d095968c410bb8f1509d5914773549e8
SSDEEP 768:wF1j+9KEwgxgevn9fGLufWFePGfmn12bfJ7M:d9KyzfO0k0yJ7M
TLSH
T1E1C25C36D864CE77ACE78BC5B7497686EEE00167C5C84AD8EAD84E4D01D72DE130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3d49e0fe3355032fb9384d1b291f38daba1336ddd6f4064eb0e4f7b8963f4076
MD5 11c2106a244f246ab097dfd452282786
SHA1 e4477e7582c14b7f624ebca89dbd0c8f0d2ad616
SHA512 b8d5a9293a86daac4d7625526baf50c21eed8a415e9fe293a3c214e1d3df50fe141eaf188973a4157306456ce842527dd3d94dd0e340bd37ecf90abe3e0dd279
TLSH
T1DC3141E0983C2DC2C4BD0DAFA09B38F898D8C616F59874796454EC98513E64E758083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 93b47b5fb93e94d18de4efc36e680d78d76162396d686e18ba0f1c3ab05c1ba1
MD5 d9a8f0fd3bcf95ca6c3fd2be32bcbe9e
SHA1 e07cebb9349ccfee6cd2bbb24bcff92d8978ed0a
SHA512 47e584ea6eaed4fdbf8a0b7678c08fbe7bdb2ebfd517a449388093fffe9c85a300c4a923e1f14977801c29062d5fc2dc824e31edb1eb0aaf877f759f0aca9e1d
TLSH
T1333142E098382DC1C4BD0DAFB49B34FC94D8C626F594347D6854E895923D65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 0224ce4bb760b6ea228575cecdf774aa9933f60fd8ad78b26447c3e4f168a77c
MD5 898f625922eeffe7764713faacc02d44
SHA1 05f6d9760c90f5d2f881146798243113cbe57324
SHA512 1f31c5372622b7c475e1c3565b11be77d08e933bceae73b25dd4ca9788e8f6383aea5de20647d48f73a2cfb0509c86c48ebdddd652afb90e81cfcc06818befcc
TLSH
T1A93161E098382DD1C4BD0D6F709738FC94E8C72AF494347D6858E888463E64DA18083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 d9a9a394baf8cecc4c7ed1f93cce54bebb6dd174913272f0cc69513f919fbf8b
MD5 20f2cee336071b5fed6e8978595ad286
SHA1 eef22ed13f62b0c3f234f7c4e4012850b72581ff
SHA512 0741b64c317110d8f4a7aadb14628a0109fe91cb18c60276096302de4b3dc08cb93480bcf311609e846fecb82d964d53b9d349b891958f293b4f683815bd4696
TLSH
T1F43142E09C382DD1D4BD0D6FB49738FC94E8C72AF494747D6858E888467D64DA58083F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1532-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1740-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2464-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2528-176-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3776-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4068-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4756-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-141-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-182-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5012-347-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5484-210-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5640-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5640-302-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5676-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6016-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6264-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6344-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download