8ed0cae5e01e4eb4eca02035df9979de4a4f3b3ad5e80b4f7f45cf2c12a226d5

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-m8y3hseq2y
SHA256 8ed0cae5e01e4eb4eca02035df9979de4a4f3b3ad5e80b4f7f45cf2c12a226d5
MD5 bec8885e7c04636c57fd0cac24f28c89
SHA1 f32e50239effd18e7c5ad0f6156f978ebcd964c1
SHA512 5bc135b5549519e69804b31d369470d580a7337bb7e37ea3160c93cb7915a5b635412bf17d42b6eb73e2c94fba4dc9ded88e124d5b8331edaa29d9e9f56f720b
SSDEEP 3072:PMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:LGii9IL8Xa3lLNngoqRttA75
TLSH
T12134490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3236	CP.exe
5972	xrpjhczecw.exe
3088	CP.exe
3592	CP.exe
4184	i_xrpjhczecw.exe
3476	pjgezwrpjh.sys
3148	CP.exe
2052	omgezwrpjg.exe
5944	CP.exe
5168	CP.exe
1760	i_omgezwrpjg.exe
5264	wtrojgbywq.sys
5984	CP.exe
1612	wqoigdbztr.exe
4472	CP.exe
4100	CP.exe
1280	i_wqoigdbztr.exe
1788	vtqoigbytr.sys
1252	CP.exe
3700	tqoigbytnl.exe
3016	CP.exe
1012	CP.exe
4836	i_tqoigbytnl.exe
2324	vtnlidbvtn.sys
2752	CP.exe
5668	gaysqlidxv.exe
4508	CP.exe
3108	CP.exe
3068	i_gaysqlidxv.exe
3116	snkidavtqk.sys
1544	CP.exe
6048	snlfdxvpni.exe
2572	CP.exe
1596	CP.exe
1216	i_snlfdxvpni.exe
6092	usqkicaxsq.sys
4912	CP.exe
4208	usnkfcaxsp.exe
3324	CP.exe
2604	CP.exe
6136	i_usnkfcaxsp.exe
6052	nkfcxuspcz.sys
3428	CP.exe
5672	eczxrpmkfz.exe
696	CP.exe
364	CP.exe
4668	i_eczxrpmkfz.exe
4304	smkecxupmh.sys
5264	CP.exe
1180	rpjhfzxrpj.exe
2896	CP.exe
5108	CP.exe
4268	i_rpjhfzxrpj.exe
2432	mkecwuomje.sys
3044	CP.exe
1936	mhecwtomje.exe
6028	CP.exe
4824	CP.exe
4728	i_mhecwtomje.exe
3232	omjdbzwuom.sys
3380	CP.exe
964	rmjebwtolj.exe
4616	CP.exe
4360	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4432_1445490850\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_2061280184\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4432_881428064\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysnlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwtomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtnlgdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysnlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpmkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtnlgdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwtomje.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5528	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4516	ipconfig.exe
2568	ipconfig.exe
1220	ipconfig.exe
4788	ipconfig.exe
3556	ipconfig.exe
2900	ipconfig.exe
2820	ipconfig.exe
2792	ipconfig.exe
5240	ipconfig.exe
2920	ipconfig.exe
6060	ipconfig.exe
2612	ipconfig.exe
5164	ipconfig.exe
6060	ipconfig.exe
5860	ipconfig.exe
1660	ipconfig.exe
4492	ipconfig.exe
3892	ipconfig.exe
5052	ipconfig.exe
3624	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299697346680222"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{3FF17A45-F9F0-463D-B36D-399C1FCDECBB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4184	i_xrpjhczecw.exe
Token: SeDebugPrivilege	1760	i_omgezwrpjg.exe
Token: SeDebugPrivilege	1280	i_wqoigdbztr.exe
Token: SeDebugPrivilege	4836	i_tqoigbytnl.exe
Token: SeDebugPrivilege	3068	i_gaysqlidxv.exe
Token: SeDebugPrivilege	1216	i_snlfdxvpni.exe
Token: SeDebugPrivilege	6136	i_usnkfcaxsp.exe
Token: SeDebugPrivilege	4668	i_eczxrpmkfz.exe
Token: SeDebugPrivilege	4268	i_rpjhfzxrpj.exe
Token: SeDebugPrivilege	4728	i_mhecwtomje.exe
Token: SeDebugPrivilege	4708	i_rmjebwtolj.exe
Token: SeDebugPrivilege	3432	i_wtnlgdbywq.exe
Token: SeDebugPrivilege	1680	i_jdbvtqoigd.exe
Token: SeDebugPrivilege	1524	i_aysnlfdavt.exe
Token: SeDebugPrivilege	2660	i_usqkifdxvs.exe
Token: SeDebugPrivilege	3496	i_ausnkfcxsp.exe
Token: SeDebugPrivilege	3056	i_hcausmkfcx.exe
Token: SeDebugPrivilege	5456	i_zurmjecwuo.exe
Token: SeDebugPrivilege	3432	i_omjecwuomg.exe
Token: SeDebugPrivilege	3904	i_gbywtolgdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 4204	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	89
PID 4204 wrote to memory of 4432	4204	iexplore.exe	90
PID 4432 wrote to memory of 4776	4432	msedge.exe	91
PID 4432 wrote to memory of 5528	4432	msedge.exe	92
PID 4432 wrote to memory of 236	4432	msedge.exe	93
PID 4432 wrote to memory of 236	4432	msedge.exe	93
PID 4432 wrote to memory of 264	4432	msedge.exe	95
PID 4432 wrote to memory of 264	4432	msedge.exe	95
PID 4432 wrote to memory of 264	4432	msedge.exe	95
PID 4432 wrote to memory of 752	4432	msedge.exe	96
PID 4432 wrote to memory of 752	4432	msedge.exe	96
PID 4432 wrote to memory of 752	4432	msedge.exe	96
PID 4432 wrote to memory of 3748	4432	msedge.exe	97
PID 4432 wrote to memory of 3748	4432	msedge.exe	97
PID 4432 wrote to memory of 3748	4432	msedge.exe	97
PID 4432 wrote to memory of 1796	4432	msedge.exe	98
PID 4432 wrote to memory of 1796	4432	msedge.exe	98
PID 4432 wrote to memory of 1796	4432	msedge.exe	98
PID 4432 wrote to memory of 2676	4432	msedge.exe	99
PID 4432 wrote to memory of 2676	4432	msedge.exe	99
PID 4432 wrote to memory of 2676	4432	msedge.exe	99
PID 4432 wrote to memory of 4516	4432	msedge.exe	100
PID 4432 wrote to memory of 4516	4432	msedge.exe	100
PID 3452 wrote to memory of 3236	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	102
PID 4432 wrote to memory of 2960	4432	msedge.exe	104
PID 4432 wrote to memory of 5576	4432	msedge.exe	105
PID 4432 wrote to memory of 2960	4432	msedge.exe	104
PID 4432 wrote to memory of 5576	4432	msedge.exe	105
PID 5972 wrote to memory of 3088	5972	xrpjhczecw.exe	107
PID 4432 wrote to memory of 3720	4432	msedge.exe	111
PID 4432 wrote to memory of 2292	4432	msedge.exe	112
PID 4432 wrote to memory of 2292	4432	msedge.exe	112
PID 4432 wrote to memory of 3700	4432	msedge.exe	113
PID 4432 wrote to memory of 3700	4432	msedge.exe	113
PID 3452 wrote to memory of 3592	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	116
PID 4432 wrote to memory of 3180	4432	msedge.exe	120
PID 4432 wrote to memory of 3180	4432	msedge.exe	120
PID 4432 wrote to memory of 6124	4432	msedge.exe	121
PID 4432 wrote to memory of 6124	4432	msedge.exe	121
PID 3452 wrote to memory of 3148	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	122
PID 2052 wrote to memory of 5944	2052	omgezwrpjg.exe	124
PID 3452 wrote to memory of 5168	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	127
PID 3452 wrote to memory of 5984	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	131
PID 1612 wrote to memory of 4472	1612	wqoigdbztr.exe	133
PID 3452 wrote to memory of 4100	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	136
PID 3452 wrote to memory of 1252	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	140
PID 3700 wrote to memory of 3016	3700	tqoigbytnl.exe	142
PID 3452 wrote to memory of 1012	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	145
PID 4432 wrote to memory of 4996	4432	msedge.exe	148
PID 4432 wrote to memory of 5232	4432	msedge.exe	149
PID 4432 wrote to memory of 2848	4432	msedge.exe	150
PID 3452 wrote to memory of 2752	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	153
PID 5668 wrote to memory of 4508	5668	gaysqlidxv.exe	155
PID 3452 wrote to memory of 3108	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	158
PID 3452 wrote to memory of 1544	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	162
PID 6048 wrote to memory of 2572	6048	snlfdxvpni.exe	164
PID 3452 wrote to memory of 1596	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	167
PID 3452 wrote to memory of 4912	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	171
PID 4208 wrote to memory of 3324	4208	usnkfcaxsp.exe	173
PID 3452 wrote to memory of 2604	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	176
PID 3452 wrote to memory of 3428	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	180
PID 5672 wrote to memory of 696	5672	eczxrpmkfz.exe	182
PID 3452 wrote to memory of 364	3452	2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe	185
PID 4432 wrote to memory of 2112	4432	msedge.exe	189

C:\Users\Admin\AppData\Local\Temp\2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_bec8885e7c04636c57fd0cac24f28c89_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffa6a9dc188,0x7ffa6a9dc194,0x7ffa6a9dc1a0
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,5706444013279337102,5618336439090706269,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
      4⤵
      System Time Discovery
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,11642370453193410323,14328207747094011010,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:13
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,18379113248776402303,6310510622632600436,262144 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17488308009878010493,4503651688033918451,2097152 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,7011650927577699894,4929346892879438717,2097152 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,17485826078046207868,5614352988643398627,2097152 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:1796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,6966209809410846788,16373799418570540734,2097152 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,14906022171516742125,12439901670792181324,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6917104081059666418,12220130473113158567,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11596158002338748827,5800375372899452936,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:5576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12968128913475599739,9681068931094312233,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12968128913475599739,9681068931094312233,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,12427569572244470716,16559762173298235845,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3045662672720091916,13791937892147622072,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,15286102532858446461,17187779719356558144,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,3071692439775521542,26157681127785797,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,1316815799234205690,1917643443454928739,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:14
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,15304038671024223868,1754720902275449632,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,3779806304940611088,12760312148167296751,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,18269633198757804507,7262019739583479237,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:14
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,424842484665934556,13131593590011917604,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5840,i,16952542943052563672,11202487311210627381,262144 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8598401804285957918,5237522424679189992,524288 --field-trial-handle=2628,i,7141191011415001486,12993873001473909427,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczecw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3236
- - C:\Temp\xrpjhczecw.exe
    C:\Temp\xrpjhczecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\i_xrpjhczecw.exe
    C:\Temp\i_xrpjhczecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Temp\omgezwrpjg.exe
    C:\Temp\omgezwrpjg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5168
- - C:\Temp\i_omgezwrpjg.exe
    C:\Temp\i_omgezwrpjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigdbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5984
- - C:\Temp\wqoigdbztr.exe
    C:\Temp\wqoigdbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigdbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\i_wqoigdbztr.exe
    C:\Temp\i_wqoigdbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqoigbytnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1252
- - C:\Temp\tqoigbytnl.exe
    C:\Temp\tqoigbytnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqoigbytnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1012
- - C:\Temp\i_tqoigbytnl.exe
    C:\Temp\i_tqoigbytnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2752
- - C:\Temp\gaysqlidxv.exe
    C:\Temp\gaysqlidxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_gaysqlidxv.exe
    C:\Temp\i_gaysqlidxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Temp\usnkfcaxsp.exe
    C:\Temp\usnkfcaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\i_usnkfcaxsp.exe
    C:\Temp\i_usnkfcaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczxrpmkfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3428
- - C:\Temp\eczxrpmkfz.exe
    C:\Temp\eczxrpmkfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczxrpmkfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Temp\i_eczxrpmkfz.exe
    C:\Temp\i_eczxrpmkfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhfzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5264
- - C:\Temp\rpjhfzxrpj.exe
    C:\Temp\rpjhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhfzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5108
- - C:\Temp\i_rpjhfzxrpj.exe
    C:\Temp\i_rpjhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhecwtomje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Temp\mhecwtomje.exe
    C:\Temp\mhecwtomje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhecwtomje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Temp\i_mhecwtomje.exe
    C:\Temp\i_mhecwtomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebwtolj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3380
- - C:\Temp\rmjebwtolj.exe
    C:\Temp\rmjebwtolj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebwtolj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\i_rmjebwtolj.exe
    C:\Temp\i_rmjebwtolj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtnlgdbywq.exe ups_run
  2⤵
  PID:3616
- - C:\Temp\wtnlgdbywq.exe
    C:\Temp\wtnlgdbywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtnlgdbywq.exe ups_ins
  2⤵
  PID:1260
- - C:\Temp\i_wtnlgdbywq.exe
    C:\Temp\i_wtnlgdbywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtqoigd.exe ups_run
  2⤵
  PID:5956
- - C:\Temp\jdbvtqoigd.exe
    C:\Temp\jdbvtqoigd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtqoigd.exe ups_ins
  2⤵
  PID:4728
- - C:\Temp\i_jdbvtqoigd.exe
    C:\Temp\i_jdbvtqoigd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysnlfdavt.exe ups_run
  2⤵
  PID:2920
- - C:\Temp\aysnlfdavt.exe
    C:\Temp\aysnlfdavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysnlfdavt.exe ups_ins
  2⤵
  PID:4164
- - C:\Temp\i_aysnlfdavt.exe
    C:\Temp\i_aysnlfdavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkifdxvs.exe ups_run
  2⤵
  PID:3404
- - C:\Temp\usqkifdxvs.exe
    C:\Temp\usqkifdxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkifdxvs.exe ups_ins
  2⤵
  PID:1288
- - C:\Temp\i_usqkifdxvs.exe
    C:\Temp\i_usqkifdxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfcxsp.exe ups_run
  2⤵
  PID:5088
- - C:\Temp\ausnkfcxsp.exe
    C:\Temp\ausnkfcxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfcxsp.exe ups_ins
  2⤵
  PID:1640
- - C:\Temp\i_ausnkfcxsp.exe
    C:\Temp\i_ausnkfcxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkfcx.exe ups_run
  2⤵
  PID:2812
- - C:\Temp\hcausmkfcx.exe
    C:\Temp\hcausmkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkfcx.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_hcausmkfcx.exe
    C:\Temp\i_hcausmkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjecwuo.exe ups_run
  2⤵
  PID:2872
- - C:\Temp\zurmjecwuo.exe
    C:\Temp\zurmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjecwuo.exe ups_ins
  2⤵
  PID:4980
- - C:\Temp\i_zurmjecwuo.exe
    C:\Temp\i_zurmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omjecwuomg.exe ups_run
  2⤵
  PID:3000
- - C:\Temp\omjecwuomg.exe
    C:\Temp\omjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omjecwuomg.exe ups_ins
  2⤵
  PID:5224
- - C:\Temp\i_omjecwuomg.exe
    C:\Temp\i_omjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbywtolgdb.exe ups_run
  2⤵
  PID:6040
- - C:\Temp\gbywtolgdb.exe
    C:\Temp\gbywtolgdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbywtolgdb.exe ups_ins
  2⤵
  PID:5924
- - C:\Temp\i_gbywtolgdb.exe
    C:\Temp\i_gbywtolgdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3376

C:\Temp\pjgezwrpjh.sys
C:\Temp\pjgezwrpjh.sys
1⤵
- Executes dropped EXE
PID:3476

C:\Temp\wtrojgbywq.sys
C:\Temp\wtrojgbywq.sys
1⤵
- Executes dropped EXE
PID:5264

C:\Temp\vtqoigbytr.sys
C:\Temp\vtqoigbytr.sys
1⤵
- Executes dropped EXE
PID:1788

C:\Temp\vtnlidbvtn.sys
C:\Temp\vtnlidbvtn.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\snkidavtqk.sys
C:\Temp\snkidavtqk.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Temp\usqkicaxsq.sys
C:\Temp\usqkicaxsq.sys
1⤵
- Executes dropped EXE
PID:6092

C:\Temp\nkfcxuspcz.sys
C:\Temp\nkfcxuspcz.sys
1⤵
- Executes dropped EXE
PID:6052

C:\Temp\smkecxupmh.sys
C:\Temp\smkecxupmh.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\mkecwuomje.sys
C:\Temp\mkecwuomje.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\omjdbzwuom.sys
C:\Temp\omjdbzwuom.sys
1⤵
- Executes dropped EXE
PID:3232

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
PID:1524

C:\Temp\gdbvtnlige.sys
C:\Temp\gdbvtnlige.sys
1⤵
PID:3104

C:\Temp\idavtnlfda.sys
C:\Temp\idavtnlfda.sys
1⤵
PID:5128

C:\Temp\xvsnlfdxvp.sys
C:\Temp\xvsnlfdxvp.sys
1⤵
PID:3280

C:\Temp\kicaxsmkfc.sys
C:\Temp\kicaxsmkfc.sys
1⤵
PID:6052

C:\Temp\kfcxusmkfc.sys
C:\Temp\kfcxusmkfc.sys
1⤵
PID:1796

C:\Temp\wupmkhbzxr.sys
C:\Temp\wupmkhbzxr.sys
1⤵
PID:5104

C:\Temp\trljebwtrm.sys
C:\Temp\trljebwtrm.sys
1⤵
PID:3544

C:\Temp\rljgeywuom.sys
C:\Temp\rljgeywuom.sys
1⤵
PID:1000

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlidxv.exe

Path C:\Temp\gaysqlidxv.exe
Size 243KB
SHA256 228ae6f3f0fbd7d00478e84e8dd6539c8e6e728ed6fe32b52385d7e81bce742d
MD5 01b6f6eac740ebaca588316fc03d525e
SHA1 a437a26afa47e577f096e3367a99e1cb5eaf525f
SHA512 0fe310a5e0007cf86982113e24189873f0a3abbe8e542900d91f8b4c20e5c6145a4dd4b5861cbf0f219a56ead39ab8e55bd6d5b39b7f76f9a186eb05eef90874
SSDEEP 3072:GMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:wGii9IL8Xa3lLNngoqRttA7s
TLSH
T10034490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaysqlidxv.exe

Path C:\Temp\i_gaysqlidxv.exe
Size 243KB
SHA256 efb784a7952fd68096f58c185e6b56ffa492fba165aaac851455a989f6065955
MD5 f72c50b8d2ad26a2465eea9e8341b49d
SHA1 ea1bfa2ff30eb11ae6a2a3bd7146d76a1af7aa10
SHA512 2c9c2823d5556d0091763c1ae089abe12c6b784f007bed3e479b82f55c1dac35e89156be5030dd5e26e5a2734bd7e2e0e319350d493bc6dfc14c5577bba8dd7f
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:FGii9IL8Xa3lLNngoqRttA7X
TLSH
T1EA34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpjg.exe

Path C:\Temp\i_omgezwrpjg.exe
Size 243KB
SHA256 e5f777cf21e1fe4bf18ffbb24385a496e30f053fd0600534d47d381d97f4b841
MD5 2f81884c8b40019b265a95649f747957
SHA1 d0988792ca605c34f5bd45edb102b2113e9f65ab
SHA512 83d7e4b1c00c55e251c43b3d3500849868ed6e38ee975e79f883aa84a4fe286fe21f5c0b41e63faa6674e6d3af3bd6bab14e008bf71d4a93c673a0feb3a5b242
SSDEEP 3072:NMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:JGii9IL8Xa3lLNngoqRttA7z
TLSH
T17634490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqoigbytnl.exe

Path C:\Temp\i_tqoigbytnl.exe
Size 243KB
SHA256 11e698708937ad09510a230a5105d1fef99bbd89c6ed0b1a47971865ba27b62b
MD5 d8d35076e0b0a66818dd783c9ac81c4e
SHA1 5dc6a2ebbadbbe1b3bf117da63504d437ea2c752
SHA512 f600b5469aabd028b7ba37d55a5da9e162a03aff2087c2ec0a6a7ddc05b12e8b2f3857b9ceaddc78b054f60f907dd248462ca9e43482c0b2d0d28ba1e856e220
SSDEEP 3072:EMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:GGii9IL8Xa3lLNngoqRttA7G
TLSH
T17434490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoigdbztr.exe

Path C:\Temp\i_wqoigdbztr.exe
Size 243KB
SHA256 76d91f3d4904a3b432e03ced5986f16c9f6dae15d5bc06c5bc804eff34161967
MD5 078b64ce30aa1dbbc861059574b4d2cb
SHA1 1be7f2a473ce9616402b10a3b504ba000edfbe94
SHA512 d1bb413d5618b9a1d4ae6c3be8c70b588da1d03cbe9da70440bd12f4a90e5cdbff5f63c87ff02bce4db2b3175ef412839233abdf0ce89c4ab1fd838b7b88cf92
SSDEEP 3072:jMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:XGii9IL8Xa3lLNngoqRttA71
TLSH
T11234490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhczecw.exe

Path C:\Temp\i_xrpjhczecw.exe
Size 243KB
SHA256 fc7398207ebcaf9df1e0a5a760f729df70eb58d0a781b5ca7fd1680b3d761aac
MD5 c073cda1b1eaa4e932fc7a95be27d52d
SHA1 e1f1c50f3bf4652a911312e821be017a947ccee4
SHA512 cafa922bfccdc0449d9c880d42b2d6f06ba2a1f4398323e5e1a4169c2c4c45ddf85356e4db2c9e016f8941f43a7f6e0bcbd206cf619d08c14507ad53d6b11dbb
SSDEEP 3072:UMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:2Gii9IL8Xa3lLNngoqRttA7W
TLSH
T1A734490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjg.exe

Path C:\Temp\omgezwrpjg.exe
Size 243KB
SHA256 b65a3c4694db9f825fb6d557f1437d6bb13767500dd0e5c34e1961ac2dd253d4
MD5 5995be4d157720e5267ceec6f46cd0c2
SHA1 c4ace2601dbe44dc3306f71feeff026a4d70f83e
SHA512 7d08a4756628318bab26431f5db5c50aec88cbc09cfc840331ca6fbb793322e1febd9d4a06a04651e4e0c8e70f323c34eaab3cca369aba1b57b9f8a3d2a9176b
SSDEEP 3072:aMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:cGii9IL8Xa3lLNngoqRttA7s
TLSH
T14534490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjgezwrpjh.sys

Path C:\Temp\pjgezwrpjh.sys
Size 141KB
SHA256 535fe506ef1a877cdf12df70c9f55525dd3950b91dcb554b5b9fe7cf8ae7123d
MD5 ca3194b8488370c3bfd9e12f9f0dd2fb
SHA1 88219a5fe65f9f695b0a62f4b146e4a92e65ad7c
SHA512 ec01fd0259b3da301971920a020503762cbf6aa864d8a94f4b3f3dff79a1755148b1003483658c9251d66673c2b6500c07c3182d4be30856e46072c657f48b6a
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T121E38D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkidavtqk.sys

Path C:\Temp\snkidavtqk.sys
Size 141KB
SHA256 8c3c0f02d8ef9bc6cb545a09e01f72188acbc18a7aefdbe8949e780c96ae4f52
MD5 cef21a41425db05dc0fafeab8e18ba63
SHA1 b9074217a3f3c3f6d4dc68107eadd881bd18fa38
SHA512 0f7f949bd68447d764a4b3b8e02ffdac8de95869d6abbbb42fe0bb9316e037b8f15800a4fd22ac6ce04341f756a89552dc95cae8c56148f7baaadee2301aa99a
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 243KB
SHA256 344c4f82aa1d9901ba579a6464fc82ab465602a534dd863da915ae4ec6923fc1
MD5 d008aa637842267c9c42484c679f0c6e
SHA1 a884c63366c1de0eadac547434c978c7fc530acf
SHA512 709744c281c7405d3d17b87e1a93807b7e2b773318dfd37dbbdde797c6e21166772e643b6ba484b439cc3bc32ae49dc6220b217e263c36095b3418fcb56544c1
SSDEEP 3072:KMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:sGii9IL8Xa3lLNngoqRttA7M
TLSH
T16034490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoigbytnl.exe

Path C:\Temp\tqoigbytnl.exe
Size 243KB
SHA256 831d26ec236e31f7c40ad040862a28f9becb95a00474c3bb40869606dd9066a7
MD5 d6c2bb00b2e295c64c822590fe17a8af
SHA1 ffbb4ef63a25a237553fa06193278f7320447a25
SHA512 83b69e0f963f2e5d851720a69c1165c6e056c94d9404ac3d63097993b79c1cd458ef06c8d366dd65b7d13cf222bb1802cba7c015284674e418668b60b0a2bb53
SSDEEP 3072:AyMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76q:3Gii9IL8Xa3lLNngoqRttA79
TLSH
T18034490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlidbvtn.sys

Path C:\Temp\vtnlidbvtn.sys
Size 141KB
SHA256 8c706886d318265f3eb6ad444a3abba60e212a4546b2debe5a78fbfa1525f836
MD5 322a116f80c63d6f5a80bc700f98e2dd
SHA1 bf2b862a77a1df0ce0ee93d711e2d600ea3cca6d
SHA512 1480318f566ab892de198655179316475fe04851e746ee3ff05b683a4f86e3a1b402911bfd634ab18fbb50dd74395469d5c69c355d06f60e31248d4f9d181104
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10CE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqoigbytr.sys

Path C:\Temp\vtqoigbytr.sys
Size 141KB
SHA256 801eac59b21a2b9d7e3279afe02112687d412390ac02a03033ac84c99e6bc9e5
MD5 3df695b3f0a2d66a4ab4c4089d8185a9
SHA1 5ad0ff643efe5ec8e53bc707a446a3d1333fd9f2
SHA512 a9ef0a93daaa02d4716b4e9eef49048bdcecaa38ab7f6a1ea4aca962d29c48b17890ade1cad7a20faaf620823d84ccc8211cf049ce043eab578ab7a4d900f6ec
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T113E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigdbztr.exe

Path C:\Temp\wqoigdbztr.exe
Size 243KB
SHA256 4c7d25fb0086e896eb0fd8939b0b6c5dbffb8e175b08dbd83c7d467c1a9e6339
MD5 46013d45136bc1970ffa23cdd7f197c3
SHA1 24346aa9fb7b1c15d974547d4572af3ea47deb71
SHA512 23e4494b212dacf187acad6016aa53bf01eaf37c4113c04835f9104e34ebd26cf18fc9135d894e8bc976c37546e6d40d8190687269d20ba33741e27367215088
SSDEEP 3072:DMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:3Gii9IL8Xa3lLNngoqRttA7x
TLSH
T12634490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrojgbywq.sys

Path C:\Temp\wtrojgbywq.sys
Size 141KB
SHA256 1396c1fde5b1b7930ac7e3952c69d440ae2cffc594d9e1c9101e9ea6d33370c4
MD5 e47f7aff1880a0cebba07488a47d6583
SHA1 eadf816acf44af2adb966161be771379db62ba82
SHA512 73fef86f4f7abe6b3a1099e9ef3234a8df31ba8ae2ea88d4e43126f3f0b3374b61dc29e55160998a5bfeab2005fb733d32d16a67f8f640054d8881ed315eea03
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltc:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T122E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczecw.exe

Path C:\Temp\xrpjhczecw.exe
Size 243KB
SHA256 a41869adf4676540af1a5ee5a32883e095394b0f59c636ea09afecc39c85df0d
MD5 5d16af430229c84afdef352c1495ebc6
SHA1 5802e45619e0cc53fca1cf189e0647ecdb56d61f
SHA512 28e0788a8c17320c6c45f2371f01d3c27330b78ecd8b91ac9c9ec8949689f9febe929e756ebc7aacdcbdd38fe65e415d0427888cb3931474d480a8de4053888f
SSDEEP 3072:+MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:YGii9IL8Xa3lLNngoqRttA7g
TLSH
T13734490272818031E75A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cd56ca0-f61d-4791-bda6-31aa60ba6e0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4cd56ca0-f61d-4791-bda6-31aa60ba6e0d.tmp
Size 35KB
SHA256 02a078e92a05357f3b493fb7fa2776938ad0ca43d0d8163d5429f663988f50b1
MD5 436de0deb842f15c1c3961b507e5ac4b
SHA1 0a1ae1e7b80b0c43aa1194e3af0d7009c8b92eac
SHA512 6f9bd17e1a79848a39290841362bda8f0440fbe4f300bbd5cb3fb44e3d31cdf64ff5fc505bcbc4f5226c641ddf00f972442dc4224994fc3b75a757cc86909cf7
SSDEEP 384:nPZcIU38NAa1vz6aFG6sWZlf8hyEGunG77nOy2rEoajo4cdR8eHhVODjYPNDUMVs:HU3oZzhFi0XarEnjN3Gac1FVb9Mj
TLSH
T174F2BF3069A58EB38CEEE356B58377426EF016B3C5D40F58D6DDAB0D05839AC1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

010da45e-4659-4fa5-8da2-ec0e6b8a985d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\010da45e-4659-4fa5-8da2-ec0e6b8a985d.tmp
Size 11KB
SHA256 b3af574ca70c1a82c7581b6765c94e91f8011d6ff2c10b274f51bff7f2cb08c9
MD5 ab1c015c8d8e7f1ff6746f36235e4541
SHA1 c3558503d9d387c2934698789b2a914ee5796ee9
SHA512 86f2a1206f26cb72ce8d566f8008e3839d6dde6723461e311133d8f29cb8f48b3a6571f55571ceb7ce1d8c834a0fd20955932e6644a3067122e335678b5d01df
SSDEEP 192:sxRMrCp/f3sTHKeZMN1FGzoA8p9V/g6+WNC5m/YD9j6S7G3jIgVNt0J:sxRMep/f3sTHKYeX7//5H/jSym
TLSH
T13442B7166A289D7B4CCBE219FB15BF53D6F95032A1951E48A7FC9A0C04E66DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 327ca8d32fd0eff2acfbb25c9451f4a696a29f8079b631fd8ef3308c78e61eac
MD5 7afcafc3a7bed948b88d1c05cc4e823f
SHA1 632f73d5dacaeb3bcd1d82633168a5cf8890135f
SHA512 c5d1cbb740e0251f6f6f6e805a7f2f82fa8e03c05399f0df6a7398f88cba3348ee54fc44f4aaa8f8a10e2418604d4028e92a8007e9701b2302b08bf2d32f1ac1
TLSH
T17551B795437709C1D73347B2D9F09B663EFAAAEF0A472FCD4C7435B4A8A6F685002560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597bed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597bed.TMP
Size 2KB
SHA256 df4ab30c71bcfc1d62cc97cb1dc2e7b7c51181468823bde36848cb78266f601b
MD5 fbf4c153b60322738f3f1d1f7a4414ef
SHA1 61100dd5bb66b1ea8d9c9288e075853974c4d317
SHA512 6e493957d4bf6ae03eb86462168fd0288c9d1f9beff89131982b7956b760ebb75cab39d5765e4f0303c57db2de7da66c24faabe571c842b19793627eb4219b52
TLSH
T16051C695437709C1D73347B2D8F09B6A3EFAAAEF09432FCD0C3835B0A8A6F685002160
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

bad927e4-ef16-43da-b9ef-33ce1322a907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bad927e4-ef16-43da-b9ef-33ce1322a907.tmp
Size 2KB
SHA256 4f79d1b3bff4e088f6622902028700673dc16aeb20925fe923dd64094eb28d09
MD5 85ee49c4714dbc4907fae10250bc7916
SHA1 3678d8ddd65d233ab24920c1f7858e0be4664e44
SHA512 bd4d057e00845b0eef6165b3b7859aa2df6b828b4836bc036f28f2a88c88fd20df9dc0da40ebb7bbadb2da13a0a97938d448f3eb9240cb6863a1a65b1927903f
TLSH
T12641D1F7C2E8863D894196F4EB147E1BCE2D0914832C3D5AC8E4AF1B93E2471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d9bf39625f0dd6c523b27f57aea8dd397d4fe45a4396b380a18236825324492
MD5 09c2f9be4b9004df692e569ccc4c2ed2
SHA1 3ae4f810f1e58cb89bed3a978e6e8f19a349fb1e
SHA512 45659f39c4040271a4f67400513940d1ee1da4c293e15a01129cbea95bf646a3dbbdc9c37fdbc3c1df733be99dadd7711b9514f84801bf0978cd9d45fa2db016
SSDEEP 192:sxRjrCp/f3s8nKeZMN1FGzoA8p9V/g6+WNC5m/YD9D6S7G3jIgDtNt0J:sxRjep/f3s8nKYeX7//5H/xSyy
TLSH
T1EA42B71669289D7B4CCBE219FB55BF53E6F95032A1911E48A7FC9B0C04E76DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 48d63ed2209fc1a92b7769359610d0f682eb9f800a23cc084e12866c8458a593
MD5 f1ee8cd629ec778ab35c99e802af5ada
SHA1 40f73b7d363baa5b7228e101e5f89b564634d83c
SHA512 ba9597963887247c73651ebed4d528b258fd902f12cadef4d920a531d654648fb2a9fad5034b4e44a47740ca47cb1ff6abb3fe0312ae7f51e4891e5e4784a408
SSDEEP 192:sxRjrCp/f3s8HKeZMN1FGzoA8p9V/g6+WNC5m/YD9j6S7G3jIgDfNt0J:sxRjep/f3s8HKYeX7//5H/jSyg
TLSH
T14042B7166E289D7B4CCBD219FB55BF53D6F95032A1911E48A7FC9A0C04EB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 6b4b646a3bda95e774af7cb7fddfbab9c65340e90a924495901af317458a9852
MD5 c70abf8df85c2e107ecbd8ff0c560419
SHA1 e4eadfeded2c5c5ce6891b7cacf70fbb64125e9e
SHA512 dacd806f963f760bd4c34a9da9e345c4c5530db02fa509454506055c6b24c1b88dac8c523d80b029cf58233875043cc95a1d94c807785ef823b78f6b8907b766
SSDEEP 768:azfWI57pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+pYc16Grop5PBi:azfWIPEf30Wg/XfHfu1jaJpYy69p54
TLSH
T1D3D2D97B640CCA7F4F800ADDAD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1762.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 73cf6e512c03b661de222c87fe028346faa38dde107c58dc9e7c8b0962432aa5
MD5 0437f154ff73284d8ddb9295299c22f2
SHA1 8c594f1a8b29a32ace0967dd514697337f2b309f
SHA512 7777db827747f6cfd0fd3ecd3eb54554f038d9c52adc8917ff384317827673653656b034182731c70f557ddf77b9dd592eaafeba467c22c66aed2dc27e27d2ed
SSDEEP 384:nVZcIU38NAR1vz6aFG6sWZlf8hyEGunG77nOy2rEoajo4cdR8eHhVODjYPNDUMVs:tU3jZzhFi0XarEnjN3Gac1FVb9Mj
TLSH
T17BF2BE3069A58EB38CEEE256B58377426EF016B3C5D80F58D6DDAB0D05839AC170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3345d7bc200ddc2feae1923c881c990c5b9d200ebc904ab50c86bd4f28282208
MD5 c4c3bc0a1f3e0b0b085a0aabdbc64d38
SHA1 55297c97d7646710c0272ac7cfa4eb9ca3a9bf3c
SHA512 dea91f1133e99362fead6b54d68a546626fa9cb6d5977ec3032158590275d87b299faf5b1194c7a9b3b69ccda304157dcc4db45e2ab98481d8884ab6df4d3806
SSDEEP 768:Rrv+4UNbdv3ozwFi0X8rEnjN3Gac1FVeVH1SCx:RbsbR3owMQnjMaOEH1X
TLSH
T17413BF3169B89E738CEBE245B14376437FF416A385940BA4D9C96B0D06875ED230BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d198106305d3859921cd2824efe1ed152a38c2c328ee2b33dfa4d00dd6aeb196
MD5 e9bf57643a1ba64a64d665c75c97a86c
SHA1 7853131b2c06df6fe07c5db2b4fdecefdccbdb3a
SHA512 e72c30765ecef89b51004d4e93fbaa2f516ee7110b7e20440bc812ae84fc1d862c7d83b426c44c4659b139f2fe71ae2aa7bce2eb7a8ad6fa73328e906f9829ae
SSDEEP 768:rrv+4UNbdS37mi0XSrEnjN3Gac1ZxeVH1SCz:rbsbg3ACQnjMaGEH1V
TLSH
T1E303BF3669A88EB38CEBA385B18776037EB4525385940BE0C9DD6B0D029B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 2918a04246c8cc5ef908f59f46b200fa0491934c02f171ee594c188f94fdcc93
MD5 5cc123fd99042eaab753d8b4aeac09a3
SHA1 041cf2afdf4a3f4f635b633b273f102ab48da332
SHA512 6bdb1f07065d9f30fa4ca7a880069c919e4b97389dabbdf54f1e43c3516db3a67b1511d792be59689a1ee001aee07bc123a335feb062e5f17ec0f82ae734b264
SSDEEP 384:nFiFiZcIO38NA8TUNTUlIlR1vz6aFGJs4Hf05yEGunG77nNy2rEoajo4cdR8eHh+:MFQO3nwgLZzuesXfrEnjN3Gac1FVb9Mj
TLSH
T19B1338F598D78A76D8AE9783A37E6E429DFCC163B5984994B7C85D0CCC820BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

0a411416-f3fa-4281-a21b-627e0ed06a39.tmp

Path C:\Users\Admin\AppData\Local\Temp\0a411416-f3fa-4281-a21b-627e0ed06a39.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4432_695256524\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1000-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1524-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1788-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1796-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1972-688-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-602-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3116-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3232-586-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3280-639-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3476-175-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5128-619-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5264-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6052-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6092-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download