72fcbece8b86929e89a99277c432f798f2034af916a38429c7180252aaa1f675

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe
Size 243KB
Sample260704-r2n17act2p
SHA256 72fcbece8b86929e89a99277c432f798f2034af916a38429c7180252aaa1f675
MD5 c6ae5cffce42faec18ae9d463134dae2
SHA1 d6d11bc7c763e4807b8701ce9f3f6baea0cb3cd3
SHA512 2637c2b0534f8a1f5f177346caab15c9e1fc1635c88cc150e21457341c172ed861329ee428225161c3b22f7c4d9a8b773a97868e0e1552d312a50b076f26bebc
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:8vMsLaOa3lLNngoqRttA7z
TLSH
T10B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3212	CP.exe
4796	ljdbvrljdy.exe
4824	CP.exe
944	CP.exe
3824	i_ljdbvrljdy.exe
2156	dywqolgeyw.sys
6732	CP.exe
6832	lgdyvqoiga.exe
6744	CP.exe
2912	CP.exe
1712	i_lgdyvqoiga.exe
5824	qnigayvqnl.sys
5552	CP.exe
2888	qnlidyvqoi.exe
3428	CP.exe
6912	CP.exe
6836	i_qnlidyvqoi.exe
5648	vsqkifdxvp.sys
5288	CP.exe
3672	xvpnifaxsq.exe
2904	CP.exe
6976	CP.exe
6612	i_xvpnifaxsq.exe
4708	kfcxvpnhfz.sys
4724	CP.exe
5852	icausmkfcx.exe
6364	CP.exe
1292	CP.exe
5836	i_icausmkfcx.exe
3688	pnhfcxuspk.sys
5916	CP.exe
804	eczxrpmkec.exe
4436	CP.exe
1672	CP.exe
1328	i_eczxrpmkec.exe
4924	uomkecwupm.sys
996	CP.exe
364	omhezxrpjh.exe
696	CP.exe
3724	CP.exe
1104	i_omhezxrpjh.exe
1644	wuomgeywuo.sys
1676	CP.exe
1968	wuomgezwro.exe
912	CP.exe
3912	CP.exe
6660	i_wuomgezwro.exe
4376	rljetromge.sys
5384	CP.exe
6220	ljebwtqomg.exe
1324	CP.exe
4460	CP.exe
6840	i_ljebwtqomg.exe
1892	bytrligebw.sys
2232	CP.exe
5364	bwtrljdbwl.exe
4444	CP.exe
6472	CP.exe
6148	i_bwtrljdbwl.exe
1308	gdyvqoigay.sys
5260	CP.exe
5876	dyvqoigays.exe
5888	CP.exe
3132	CP.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Other	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1689300771\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1689300771\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_981891834\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1689300771\safety_tips.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_981891834\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1689300771\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\TransparentAdvertisers	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvrljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxvsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvrljdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljdbwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtoljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlidyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlidyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtoljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqnifayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxvsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljdbwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xromhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 21 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6416	ipconfig.exe
6812	ipconfig.exe
6396	ipconfig.exe
1864	ipconfig.exe
6404	ipconfig.exe
2984	ipconfig.exe
1332	ipconfig.exe
3696	ipconfig.exe
4964	ipconfig.exe
1076	ipconfig.exe
4812	ipconfig.exe
1372	ipconfig.exe
1508	ipconfig.exe
6204	ipconfig.exe
6280	ipconfig.exe
6156	ipconfig.exe
4732	ipconfig.exe
7144	ipconfig.exe
5952	ipconfig.exe
3016	ipconfig.exe
6012	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276497005615013"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{6346B0B1-F9AF-4787-B8B8-936DDCD1A900}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3824	i_ljdbvrljdy.exe
Token: SeDebugPrivilege	1712	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	6836	i_qnlidyvqoi.exe
Token: SeDebugPrivilege	6612	i_xvpnifaxsq.exe
Token: SeDebugPrivilege	5836	i_icausmkfcx.exe
Token: SeDebugPrivilege	1328	i_eczxrpmkec.exe
Token: SeDebugPrivilege	1104	i_omhezxrpjh.exe
Token: SeDebugPrivilege	6660	i_wuomgezwro.exe
Token: SeDebugPrivilege	6840	i_ljebwtqomg.exe
Token: SeDebugPrivilege	6148	i_bwtrljdbwl.exe
Token: SeDebugPrivilege	2216	i_dyvqoigays.exe
Token: SeDebugPrivilege	4456	i_gaysqkidav.exe
Token: SeDebugPrivilege	6616	i_icausnkfdx.exe
Token: SeDebugPrivilege	2756	i_nhfaxvsnkf.exe
Token: SeDebugPrivilege	6156	i_upmkeczxrp.exe
Token: SeDebugPrivilege	6784	i_xromhezwrp.exe
Token: SeDebugPrivilege	5408	i_jdbwtoljge.exe
Token: SeDebugPrivilege	5712	i_wtrojgebwt.exe
Token: SeDebugPrivilege	4988	i_nlgdywqoig.exe
Token: SeDebugPrivilege	4228	i_qoigaysqli.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 5984	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	89
PID 5984 wrote to memory of 5880	5984	iexplore.exe	90
PID 5880 wrote to memory of 4520	5880	msedge.exe	91
PID 5880 wrote to memory of 5168	5880	msedge.exe	92
PID 5880 wrote to memory of 3840	5880	msedge.exe	94
PID 5880 wrote to memory of 5168	5880	msedge.exe	92
PID 5880 wrote to memory of 5168	5880	msedge.exe	92
PID 5880 wrote to memory of 3336	5880	msedge.exe	95
PID 5880 wrote to memory of 3336	5880	msedge.exe	95
PID 5880 wrote to memory of 5556	5880	msedge.exe	96
PID 5880 wrote to memory of 988	5880	msedge.exe	97
PID 5880 wrote to memory of 5556	5880	msedge.exe	96
PID 5880 wrote to memory of 5556	5880	msedge.exe	96
PID 5880 wrote to memory of 988	5880	msedge.exe	97
PID 5880 wrote to memory of 988	5880	msedge.exe	97
PID 4696 wrote to memory of 3212	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	98
PID 4796 wrote to memory of 4824	4796	ljdbvrljdy.exe	101
PID 4696 wrote to memory of 944	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	104
PID 5880 wrote to memory of 6424	5880	msedge.exe	106
PID 5880 wrote to memory of 2216	5880	msedge.exe	107
PID 5880 wrote to memory of 6424	5880	msedge.exe	106
PID 5880 wrote to memory of 2216	5880	msedge.exe	107
PID 5880 wrote to memory of 1324	5880	msedge.exe	109
PID 4696 wrote to memory of 6732	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	114
PID 6832 wrote to memory of 6744	6832	lgdyvqoiga.exe	116
PID 4696 wrote to memory of 2912	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	119
PID 4696 wrote to memory of 5552	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	123
PID 2888 wrote to memory of 3428	2888	qnlidyvqoi.exe	125
PID 4696 wrote to memory of 6912	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	128
PID 4696 wrote to memory of 5288	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	132
PID 3672 wrote to memory of 2904	3672	xvpnifaxsq.exe	134
PID 4696 wrote to memory of 6976	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	137
PID 5880 wrote to memory of 1564	5880	msedge.exe	140
PID 5880 wrote to memory of 3856	5880	msedge.exe	141
PID 5880 wrote to memory of 2944	5880	msedge.exe	142
PID 4696 wrote to memory of 4724	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	145
PID 5852 wrote to memory of 6364	5852	icausmkfcx.exe	147
PID 4696 wrote to memory of 1292	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	150
PID 4696 wrote to memory of 5916	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	154
PID 804 wrote to memory of 4436	804	eczxrpmkec.exe	156
PID 4696 wrote to memory of 1672	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	159
PID 4696 wrote to memory of 996	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	163
PID 364 wrote to memory of 696	364	omhezxrpjh.exe	165
PID 4696 wrote to memory of 3724	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	168
PID 4696 wrote to memory of 1676	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	172
PID 1968 wrote to memory of 912	1968	wuomgezwro.exe	174
PID 4696 wrote to memory of 3912	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	177
PID 5880 wrote to memory of 5272	5880	msedge.exe	181
PID 5880 wrote to memory of 5272	5880	msedge.exe	181
PID 4696 wrote to memory of 5384	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	184
PID 6220 wrote to memory of 1324	6220	ljebwtqomg.exe	186
PID 4696 wrote to memory of 4460	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	189
PID 4696 wrote to memory of 2232	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	193
PID 5364 wrote to memory of 4444	5364	bwtrljdbwl.exe	195
PID 4696 wrote to memory of 6472	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	198
PID 4696 wrote to memory of 5260	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	202
PID 5876 wrote to memory of 5888	5876	dyvqoigays.exe	204
PID 5880 wrote to memory of 6432	5880	msedge.exe	207
PID 5880 wrote to memory of 6432	5880	msedge.exe	207
PID 4696 wrote to memory of 3132	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	208
PID 4696 wrote to memory of 2044	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	212
PID 2444 wrote to memory of 3400	2444	gaysqkidav.exe	214
PID 4696 wrote to memory of 4676	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	217
PID 4696 wrote to memory of 5132	4696	2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_c6ae5cffce42faec18ae9d463134dae2_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x320,0x7fffef0dc188,0x7fffef0dc194,0x7fffef0dc1a0
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9568616565954514144,13136937781593688501,262144 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,274578298938168507,14479195540846934126,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:11
      4⤵
      System Time Discovery
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,5875422980977464517,16507168748736319112,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:13
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,4979106900480069258,14263330439111876636,2097152 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,13904954194967842416,796672214390592769,2097152 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,14360664611759339842,5157181558725909189,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:6424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17089766516766039597,3028833401063704672,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13356339170015562590,196834423942705693,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13356339170015562590,196834423942705693,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,2899331086149800608,2170387896309973102,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:1564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,12762431930203344864,6207343414581727940,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,533075200112582348,9874697732715870320,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,11101110264334211384,9022120538084889977,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,7268113015206737207,10897095375258128551,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:6432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,9416890742349507886,17883487249767210620,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5936,i,12662654687833342655,6344761572178833332,262144 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,17654022562021425230,13549302354076818188,524288 --field-trial-handle=2276,i,17610946993451441690,13049500599984213980,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvrljdy.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3212
- - C:\Temp\ljdbvrljdy.exe
    C:\Temp\ljdbvrljdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvrljdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:944
- - C:\Temp\i_ljdbvrljdy.exe
    C:\Temp\i_ljdbvrljdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6732
- - C:\Temp\lgdyvqoiga.exe
    C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2912
- - C:\Temp\i_lgdyvqoiga.exe
    C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlidyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5552
- - C:\Temp\qnlidyvqoi.exe
    C:\Temp\qnlidyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlidyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6912
- - C:\Temp\i_qnlidyvqoi.exe
    C:\Temp\i_qnlidyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5288
- - C:\Temp\xvpnifaxsq.exe
    C:\Temp\xvpnifaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6976
- - C:\Temp\i_xvpnifaxsq.exe
    C:\Temp\i_xvpnifaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\icausmkfcx.exe
    C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\i_icausmkfcx.exe
    C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczxrpmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\eczxrpmkec.exe
    C:\Temp\eczxrpmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczxrpmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1672
- - C:\Temp\i_eczxrpmkec.exe
    C:\Temp\i_eczxrpmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:996
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3724
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1676
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3912
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwtqomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\ljebwtqomg.exe
    C:\Temp\ljebwtqomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwtqomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4460
- - C:\Temp\i_ljebwtqomg.exe
    C:\Temp\i_ljebwtqomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtrljdbwl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Temp\bwtrljdbwl.exe
    C:\Temp\bwtrljdbwl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtrljdbwl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6472
- - C:\Temp\i_bwtrljdbwl.exe
    C:\Temp\i_bwtrljdbwl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\dyvqoigays.exe
    C:\Temp\dyvqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3132
- - C:\Temp\i_dyvqoigays.exe
    C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  PID:2044
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
  2⤵
  PID:4676
- - C:\Temp\i_gaysqkidav.exe
    C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run
  2⤵
  PID:5132
- - C:\Temp\icausnkfdx.exe
    C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:7048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins
  2⤵
  PID:6876
- - C:\Temp\i_icausnkfdx.exe
    C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxvsnkf.exe ups_run
  2⤵
  PID:2928
- - C:\Temp\nhfaxvsnkf.exe
    C:\Temp\nhfaxvsnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxvsnkf.exe ups_ins
  2⤵
  PID:6492
- - C:\Temp\i_nhfaxvsnkf.exe
    C:\Temp\i_nhfaxvsnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkeczxrp.exe ups_run
  2⤵
  PID:6204
- - C:\Temp\upmkeczxrp.exe
    C:\Temp\upmkeczxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkeczxrp.exe ups_ins
  2⤵
  PID:2272
- - C:\Temp\i_upmkeczxrp.exe
    C:\Temp\i_upmkeczxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xromhezwrp.exe ups_run
  2⤵
  PID:7044
- - C:\Temp\xromhezwrp.exe
    C:\Temp\xromhezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xromhezwrp.exe ups_ins
  2⤵
  PID:2700
- - C:\Temp\i_xromhezwrp.exe
    C:\Temp\i_xromhezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtoljge.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\jdbwtoljge.exe
    C:\Temp\jdbwtoljge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtoljge.exe ups_ins
  2⤵
  PID:3060
- - C:\Temp\i_jdbwtoljge.exe
    C:\Temp\i_jdbwtoljge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrojgebwt.exe ups_run
  2⤵
  PID:4664
- - C:\Temp\wtrojgebwt.exe
    C:\Temp\wtrojgebwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrojgebwt.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_wtrojgebwt.exe
    C:\Temp\i_wtrojgebwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  PID:120
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  PID:2580
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:6352
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:6508
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqnifayvt.exe ups_run
  2⤵
  PID:464
- - C:\Temp\vtqnifayvt.exe
    C:\Temp\vtqnifayvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6280

C:\Temp\dywqolgeyw.sys
C:\Temp\dywqolgeyw.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Temp\qnigayvqnl.sys
C:\Temp\qnigayvqnl.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\vsqkifdxvp.sys
C:\Temp\vsqkifdxvp.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\pnhfcxuspk.sys
C:\Temp\pnhfcxuspk.sys
1⤵
- Executes dropped EXE
PID:3688

C:\Temp\uomkecwupm.sys
C:\Temp\uomkecwupm.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\wuomgeywuo.sys
C:\Temp\wuomgeywuo.sys
1⤵
- Executes dropped EXE
PID:1644

C:\Temp\rljetromge.sys
C:\Temp\rljetromge.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\bytrligebw.sys
C:\Temp\bytrligebw.sys
1⤵
- Executes dropped EXE
PID:1892

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:1308

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
PID:2864

C:\Temp\pnlfdavsnl.sys
C:\Temp\pnlfdavsnl.sys
1⤵
PID:5828

C:\Temp\usmkfcxvpn.sys
C:\Temp\usmkfcxvpn.sys
1⤵
PID:260

C:\Temp\uspkhfzxrp.sys
C:\Temp\uspkhfzxrp.sys
1⤵
PID:3168

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:5756

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:1800

C:\Temp\ywqomgebwu.sys
C:\Temp\ywqomgebwu.sys
1⤵
PID:4704

C:\Temp\oigbywqolg.sys
C:\Temp\oigbywqolg.sys
1⤵
PID:948

C:\Temp\aywqoigbql.sys
C:\Temp\aywqoigbql.sys
1⤵
PID:6376

C:\Temp\xvtnlidays.sys
C:\Temp\xvtnlidays.sys
1⤵
PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqolgeyw.sys

Path C:\Temp\dywqolgeyw.sys
Size 141KB
SHA256 da95f93c073c3fe223e2dbcb591810568636ed25e52b5633bb3026b154220a04
MD5 a107d63d5d60e497fdac2e189fd0fd34
SHA1 020e35d954753f161eefd73caed761b9d90c8ccc
SHA512 14b8c888f5f4f27a22c30fe167dc4094ac6d80038f8e1927225451c430c07fb86b32b7bed3072641748b696930d179627758b1e11e13b6fd97f3d4ab3f04e145
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T137E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczxrpmkec.exe

Path C:\Temp\eczxrpmkec.exe
Size 243KB
SHA256 4b6e2135a0d402cdb2b18592c2a306e42b7df0daf61200efbdc159d5592bfe99
MD5 76adc4f22262969e44a66c5b942b9b99
SHA1 5661ebd3be54c223f08f9a70e586633bc0e7c073
SHA512 f52f9d5ae9c8e07091a5095123ba92c4798ed4ebab43bd738cd83cdca73398476933dfcd877ac3acd714382c63b8e55bea3e4586935191d64d045519d26b7b0e
SSDEEP 3072:eCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:RvMsLaOa3lLNngoqRttA7E
TLSH
T1E1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczxrpmkec.exe

Path C:\Temp\i_eczxrpmkec.exe
Size 243KB
SHA256 2f9099481f7f73f725e89e372589b939ffc2e05018d35dad8f3abe49a966db8a
MD5 c98a3ce3c1535a96baf238f9736231d9
SHA1 0cd2a1e595303264466c50eea2bbdb7f4dbf6aba
SHA512 4c8d7c9e562fc7b83bedcf8ced963b91c2897c0e5a7205420051202690aa1542505755b337994ddb55cddae3e479ef70ac5fd2abc48001a3b4f3b31dc0d9f613
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:dvMsLaOa3lLNngoqRttA7M
TLSH
T192345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icausmkfcx.exe

Path C:\Temp\i_icausmkfcx.exe
Size 243KB
SHA256 a1f4e3ba9c6c81a0bb81592458232b5816a49c861429a751aeedfb0daa4937e9
MD5 ff2ddb00109416e207555303a37ca173
SHA1 ffebbd98fa90bb7a8185c2f232a2de0a843736f3
SHA512 875191f228952b1e6a129001e7247432a7d43299fd16c55ebf0476dbd72bbe489abf313c535809bc448171403d5acd9f61ef6382bc8acf503df97b3c154694a8
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:UvMsLaOa3lLNngoqRttA7D
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvqoiga.exe

Path C:\Temp\i_lgdyvqoiga.exe
Size 243KB
SHA256 6dc2a6ef62a52460eec30faf6e6fb4b837e61f971a99c18618377617fee03f41
MD5 9a362b2a06be57e5a827926fb6ecf7ae
SHA1 35ee071ee816aec9b7e010baeeb227f2d9d7abe0
SHA512 628de0f7900141dcad46fa9df7acc7d64c8cff5eeca866372c7933182b92927f63ef88073350578555fe5820e714995a0056073f1ea57cb9f1b20e8208a29411
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:BvMsLaOa3lLNngoqRttA7Q
TLSH
T184345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvrljdy.exe

Path C:\Temp\i_ljdbvrljdy.exe
Size 243KB
SHA256 7bdc16d6088dfd16f82585947353dd201456b17cff42698fb642222f549888d8
MD5 a6d437835c6cf7eead853f506abfc03c
SHA1 70e6aceb88fe50ad9a59567f023ddcfc6cc746c1
SHA512 b7f86d0ec3f4546df4f014105b963e793a22faaef103265db2527395af014b5df8f9a550e7413d17f47d084fdb7648e55c5aa5762fec621f6e52ff2abf93c6cf
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:cvMsLaOa3lLNngoqRttA7b
TLSH
T10B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlidyvqoi.exe

Path C:\Temp\i_qnlidyvqoi.exe
Size 243KB
SHA256 163f98647ee4241c158de68ef8e20e4bd586463d835612fad862804b498b8941
MD5 f91540a42c2cbb4556b2b8f0e13408a2
SHA1 3b9b87357b7ee8e42f55c4f39e52cbd510ca49dd
SHA512 de3028227b120553b222969935d050c8a2467491e6c4fcf8c1dba5ec6b3c7e301baa1c38545a1707a89b0fa4a12656a253f65f83f8d7c8cae890e3d2cdc25988
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:dvMsLaOa3lLNngoqRttA7g
TLSH
T121345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifaxsq.exe

Path C:\Temp\i_xvpnifaxsq.exe
Size 243KB
SHA256 cbf5bfb179036172afaab2c8112ab8a20e88b9506bdacfd5f3f33e2adeb24385
MD5 b9af7f0141db4a7dc911034ef35df6f2
SHA1 5315f5b02febf3c10edbefa2e76d3072670346b0
SHA512 26aa6d83f362168f8d90571b521b4a4eab59e891c30c790f7e042582de5f02a94b5bfdd5da3df71fd5f8b8b2435730944689c3a268064330371648cbcc0281cf
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:vvMsLaOa3lLNngoqRttA7K
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfcx.exe

Path C:\Temp\icausmkfcx.exe
Size 243KB
SHA256 fecbd08dc08a6698b8c164a1b85ae640ab3d434f5e244aeb91c22a72894cd416
MD5 55ecac30a1d470aaa081ccc6861f6775
SHA1 12790449169b92e7f2c3eb293e857aa1e87a3cdc
SHA512 49fccf4cf0e18c9e581bae99eee17a547f286098f75261c2fdb89aedbd6daa3ca6825635cb1b1a01d8af0bc291584dda6f00e2e5a2f52e02105028b55bc5174e
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:dvMsLaOa3lLNngoqRttA7A
TLSH
T11A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 141KB
SHA256 d6c4740f91a4f5c387457b5440478a5ba126224c2abe5a996521a346f2f76092
MD5 6e23c900e5ab2f5a08d9e80c458d85f0
SHA1 49d921c5af841a0447fb5e85d2fc3fc8c291b334
SHA512 0dd5124e8fce27001b8fa80b798d29398338983bc98047a4667aa00054da9750098622731beb8b84761418fbe0487db0728d2478e9a4d4a9bd32215ddb8631ee
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvqoiga.exe

Path C:\Temp\lgdyvqoiga.exe
Size 243KB
SHA256 07841826619f9cdeb83027a703374fc8769f6aafd77314606d725b44bfaf0c70
MD5 5da20da4cfacb57aaab2a764c0c5ca7a
SHA1 239bdf919d66366ae8c248d09d9a27ef8a295ae9
SHA512 74dcce1f10025f102aead2ea24a876b1ac6437195ab15753fb5d477b80bec712ccc4770c5ed721b73d08aceef1b0286fd0ab5e4d6f25ae8904153917a996d722
SSDEEP 3072:NCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:AvMsLaOa3lLNngoqRttA7v
TLSH
T13F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvrljdy.exe

Path C:\Temp\ljdbvrljdy.exe
Size 243KB
SHA256 854f160b4ebbf1897a3c7edb84cf845461030e8a7701b21204f83cb4bb52e31d
MD5 f27cbd9902360c2dc746a7ef2150b1a5
SHA1 0f4ce1021d676e4eea8fa9bc8098d688f5f31ccb
SHA512 9be196aa321562245c7dc8b4db57f1871ebbed88faea8ee7d1afdf5ee8548c7486806cdb947c75918de567c8862871e8437975a585e597291e43d1d54c8a10bb
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:VvMsLaOa3lLNngoqRttA7A
TLSH
T13C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezxrpjh.exe

Path C:\Temp\omhezxrpjh.exe
Size 243KB
SHA256 83adc8ae59ffe1c80cf56eb98491518acb821da557c61c8b0c6a65de59ca5813
MD5 cad791557bf3c92a115b78e041219491
SHA1 9e9aef7305387bc1f049b4ef50e7ef4ad0e8cf88
SHA512 37b30ca63d9195ab5afce0fc727a9442d93e4a64d040883b29341914591c48cc0c763d34fae91fb7cd3b969a5c9b1affda82ab003a497640107bbd347e5138b0
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:uvMsLaOa3lLNngoqRttA7d
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfcxuspk.sys

Path C:\Temp\pnhfcxuspk.sys
Size 141KB
SHA256 ac854597c4307934cd779ac2aa1b6c8320a7ab810c2f645fd5ca698c7a29b19a
MD5 ae43e7f1ae5a391be2eb6ef010c731bd
SHA1 fd7ff04411bd452ad0353535eb46338578f066cd
SHA512 cba1b4418d90295c6b66bb14e3dbf63cf2aae2eccadbf717e0361bfe5f10dc02140557715fa491ef5207faa17ccc4ed38ffd5cebcf884dba625dd9b23056bf30
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigayvqnl.sys

Path C:\Temp\qnigayvqnl.sys
Size 141KB
SHA256 caea9232d93d6024288dadc4016c05efe24285729363f635c48a67d6a0b02dfb
MD5 9e834cdd6c5281e4e639192eaedd54f2
SHA1 bcf18e4ce0cc7cd4fa43e79f3da649722b2760b8
SHA512 8ae0ad1b4af78b3c40cbbcd57d63dbeabe2fa6050acdee4e7018eae9fc7fe22ca980118f2aaca416665292e2f72a6dc274663d69fcf532b86c93844098453131
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidyvqoi.exe

Path C:\Temp\qnlidyvqoi.exe
Size 243KB
SHA256 f71bb99d399955a98817ffee59bfaec26b57c73bf787d392a4c999abd0982e7d
MD5 d37aad484bd25d0776d31772cdc06355
SHA1 c77607c35a85492c5b7543948cb0db78618e7c07
SHA512 e929d1e52ee3bf3494942c39b80dccd74432684b6aeb40bf1d18ed238a8c7e37e463bcac0d69a81ef98dffab4e34d57b8efe1260ad79e4507b52cdc87420ea5b
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:9vMsLaOa3lLNngoqRttA70
TLSH
T100345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomkecwupm.sys

Path C:\Temp\uomkecwupm.sys
Size 141KB
SHA256 91b30541eebb617fffc39047c3cf078514b7f796f9c69891f8669d8f272e5f64
MD5 dcec0b2a1a773c15ae1a0c221ee96b27
SHA1 7d7edafe70981d7bb0cbc358632d51bd567a9b47
SHA512 e156dd02a39e8cc670cb5b579b136222bbf6cdb35ade40f3501fb6be34d261a5caa811bb6f77b18d7772b6fc4e0e2b1c372a5f0c9cadb6c8cd3af2599a40c77d
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkifdxvp.sys

Path C:\Temp\vsqkifdxvp.sys
Size 141KB
SHA256 efd509cea71e6cce97a2dc95a92c334d3bf333265461b8b3b632ad806f364d64
MD5 9209664823213a21c41c29e64103c650
SHA1 43d1d196f0231e7f425b66805b50a34994d3c1d7
SHA512 21b36da0e3333fb4e1b527f0b7eeaa31b80d0f02433f39d9ca1f46954181baae28eff73e6c3cc0748f9d23708f161baadb699cb5809f6c02ffb6e056132f2519
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaxsq.exe

Path C:\Temp\xvpnifaxsq.exe
Size 243KB
SHA256 ae5b997c5a9de3dc3fabb8625ae0de90c6d838b8e5438224f183b38bbeda9263
MD5 7e0b1b126e875c66c9e215099c059d3b
SHA1 6f50ffdc26a9ddc82c280af159121cb8a26463d9
SHA512 07237bdf08ea89a375b53ccd3fcc769c35439a0f8dbbcbaa5ecd75e3f39e9ea5164158638abd53e5ad03762dc0b7633bb5026131e5b7e8adc0bc43d0e86b978f
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:bvMsLaOa3lLNngoqRttA7O
TLSH
T1F1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0991b24f42990a6dd956c7f420a533b29e604e60e7a897332bdc61a539c26416
MD5 486d8306e75c61587896d8d24c9c7fcd
SHA1 2cf13981ac9821a7e47a5741c9e09c9a751bbb31
SHA512 c1e830c5fff93623c5331f8a24a132e4ad811becb29d4a4a6aac1802ac6a984deb7492d1731d9c513be15d9adc8be2ffebcf934838fb0d7c46be328072718c87
TLSH
T13E41E0F383F4856E890195F0AA187E2BCE1C0910432C3C5AC9E4EF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 401b37bdfc56db6e47bc983295c32529f224da8f5adab2acc751e2a8705e0374
MD5 928147530e91593bf87aa12e9f33a50e
SHA1 de6e7da7c65ea71f5cbfc3e946b62629935787b3
SHA512 db32eb37ee384cd7447c95a2c06ae1f55e31a46f2a7d6fd3a8aa7f97adfb141b2fcd109a8bdab5b564fcb63c016b18656a564c21d29fadc6a2302ca6903e62e6
SSDEEP 192:sxRbRZyMqZjK1Ml8UQmcE/fRsCwO7pZsGJlsJqzoA8prt/g6+WNCec/YmkIGQIg/:sxRbCqFE/fRsvUnsGr4nR/58/3yk
TLSH
T1C372E81A6A38497B8CDBD219FA557B63D2F91173A2904F44AAFC8B0C11E76DD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d27e0072db2f61d3b91e60963d5265b3ddc0928f9d76b65a83c94cbeb3a4f54a
MD5 36b23d757a7e74d65cf597601314c69e
SHA1 335b419056c3213bdd06d46d4d542b2a04a2f44c
SHA512 5e8fbb291805b9d8a551ff9ea20d0fa0f5d4d50e4182bb441c699e8d10931507e22b35ef36b5aaa87076e6cf49e4dc50d9bb9c07dbac9c16436f1d264394eefd
SSDEEP 192:sxRbRZyMqZjK1Ml8wcE/fRskwOKpZsGJlsJqzoA8prt/g6+WNCec/YmUIGQIgjSe:sxRbCCE/fRs1JnsGr4nR/58/PjKG
TLSH
T12E72F91A6A34597B8CDBD219FA557F63D2F91163A2804F04AAFC8B0C05E76DD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 08eabcbd844d2768c95b2984ee229d1443c49f1bf8c2382149b0c09aa345474f
MD5 e24ae64bfd7ee8c6b391f39013e5d566
SHA1 e8283ce49f3e041c2dd132039ef7002c2b9e12af
SHA512 ea2f0f3cb96b3468f09b5374e43dbbe32e7d54de25fbd3cc5718735bbed6bb74b026a7371ce63938437918ea4849f341dcda366e01d5c0a28f10c947bdb084db
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIu7z9wQroPw1Lf:RGqO3VE7yrWgzvfiXu1jafu7pw7Pw1Lf
TLSH
T103E2ED3B680CC77F4F804A9CEC29BE9A6DA802CF56D8895447EE844C03C7AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 cea2207b2bdc7cb2edeea8cd1ce6b1f6c055dfffd33934136ca7004dcc0d9e45
MD5 d48ebe41f5c174510899b6366e38f73f
SHA1 55e7e56d83cb8a14552f195bda756efbb3d916e5
SHA512 3fddbf378bfa6e4c5574803da5b8ea256808e5792eb659443d59766af88f00fe070501185baf0cd014d954ef8aec3ea566f7152cb11244087b350cb9097a36d7
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83MtU:aR55IlHnOLRXxxinLDc
TLSH
T155B2CE5171BA2B00387D29099379D42F1A4630A270DEA87B3B6835E16F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4d16da76f8a2b4c985c0d9e65b111cab5bfa36d8f2ba0f0295a0b1b806ea160e
MD5 20da9bde3926b116bb413c5613a7649b
SHA1 80a75ab4ef854863d93395f6d2ddb135ef011dd0
SHA512 5ac146095ccaed1dffa684760d2103f9c5c8a9ac026be159e4526e31e7b3e242eda2811d223f60426d0b959371d18026301c69bda0aba82c5402bdd979d08730
SSDEEP 384:n8iF1tNn/s3n9SsD8Nl8TUNTUlIRYpznNVfHX+fo1oY5IepAAomn15wbAjEJ28L0:nF1j+9Rcwg+to6gAomn12bfJq
TLSH
T139C24A36D8A4CA7BECF38FC9B709B61AEEE412A3859819D4DAD95D4C01C31DD0307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6b28b654f2206e41606d7f3dfd9ea05f37897ab7749dcddb9ce0398370dbc211
MD5 51fdb770c6e8897f10c7b229d0c47bbd
SHA1 2b9d6e5fc99981178bdf84520c9371d5d22e1215
SHA512 792fd34bd95e20e6021bc5d4f541a8ff179271d3ad1d73be8c20a3a18625e0f9f6aa16394d240e29a7fe5db8995c8aa89dc1431cf5a69818f2568903d6037206
SSDEEP 384:nqiF1tNn/s3n9Sd8Nr8TUNTUlIRsznNvdyX+fo1oY5IepABDclOObjI9G6w7rUBW:hF1j+9kewgU6o6gBYl29MZ
TLSH
T170E2C2F198D78A77D8AE4B87677D2E569AFCD163B4884984F7C85D0CCC821BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 64ae1d61037c698e9727dca7a82eb1ccf867cf271e14e5bacdbbc6eecc07c6ba
MD5 ab9114e627e7da1abaf6530521af2252
SHA1 d80a7cf37dab6a69cf269312536d26b84b6a33e2
SHA512 5330a037157adbdb6d907458c9cbecc19411b9c504c13daef440dc51ac002fb5ceb6534b729b32638806ceafd58201e1a439e85e3f25b6258e6b1661d53bb1ab
SSDEEP 384:nziF1tNn/s3n9S68Nr8TUNTUlIRsznNvjyX+fo1oY5IepABDmlOObjI9G6w7rUBW:eF1j+9vewg+6o6gByl29MZ
TLSH
T13DD24932ECA5CE77ACE64BD9B74A7A5AEEE412A3858C4DC4DAC95E4C01C31ED0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 43706eea8dcfe224035efd3de8ad10060276bb8062d3e24ded9134fa63701d2d
MD5 dc1f5b6ac6d09f71191e385a32c00a65
SHA1 225b3fe8a24000bdf29eb234de0cec9c8d129840
SHA512 409c281ac21c9b97251ecf67221115d1bce15e892129b571e7b6f027f66f09d63a3ff6fd1cce5d1cd42fd0684ac66a664328278db8c4d211711c5b003cf709c3
SSDEEP 384:nziF1tNn/s3n9SsD8Nr8TUNTUlIRiznNmjyX+fo1oY5IepABDmlOObjI9G6w7rUQ:eF1j+9Rewg36o6gByl29MV
TLSH
T191D23A32E8A5CE77ACE64BD9B74A7A5BEEE412A3858C5DC4DAC95E4C01C31ED0307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1edb301c73064d13c15c9b58cb5da13876589b93217a8e19095b600839b1144b
MD5 c7e677e9279489252b0c9637852fe066
SHA1 1d8a7d4e215ec032a80103feb2a1ca785351654b
SHA512 30f82f3c0b3ed74ee9f4ad20ab072d85678492d0862bf3d650e607bc80c5ec4383692d35840dca5fba7cfb4e5bec3ea22bb830c6a8d99ea6cf9691093d0567b5
TLSH
T15C3141E19C3929C2C4BE0DAF744B39FC94E8D326F59470386888EE58523A65E224087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fce23ea2a7ea1f2813cf1e8165b8f09831c013f2234006d58063fc698f2fdc6f
MD5 7d22d822a19b10c49b50f3c7d280bf1c
SHA1 151586289e866e4cb7cf71ee38107bf98e679d8c
SHA512 3628b8a03047d23f259e5267d0a1d5f68b6b1dac2343fe89eea0d64f3b52d23d6d30ec9d53ead54ab7848c6b1d2570738f4cf65ae12da30735e47a0e02f5f595
TLSH
T1C03142E05C3829D1C4BE0DBFB44B39FC94E8D326F8A4703C6844EE58567A25E224047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 31fa46e668eb5a51efc7119707121f6695527135642ebd9485d154ad34d35691
MD5 9744276a02022a745cfab5c62928a249
SHA1 539b79b6a5977ac2d3def75f0f7bed9576531288
SHA512 529ced3a918e704fc2148e5d4be7e0d870b00e552f404544db843aec3a34d1a66caafecc6be343653d49d8f198cc6f75c69107094b39b45fa849f3dbbb42f440
TLSH
T1A22142E19C3929D1D47E0DEFB04B25FC94E8C316F49434386858ED98567A15E224087F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5880_1430427526\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/260-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/948-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1308-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1644-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1800-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1892-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2156-150-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2864-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3168-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3688-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4704-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4708-218-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5648-205-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5756-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-177-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6376-482-0x0000000000010000-0x0000000000083000-memory.dmp

Download