96421ed54751d56b88e21ab671359c75131a4da9e5dd2a770807e7ae0b4e9fdd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
Size 243KB
Sample260729-nadvcsvscv
SHA256 96421ed54751d56b88e21ab671359c75131a4da9e5dd2a770807e7ae0b4e9fdd
MD5 3a6707f1c0aa83c01e8408ed724a08ab
SHA1 b6c0af0c448a9fd0cb3827a49e54d7a05e37c1b2
SHA512 f43eb0e0fa9175000e43dc53ac7061b56dffa73db8f42bcdbcbdab7b7ad76babdc059c599064bb9a3c65e4aa0a77d66624d8f95c6405cc2b511043ccfd6e0def
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:ZvMsLaOa3lLNngoqRttA7Y
TLSH
T135345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2572	CP.exe
4012	pjeczusmhc.exe
3548	CP.exe
5556	CP.exe
4120	i_pjeczusmhc.exe
5392	gezwrpjhbz.sys
3516	CP.exe
4764	wuomjebzto.exe
3460	CP.exe
4532	CP.exe
5660	i_wuomjebzto.exe
2932	qomgeywroj.sys
4100	CP.exe
2300	ojgbztrljg.exe
1592	CP.exe
5360	CP.exe
2768	i_ojgbztrljg.exe
2072	lgdbywqolj.sys
5576	CP.exe
4636	jdaytqoigd.exe
4956	CP.exe
1596	CP.exe
4288	i_jdaytqoigd.exe
6040	lidbvtnlfd.sys
4624	CP.exe
4796	dywqnigays.exe
5004	CP.exe
6120	CP.exe
2328	i_dywqnigays.exe
5368	aysqkidays.sys
5032	CP.exe
4176	yvpnlidays.exe
3416	CP.exe
4028	CP.exe
1076	i_yvpnlidays.exe
4588	uspnhfdxvp.sys
2540	CP.exe
6100	xvpnhfzxsp.exe
2580	CP.exe
4188	CP.exe
4640	i_xvpnhfzxsp.exe
2592	icaxspkica.sys
2360	CP.exe
1400	caxsmkhcau.exe
260	CP.exe
1388	CP.exe
4120	i_caxsmkhcau.exe
4648	ecwurpkhfz.sys
5864	CP.exe
2828	zxrpnhfzxr.exe
5040	CP.exe
1536	CP.exe
4484	i_zxrpnhfzxr.exe
980	omgezwrpjh.sys
4060	CP.exe
4780	jecwuomgez.exe
5740	CP.exe
5936	CP.exe
5372	i_jecwuomgez.exe
1392	ywqojgbywr.sys
5448	CP.exe
1096	wqoljhbztr.exe
6012	CP.exe
5368	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1829951040\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_826628308\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_374179182\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_374179182\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1829951040\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1542657674\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4704_1710604197\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1663524230\_locales\hr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjeczusmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvpnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtojgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvpnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxsmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtojgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxvpmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjebzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjeczusmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdaytqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxsmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjebzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxvpmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdaytqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoljhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkhb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
108	ipconfig.exe
3004	ipconfig.exe
5328	ipconfig.exe
4288	ipconfig.exe
3420	ipconfig.exe
4640	ipconfig.exe
1764	ipconfig.exe
4648	ipconfig.exe
6032	ipconfig.exe
5148	ipconfig.exe
1880	ipconfig.exe
4016	ipconfig.exe
2212	ipconfig.exe
2372	ipconfig.exe
4976	ipconfig.exe
3004	ipconfig.exe
4952	ipconfig.exe
6048	ipconfig.exe
2768	ipconfig.exe
5372	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297970871806529"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{95E452BF-9E47-4914-BBF5-B8FA67997B82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	i_pjeczusmhc.exe
Token: SeDebugPrivilege	5660	i_wuomjebzto.exe
Token: SeDebugPrivilege	2768	i_ojgbztrljg.exe
Token: SeDebugPrivilege	4288	i_jdaytqoigd.exe
Token: SeDebugPrivilege	2328	i_dywqnigays.exe
Token: SeDebugPrivilege	1076	i_yvpnlidays.exe
Token: SeDebugPrivilege	4640	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	4120	i_caxsmkhcau.exe
Token: SeDebugPrivilege	4484	i_zxrpnhfzxr.exe
Token: SeDebugPrivilege	5372	i_jecwuomgez.exe
Token: SeDebugPrivilege	5696	i_wqoljhbztr.exe
Token: SeDebugPrivilege	1448	i_qolgdywqoi.exe
Token: SeDebugPrivilege	4032	i_bytqljdbvt.exe
Token: SeDebugPrivilege	2552	i_nlfdxvtqli.exe
Token: SeDebugPrivilege	1448	i_ifaxsqkica.exe
Token: SeDebugPrivilege	2160	i_czxvpmkifz.exe
Token: SeDebugPrivilege	3820	i_fzxrpkhcax.exe
Token: SeDebugPrivilege	788	i_jhbzurmkhb.exe
Token: SeDebugPrivilege	1124	i_jhezwuoljh.exe
Token: SeDebugPrivilege	480	i_dbwtojgbyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 2832	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	88
PID 2832 wrote to memory of 4704	2832	iexplore.exe	90
PID 4704 wrote to memory of 2564	4704	msedge.exe	91
PID 4704 wrote to memory of 4416	4704	msedge.exe	92
PID 4704 wrote to memory of 3068	4704	msedge.exe	93
PID 4704 wrote to memory of 4416	4704	msedge.exe	92
PID 4704 wrote to memory of 4416	4704	msedge.exe	92
PID 4704 wrote to memory of 5140	4704	msedge.exe	94
PID 4704 wrote to memory of 5140	4704	msedge.exe	94
PID 4704 wrote to memory of 5848	4704	msedge.exe	96
PID 4704 wrote to memory of 5848	4704	msedge.exe	96
PID 4704 wrote to memory of 5848	4704	msedge.exe	96
PID 4704 wrote to memory of 1324	4704	msedge.exe	97
PID 4704 wrote to memory of 1324	4704	msedge.exe	97
PID 4704 wrote to memory of 1324	4704	msedge.exe	97
PID 4704 wrote to memory of 5764	4704	msedge.exe	99
PID 4704 wrote to memory of 2296	4704	msedge.exe	98
PID 4704 wrote to memory of 5764	4704	msedge.exe	99
PID 4704 wrote to memory of 5764	4704	msedge.exe	99
PID 4704 wrote to memory of 2296	4704	msedge.exe	98
PID 4704 wrote to memory of 2296	4704	msedge.exe	98
PID 4704 wrote to memory of 2944	4704	msedge.exe	100
PID 4704 wrote to memory of 2944	4704	msedge.exe	100
PID 4704 wrote to memory of 2944	4704	msedge.exe	100
PID 4704 wrote to memory of 3032	4704	msedge.exe	102
PID 4704 wrote to memory of 3032	4704	msedge.exe	102
PID 4704 wrote to memory of 5772	4704	msedge.exe	103
PID 4704 wrote to memory of 5772	4704	msedge.exe	103
PID 4704 wrote to memory of 5772	4704	msedge.exe	103
PID 4856 wrote to memory of 2572	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	104
PID 4012 wrote to memory of 3548	4012	pjeczusmhc.exe	107
PID 4704 wrote to memory of 3520	4704	msedge.exe	110
PID 4704 wrote to memory of 988	4704	msedge.exe	111
PID 4704 wrote to memory of 3520	4704	msedge.exe	110
PID 4704 wrote to memory of 988	4704	msedge.exe	111
PID 4704 wrote to memory of 4460	4704	msedge.exe	113
PID 4704 wrote to memory of 1400	4704	msedge.exe	114
PID 4704 wrote to memory of 1400	4704	msedge.exe	114
PID 4704 wrote to memory of 2420	4704	msedge.exe	115
PID 4704 wrote to memory of 2420	4704	msedge.exe	115
PID 4704 wrote to memory of 2120	4704	msedge.exe	118
PID 4704 wrote to memory of 2120	4704	msedge.exe	118
PID 4704 wrote to memory of 4072	4704	msedge.exe	119
PID 4704 wrote to memory of 4072	4704	msedge.exe	119
PID 4856 wrote to memory of 5556	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	120
PID 4856 wrote to memory of 3516	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	124
PID 4764 wrote to memory of 3460	4764	wuomjebzto.exe	126
PID 4856 wrote to memory of 4532	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	129
PID 4856 wrote to memory of 4100	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	133
PID 2300 wrote to memory of 1592	2300	ojgbztrljg.exe	135
PID 4856 wrote to memory of 5360	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	138
PID 4856 wrote to memory of 5576	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	142
PID 4636 wrote to memory of 4956	4636	jdaytqoigd.exe	144
PID 4856 wrote to memory of 1596	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	147
PID 4704 wrote to memory of 5968	4704	msedge.exe	150
PID 4704 wrote to memory of 3292	4704	msedge.exe	151
PID 4704 wrote to memory of 4916	4704	msedge.exe	152
PID 4856 wrote to memory of 4624	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	155
PID 4796 wrote to memory of 5004	4796	dywqnigays.exe	157
PID 4856 wrote to memory of 6120	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	160
PID 4856 wrote to memory of 5032	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	164
PID 4176 wrote to memory of 3416	4176	yvpnlidays.exe	166
PID 4856 wrote to memory of 4028	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	169
PID 4856 wrote to memory of 2540	4856	2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_3a6707f1c0aa83c01e8408ed724a08ab_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7ff8495ac188,0x7ff8495ac194,0x7ff8495ac1a0
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,3292125916482862922,17634481732096284185,262144 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10959257123288087567,3161892236486525124,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,12888396300802607083,5407508400202333239,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,2013036592647793159,1512377294535564926,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,12732793718920016432,8000810111378010170,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,13243357845911068798,13201775041194667819,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,589959439060688598,16535934709860892036,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:9
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4364,i,6042618200156498583,3125619208053648323,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,4776291163812595356,5168700459631479968,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3816,i,11330909734467935582,7371698042238209161,2097152 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,16333987752261195695,2518797905403836052,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,10919339579870045249,1501754175481068224,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8748697353743067353,17487469818083635748,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,8748697353743067353,17487469818083635748,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,5224660750965383682,4944825811623034629,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,1737718001105948247,10099536134597314716,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,8990643650002033163,5952449655353481876,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,16654947815043657510,6077892951703496307,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,16169908379467541077,8433448991544670104,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,4883143012442483445,14905718332316713830,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,5524266960418695100,3639240859670909393,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,5120803530832311050,1315329455725623645,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,10716976181004934690,10756009182985850793,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,8618309213828987335,11432499655984744027,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,16387917097628009120,10198777500727636028,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4356,i,10373267955755687197,12510151616676382257,262144 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10510994025847758050,6658423849827157598,524288 --field-trial-handle=2272,i,3178200541527481527,5628416675231432398,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjeczusmhc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2572
- - C:\Temp\pjeczusmhc.exe
    C:\Temp\pjeczusmhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjeczusmhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5556
- - C:\Temp\i_pjeczusmhc.exe
    C:\Temp\i_pjeczusmhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomjebzto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3516
- - C:\Temp\wuomjebzto.exe
    C:\Temp\wuomjebzto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomjebzto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\i_wuomjebzto.exe
    C:\Temp\i_wuomjebzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\ojgbztrljg.exe
    C:\Temp\ojgbztrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5360
- - C:\Temp\i_ojgbztrljg.exe
    C:\Temp\i_ojgbztrljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdaytqoigd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5576
- - C:\Temp\jdaytqoigd.exe
    C:\Temp\jdaytqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdaytqoigd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Temp\i_jdaytqoigd.exe
    C:\Temp\i_jdaytqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\dywqnigays.exe
    C:\Temp\dywqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\i_dywqnigays.exe
    C:\Temp\i_dywqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvpnlidays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Temp\yvpnlidays.exe
    C:\Temp\yvpnlidays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvpnlidays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4028
- - C:\Temp\i_yvpnlidays.exe
    C:\Temp\i_yvpnlidays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2540
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4188
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxsmkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2360
- - C:\Temp\caxsmkhcau.exe
    C:\Temp\caxsmkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxsmkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1388
- - C:\Temp\i_caxsmkhcau.exe
    C:\Temp\i_caxsmkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpnhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Temp\zxrpnhfzxr.exe
    C:\Temp\zxrpnhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpnhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1536
- - C:\Temp\i_zxrpnhfzxr.exe
    C:\Temp\i_zxrpnhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4060
- - C:\Temp\jecwuomgez.exe
    C:\Temp\jecwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5936
- - C:\Temp\i_jecwuomgez.exe
    C:\Temp\i_jecwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoljhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5448
- - C:\Temp\wqoljhbztr.exe
    C:\Temp\wqoljhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoljhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Temp\i_wqoljhbztr.exe
    C:\Temp\i_wqoljhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qolgdywqoi.exe ups_run
  2⤵
  PID:3348
- - C:\Temp\qolgdywqoi.exe
    C:\Temp\qolgdywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qolgdywqoi.exe ups_ins
  2⤵
  PID:5304
- - C:\Temp\i_qolgdywqoi.exe
    C:\Temp\i_qolgdywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  PID:3332
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvtqli.exe ups_run
  2⤵
  PID:1100
- - C:\Temp\nlfdxvtqli.exe
    C:\Temp\nlfdxvtqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvtqli.exe ups_ins
  2⤵
  PID:4436
- - C:\Temp\i_nlfdxvtqli.exe
    C:\Temp\i_nlfdxvtqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  PID:5728
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  PID:5984
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxvpmkifz.exe ups_run
  2⤵
  PID:5756
- - C:\Temp\czxvpmkifz.exe
    C:\Temp\czxvpmkifz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxvpmkifz.exe ups_ins
  2⤵
  PID:1740
- - C:\Temp\i_czxvpmkifz.exe
    C:\Temp\i_czxvpmkifz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcax.exe ups_run
  2⤵
  PID:4752
- - C:\Temp\fzxrpkhcax.exe
    C:\Temp\fzxrpkhcax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcax.exe ups_ins
  2⤵
  PID:900
- - C:\Temp\i_fzxrpkhcax.exe
    C:\Temp\i_fzxrpkhcax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkhb.exe ups_run
  2⤵
  PID:2376
- - C:\Temp\jhbzurmkhb.exe
    C:\Temp\jhbzurmkhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkhb.exe ups_ins
  2⤵
  PID:856
- - C:\Temp\i_jhbzurmkhb.exe
    C:\Temp\i_jhbzurmkhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwuoljh.exe ups_run
  2⤵
  PID:3252
- - C:\Temp\jhezwuoljh.exe
    C:\Temp\jhezwuoljh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwuoljh.exe ups_ins
  2⤵
  PID:5052
- - C:\Temp\i_jhezwuoljh.exe
    C:\Temp\i_jhezwuoljh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtojgbyw.exe ups_run
  2⤵
  PID:3292
- - C:\Temp\dbwtojgbyw.exe
    C:\Temp\dbwtojgbyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtojgbyw.exe ups_ins
  2⤵
  PID:4748
- - C:\Temp\i_dbwtojgbyw.exe
    C:\Temp\i_dbwtojgbyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6040

C:\Temp\gezwrpjhbz.sys
C:\Temp\gezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:5392

C:\Temp\qomgeywroj.sys
C:\Temp\qomgeywroj.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\lgdbywqolj.sys
C:\Temp\lgdbywqolj.sys
1⤵
- Executes dropped EXE
PID:2072

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\aysqkidays.sys
C:\Temp\aysqkidays.sys
1⤵
- Executes dropped EXE
PID:5368

C:\Temp\uspnhfdxvp.sys
C:\Temp\uspnhfdxvp.sys
1⤵
- Executes dropped EXE
PID:4588

C:\Temp\icaxspkica.sys
C:\Temp\icaxspkica.sys
1⤵
- Executes dropped EXE
PID:2592

C:\Temp\ecwurpkhfz.sys
C:\Temp\ecwurpkhfz.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
- Executes dropped EXE
PID:980

C:\Temp\ywqojgbywr.sys
C:\Temp\ywqojgbywr.sys
1⤵
- Executes dropped EXE
PID:1392

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
PID:4016

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
PID:4640

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
PID:4784

C:\Temp\icaysqkica.sys
C:\Temp\icaysqkica.sys
1⤵
PID:1008

C:\Temp\qkhfaxsqni.sys
C:\Temp\qkhfaxsqni.sys
1⤵
PID:4456

C:\Temp\hfcxvpmhec.sys
C:\Temp\hfcxvpmhec.sys
1⤵
PID:3564

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
PID:1084

C:\Temp\jebztrpjhe.sys
C:\Temp\jebztrpjhe.sys
1⤵
PID:1896

C:\Temp\mjdbwtomge.sys
C:\Temp\mjdbwtomge.sys
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidays.sys

Path C:\Temp\aysqkidays.sys
Size 141KB
SHA256 21026aa9067f4eb702fd105a41e64d65cfca8e6eb62d0f88c2fd2683e8bd3da5
MD5 dfe31bb00405cdd54e18e084a7241263
SHA1 a76379da036e4173cbb21c7d62f3e611bf133f3d
SHA512 213b18bbf35f389776970fb5ac69714047e6629b8ab7c36f684559a050afb17444b61910cd5e2404127cf4553d84b2652a8d2e0ca5e787d217e19126aad1bdc2
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqnigays.exe

Path C:\Temp\dywqnigays.exe
Size 243KB
SHA256 69fe172199c80c9cae9966d7cb27c7a5cd7099b2111b85cb3586d75af643d65c
MD5 85366a3b7d37ed2a2abd13f3c4f28979
SHA1 9df674c41a376763a36e9b4838033172ee4468c0
SHA512 7324d6c5e0aeeeb45517149ab8e391743ba06f8219bc4f10493bcddbf3422d6a6a5a68a7eee7bf3e9c669c5d57ed08c0199f293fa2c6419967f95615f496372f
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:MvMsLaOa3lLNngoqRttA7P
TLSH
T179345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrpjhbz.sys

Path C:\Temp\gezwrpjhbz.sys
Size 141KB
SHA256 aa4fdf024ce3d79019c043aed77277c29327402312046ba4caede8ef7636ec82
MD5 4118e94b6a5625ead6d8a0cf54697bf0
SHA1 3e2ae83403b1fecc94cbdac10b27288df47746a3
SHA512 dbea0aef2b63c6fc211507845154887a1e4936d0342a2309aa16a6f90f60577285ea5864c604b18bcd6394991584c0d84feb43aa7c84dded2376c7357a95b332
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqnigays.exe

Path C:\Temp\i_dywqnigays.exe
Size 243KB
SHA256 f07f6cd4edba42aa0ac6cd3462b876a4fe749dc1fd0131b8ad28537849731a70
MD5 3daa4b40edbd53fdb3cb61f025ac6e43
SHA1 e880b6f53590eb6f2f901cc5b1348dc50456da3d
SHA512 5cc31d83d99465a27787aada838d5c2a3ae8d7e3df5a0b3f4522f7dbdc5fe502107ca20396a54caf764682fb656bab3635d59ab086b33baf50aec05120b5045a
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:TvMsLaOa3lLNngoqRttA7a
TLSH
T150345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdaytqoigd.exe

Path C:\Temp\i_jdaytqoigd.exe
Size 243KB
SHA256 533b4f1f1400b3cc4bca695ead24e43ec979764f0e750ab5f9abcda9e0812927
MD5 6b6583586a51384b0da5a3ec32af6950
SHA1 b1480cbe20cee035eb175e8fee0a4f9d97606464
SHA512 a14b2d594cca06656dcbe0cabf3b975bcb237dd53d9670a7357b661f46f33cd2601f47b7e451dc75ac8e4a285f2bf45224dea706b30e2816be9a1229a8a25aba
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:rvMsLaOa3lLNngoqRttA7W
TLSH
T1A4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbztrljg.exe

Path C:\Temp\i_ojgbztrljg.exe
Size 243KB
SHA256 15dbb51d1478792d2346bc3a680c24d6adba33a248c420b96543772851e17d8b
MD5 2154aa2367cd87a8165c0518c7f5e8e0
SHA1 16e6880df9bfe78e96243d575d9b36c8f88fdc5a
SHA512 deb9037f160158cb015a985cffb96c205d462c24b051ddcb9e63427414386306087b757518cecbd9408ad527628d475e648c4ce12144051053cc58bde5158141
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:tvMsLaOa3lLNngoqRttA7g
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjeczusmhc.exe

Path C:\Temp\i_pjeczusmhc.exe
Size 243KB
SHA256 dcaaabbe06d880c397a69a878f03d55fed8c6a74a1fb4af243f9ad46bfb70718
MD5 efeca4bb8da23669348a2da575674c8b
SHA1 edf6947da0056e3039759e9c2028e39be3e31429
SHA512 c49420beeb5ad8507f27ddddccbf07633a34630b34dfb68b2a72dbc6a453fb3215206d8a2646c9380562bae7e50b3f67ca0744812d5ead9b34976cb7ac002df3
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:mvMsLaOa3lLNngoqRttA7l
TLSH
T1B2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjebzto.exe

Path C:\Temp\i_wuomjebzto.exe
Size 243KB
SHA256 07f4e3b57f4db007baf03d1cb5389b3ce0b7bcceb503fa9fb60d8da530e06f89
MD5 27dced450be1a06c4d4045e96906999c
SHA1 f59cc020bcc94795dc645215524bb98a4c4ff912
SHA512 185a7d01df66d2dfb15e80a71e9ec4fd54e1ad07039b262befbb8a557e00567e4fe02c95f7b331824ef71704ee500888b58e87b9be5c59a95e99587bfbfba7c5
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:avMsLaOa3lLNngoqRttA7h
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdaytqoigd.exe

Path C:\Temp\jdaytqoigd.exe
Size 243KB
SHA256 42b941cce581bd5238710603adf32ebbb71296077b4abdfb1a7c679cab112d2b
MD5 67817aa752192b2f61aab4702c319706
SHA1 c4abff03326a37448aa20c313fb650957cf12c5a
SHA512 e630b1c9ab4033540059492efdab37a0eb9d7e4af6ccd072f1791d1056adf59a468bd864b2b1513c709d77ad2cea20acc3d9ccd8567a510c35f7a5b77e4e6f60
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:bvMsLaOa3lLNngoqRttA7u
TLSH
T12C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbywqolj.sys

Path C:\Temp\lgdbywqolj.sys
Size 141KB
SHA256 c095053cdc5a4b23483af6ad72dd7a72743208ecda5be60e03a98aed7af320f3
MD5 94c8b128bcb53a67492ca7252841ec04
SHA1 00828b85c986a6f2950c3a571ac7e9bd2b7307e4
SHA512 040ff7336b307b2197081344ec5db719812cff5f817525db6a97890fb543c62b6d0569a86b98b3b886ed7fdd1a2795c913490ab5f2f50a3390af27d0125acb8c
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.sys

Path C:\Temp\lidbvtnlfd.sys
Size 141KB
SHA256 7f9e539c20b80ccf39030ceb728466f51d2dd1faafa30d7c6da7e331e1cc7766
MD5 816970d5ab850f4b5d4b54793505971b
SHA1 10e9eebe957cfed8d3ed0f7e755714e0d9d3b0aa
SHA512 7ced3ad3bb0fade06d4b94a3eaafb7a4e020e21948c7b2feedf96e8b8ff92050b7a360fe42e1ecdaa664e270692c27e555ab56ee15a3773087782848d30e0bf0
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T123E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljg.exe

Path C:\Temp\ojgbztrljg.exe
Size 243KB
SHA256 339dc868c6aa1e45e812771b9ff8b8f7ef409a5c35b9e9b1fe7f9674aa7729b3
MD5 6487735be8c3654e51396bdc80d0471c
SHA1 1b38deb20e60f6b06288401bbca3887038307909
SHA512 802796b37663614ae5e90375429f92600e392384de95b7d2115d0d33871f4a94e99122f3b9b6d238034d309cb4652b95e4c307e77c4f090219b6a0f34a04c7b5
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:kvMsLaOa3lLNngoqRttA7P
TLSH
T164345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjeczusmhc.exe

Path C:\Temp\pjeczusmhc.exe
Size 243KB
SHA256 e5682c1e7284f7938f30f4f69cd7adb78fd2fdcd692b9c4e99e6cbc5ee0ce066
MD5 81aaaf88da6cddc47301a873d6a4c670
SHA1 48522b3de2973b144e6068f625695c24836fe468
SHA512 e75f0728d77d3acb59b17ad892088d2f2b08bf3f23631e14bfb0ccf31f92530ad4330f2fe38ee483bc5a3bfe64f54e112dfd99d7dace7a504f3434ce230797fa
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:hvMsLaOa3lLNngoqRttA7A
TLSH
T1C8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgeywroj.sys

Path C:\Temp\qomgeywroj.sys
Size 141KB
SHA256 79d87f11f8ae909edd0d61f69ec61537613b8d5d767b9b175e8d60b345d4064f
MD5 86016e80922a6af0d83fb64884379dcf
SHA1 f0ce9e2e11b44e4fedafec22e2c68b4abbb7cf87
SHA512 16c28ff4e50721960af79f2ad82fc6f0eabd24c64a694cb2ab31784d80ce1bba5dd76d4d7ac2c611427c9bbd3f0072925a161113088386171fae182a314c3a07
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjebzto.exe

Path C:\Temp\wuomjebzto.exe
Size 243KB
SHA256 0c141d6679a64148b8d0fe0e6f46904245b71aee646921d27a2bb646920240c2
MD5 9b497a105f336698951b4b32ba6545ba
SHA1 317e727313bb6d7fbc56c88e97378127770f77bc
SHA512 fdaa367b094e18659e36d63f81b941b30468943d6ad2337e3a69aae2c8e26894dd32b87952ac334500ec95aa5ff9273e7e41feb8e47feddb872a2a5fc3ffff08
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:EvMsLaOa3lLNngoqRttA7L
TLSH
T11D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvpnlidays.exe

Path C:\Temp\yvpnlidays.exe
Size 243KB
SHA256 79c1be0d1b338cf73b580c98f965d428f60c8ef9986e927b78a91bcb8df02fe2
MD5 a997a655ec9ce0626e4adb7b7513599d
SHA1 8bd3145bcd6e1b4ee57fbbb5231994e4d88ab0c8
SHA512 e4dd66a24b868175eb5c84f1042f3836bbd194d1ccb902422c5d2998b21e9affb9eb885a85f40711f154657fba674507b23682a0dd69aa87f88a89f9fad8bf72
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:EvMsLaOa3lLNngoqRttA77
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82be7c4cba1c58c6d4e1edc1cb7a976b53a7dc38c98f1c08d98be733086c9be1
MD5 9b6b8b39782c1c27661ababe86a35527
SHA1 7e8dec1dcfdc97128409b987b7123c6ec49b2869
SHA512 fc51033891f0f9457eb747afe7901cfb71db61c0651ea95768213c48c903f78000e6605dcca1a6a05403b918db479233b1d3db5870c39ac796dc491b12be841e
TLSH
T10A51638A032E09F6D75EBCF550FE6684B3F8C864B1CB9E0140D11E370A42F3690E0127
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597277.TMP
Size 3KB
SHA256 7cb3e4d89faf29878b13ba363db1510a6210af422909effe2759863402f710dd
MD5 a187906f2558f155588c5d7be2bbba0d
SHA1 da1fe8f533c4002889d4be13a440bed5b3e27468
SHA512 b28e884a752741922b9bd055af31c132a7e2f20d2b8c59cf5e6c1f43ce07f8f7c3b455a855bf5d7311e5f241a005040358874b1768e115783d4a709f4e2706b4
TLSH
T17651639A032E09F6D75EBCF550FE6684B3F8C865B0CB9E0140D11E370A42F36A0E0127
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7dcc264900a85af63538195f19c2c60adfa401339377669bf034bb7d0a7eac16
MD5 a7ea68e7264390c6ba0542c3e161de02
SHA1 9588685648f4c580b5c00239abb1bd8cd3403dbb
SHA512 17e0a2682cdcd12c27d613649e0e117ae41b48f08fc73300d99d4a4af0d7342810943481c2f8d4c64075b794d6d6c66139efed2a487a3e960b525803ac815fdf
TLSH
T15251AFF3C7E8856E890156F0AA147E1BCE2D0A24832C3D5AC8E4EF5BA3E3471D14295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 39b229ab942c3a01b6e899a397802d69cc2ffc4bb0a24e9f9c7fb8d4ecbb6940
MD5 e74f4f72a4c468f1bcf575badb5dfa87
SHA1 53a32da8f3977a64cf178caba0496927d03c2e4c
SHA512 deddae92d8849a576e33b165706b27f0e79b1020355d3299fce4ec6a87d2b4148ae001ee6bbf0b3d668fb95c182549fdfa3c086fccc92d9fd6058046149c89b1
SSDEEP 192:sxRRR+RNCG/fYsBmZEwZ5ozoA8p9m/g6+WNCnc/YD9B6SMGlLIgVA8uJ:sxRRIeG/fYskZEurQ/5N/pSNw
TLSH
T1E742A516AA28993B5CC6D21DFB65BF53D6FD5132A1D11E48E6FC8A0C00EA6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 568470cfdfd459764fd4844addf3d7b473a23030a91fdf06691c2c36330e8aa7
MD5 a62ab1220941f7b05f396d37fc3756d2
SHA1 2b6b39d62748d0adc649abc15c4e7eeba42f2fca
SHA512 a899fdbe701dc9cbf3c4c1e339762fc25f35e00520f96a0a4a3e9e33851fef537b4d864bdbffc57896a4d675ba765a18a4e9cf5eeab4960146e086a25852f41c
SSDEEP 192:sxRaR+RNCG/fYsIvmZEwZ5ozoA8p9m/g6+WNCnc/YD9B6SMGlLIgDDA8uJ:sxRaIeG/fYs3ZEurQ/5N/pSNi
TLSH
T10A42951AA928997B5CC6D21DFB55BF53D6FD5432A1D11E48A6FC8A0C00EA7DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ca241610f225550959b3a9f58e14f65135ad8f6b74776a1000aeac473d65493a
MD5 12e41ddaf7e690fefeaebb88fdae2eab
SHA1 55a062dc92eb25edac4b3fc00eaac8849a5bdf1e
SHA512 66f72f578c6cad41dcfefe5101dd9e40d841b956870991d5645ff988315d2e9fb0fef42d31c980e6296cd36fccca9103da6d29187d71ab602eb54ff4aea2a623
SSDEEP 192:sxRaR+RNCG/fYsIvmZAwZ5ozoA8p9m/g6+WNCnc/YD9f6SMGlLIgDhA8uJ:sxRaIeG/fYs3ZAurQ/5N/JSNY
TLSH
T15442951AA928997B5CC6D21DBB55BF53E6FD5432A1D11E48A6FC8A0C00EA7DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 daa039e2e410896264fd8dedadf62015101dc7123bd653f5b27c3a6ade37af60
MD5 cb8e92d82cfae88078d25da98ccf3d85
SHA1 80780dbdcfbe757d635d65869cc771acd339e117
SHA512 244e326a2f41becfbd230fab607c4cb659052bdc7bc4449fd820fc31f2a30a9e9c9701631c561092aa67cdf7b58d67bfe7454c6cf56f908915608ee7fff7e869
SSDEEP 768:azfW2a7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvXYc16UropnLnG:azfW2yEf30Wg/XfHfu1jawXYy6/pni
TLSH
T1FED2DB7B640CCA7F4F800A9DAD197EDB6D6802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0df4cd9c-1464-48a3-8577-31cdaf94f22f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0df4cd9c-1464-48a3-8577-31cdaf94f22f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 395cf0fb5613772dd85144211441dd5187ade7e10b79358a6414c4451279a481
MD5 afd3f643c7eb7eed3add232bb0861345
SHA1 f859484fb977ebe8c465320e2125f4a4d151f212
SHA512 e6e12dc3385b910abc186ec531c2ab6418f6e76c1ffb3fd19be479444a9d8021b5fad6101ac51d955c9f90cbaa3be1cdaa396a7e5e513486ee2cb4b3a23310a3
SSDEEP 384:nRZcI+38NS/L2cNnWZlf8hyEG6TFCYFy2rEoajo4cdR8eHhVODjYPNDUMr3cjmwk:5+3nki0jsrEnjN3Gac1FrMjyl
TLSH
T15CF2CF356D688DB39CEAD38679437B53AEE4166385D40BE4DAD9A60C05C36FC130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 d76468d3bb211d3caa1e7a33f72244f5f53a6cc03276c2aa74e8f71259827b2b
MD5 1cc4d21392f684996ccb01319cde88a9
SHA1 00b452c121f3cd3b683d0629d9e1004fb58df3ad
SHA512 b82ffc6ecacc11db19403e412d4eeaa62bb556a568527d0586639bed56114d8af5858b968918a4a4aa1f54bb61ddfcd6dda7e21c0082dbff796a2f80117bf7bb
SSDEEP 384:nqziFiZcIA38Nq8TUNTUlIl/L2cen4Hf05yEG6TFCYay2rEoajo4cdR8eHhVODjG:qeFQA3dwgGLsjNrEnjN3Gac1FrMjyl
TLSH
T1D91328F598D78977E8EE8387677D6E429ABCC263B5844994BBC45D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fef3ee600a1a88175e51b958669a0d09af76cacee1ce040b4214c8db75b23278
MD5 9655544d1ec4912aa42a45aa0d5dd166
SHA1 248135459b1c01e86115c19dababba4ac41429fc
SHA512 b53a95f0549b7069fbe41e1c0f24fe4192367d57364584291d64f4d3969f1c8a33401bfda3fe8ed8247ffc6c0abbb274b6f2374dff9c7c1ca65f4885aea13c5f
SSDEEP 768:rrv+4UNbdS3Emi0JrEnjN3Gac1ZreVH1SCz:rbsbg3DJQnjMakEH1V
TLSH
T12D03CF3269B88AB39CE7E38571877A037EF4525386C40BE0C9CD6B0D06975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 11fd32f0076a67760450dd5c385a000a49c2a8f99e5810a8ef10e6fd01cbe5cc
MD5 689db20924f37e61bca53092d0a19522
SHA1 19feb2ef76c64953326483224ee00c4e8c0dd4c3
SHA512 e5f5a0a8add2d593c2164838dbdc3a36b993642b9394eeff7cd8ff92401b0180ca351105e3d50ffad1e9c5e377937104b32a9a76a06e6f8821d0d7e14538c559
SSDEEP 384:n6ZcI+38NSiL2yNnWZlf8hyEG6TFCYKy2rEoajo4cdR8eHhVODjYPNDUMr3cjmwk:4+3kki0jbrEnjN3Gac1FrMjyl
TLSH
T15DF2BF356D688DB39CEAD345B9437B53AFE4166385D40BA4DAD9A60C05C36FC130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a597f956-847e-421f-90dc-e49a11938dc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a597f956-847e-421f-90dc-e49a11938dc8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe594992.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe594992.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

27fadb2f-f783-4477-8d8a-71c8000020b2.tmp

Path C:\Users\Admin\AppData\Local\Temp\27fadb2f-f783-4477-8d8a-71c8000020b2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4704_1864968669\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/980-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/980-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1008-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-687-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-592-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1896-691-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2932-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3564-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4016-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4588-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4588-539-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4648-559-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4784-651-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4784-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4920-708-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5368-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5392-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-534-0x0000000000010000-0x0000000000083000-memory.dmp

Download