dfe694a0b0a7e51ae03f73a576a7f779c3b6519fa21f81685f5cb53213fd85b3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-ndtd8a11hz
SHA256 dfe694a0b0a7e51ae03f73a576a7f779c3b6519fa21f81685f5cb53213fd85b3
MD5 abc2eb0b611ed309fdd5cf45dbf923db
SHA1 0dd7f9b63fee008219085e880c84c8f930f19746
SHA512 f3d66548ff1cf02217352d1d0f72b6911f42c52a7f5cdf79e203a87774a2e35129f85f8d83dba362d772465bba98646731b7f06f72cc0fde3621412066ef140e
SSDEEP 3072:lMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:RGii9IL8Xa3lLNngoqRttA7D
TLSH
T19034490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6832	CP.exe
7112	mhbztrmjez.exe
2624	CP.exe
2952	CP.exe
6536	i_mhbztrmjez.exe
6272	ezwuomgezw.sys
3616	CP.exe
4552	gebztrojge.exe
4260	CP.exe
2000	CP.exe
3420	i_gebztrojge.exe
6280	mgeywqolge.sys
3044	CP.exe
6016	jdbvtoljgb.exe
5340	CP.exe
2348	CP.exe
3000	i_jdbvtoljgb.exe
6128	fdyvqoigay.sys
4472	CP.exe
4480	bvtnligays.exe
2816	CP.exe
2920	CP.exe
4264	i_bvtnligays.exe
4524	lyvqnlfdav.sys
4276	CP.exe
5420	vsnlfdxvqn.exe
4296	CP.exe
5880	CP.exe
5016	i_vsnlfdxvqn.exe
5272	vqnigaysqk.sys
6920	CP.exe
5100	kicausnkfd.exe
1088	CP.exe
3444	CP.exe
2444	i_kicausnkfd.exe
6276	kicaxspnki.sys
3640	CP.exe
6812	kifzxspkhc.exe
5028	CP.exe
4368	CP.exe
2472	i_kifzxspkhc.exe
4872	smkhcausmk.sys
6056	CP.exe
6296	pnhfzxrpjh.exe
6384	CP.exe
4984	CP.exe
2536	i_pnhfzxrpjh.exe
5916	xupmheurpj.sys
2192	CP.exe
4452	jecwuomhez.exe
5536	CP.exe
6520	CP.exe
6328	i_jecwuomhez.exe
6488	rpjhbzurpj.sys
6956	CP.exe
1540	omgezwjgby.exe
3776	CP.exe
7004	CP.exe
6784	i_omgezwjgby.exe
1592	ojdbwtomge.sys
2520	CP.exe
5908	eywrojhbzt.exe
1536	CP.exe
1700	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_911111397\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_911111397\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_911111397\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_1932603459\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5884_662367329\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5884_762453672\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnligays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbztrmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnligays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwjgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcztrpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwjgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbztrmjez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcztrpjztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigbyt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6240	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5740	ipconfig.exe
6968	ipconfig.exe
2840	ipconfig.exe
3808	ipconfig.exe
4460	ipconfig.exe
4996	ipconfig.exe
4888	ipconfig.exe
5536	ipconfig.exe
3440	ipconfig.exe
4840	ipconfig.exe
200	ipconfig.exe
4756	ipconfig.exe
5548	ipconfig.exe
6976	ipconfig.exe
6364	ipconfig.exe
4952	ipconfig.exe
4364	ipconfig.exe
4656	ipconfig.exe
6516	ipconfig.exe
4364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299702462530861"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{224B9D9B-9880-4BC9-8C5E-7463974F9D61}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe
5884	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6536	i_mhbztrmjez.exe
Token: SeDebugPrivilege	3420	i_gebztrojge.exe
Token: SeDebugPrivilege	3000	i_jdbvtoljgb.exe
Token: SeDebugPrivilege	4264	i_bvtnligays.exe
Token: SeDebugPrivilege	5016	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	2444	i_kicausnkfd.exe
Token: SeDebugPrivilege	2472	i_kifzxspkhc.exe
Token: SeDebugPrivilege	2536	i_pnhfzxrpjh.exe
Token: SeDebugPrivilege	6328	i_jecwuomhez.exe
Token: SeDebugPrivilege	6784	i_omgezwjgby.exe
Token: SeDebugPrivilege	6432	i_eywrojhbzt.exe
Token: SeDebugPrivilege	3772	i_qljdbytrlj.exe
Token: SeDebugPrivilege	1180	i_gaysqlidbv.exe
Token: SeDebugPrivilege	3228	i_aysqdavsnl.exe
Token: SeDebugPrivilege	4460	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	2540	i_hfzxupnhfz.exe
Token: SeDebugPrivilege	2532	i_bzurmkecwu.exe
Token: SeDebugPrivilege	1900	i_hcztrpjztr.exe
Token: SeDebugPrivilege	4884	i_hbztrljdbz.exe
Token: SeDebugPrivilege	1604	i_bywqoigbyt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 5612	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	90
PID 5612 wrote to memory of 5884	5612	iexplore.exe	91
PID 5884 wrote to memory of 4420	5884	msedge.exe	92
PID 5884 wrote to memory of 4564	5884	msedge.exe	93
PID 5884 wrote to memory of 6240	5884	msedge.exe	94
PID 5884 wrote to memory of 4564	5884	msedge.exe	93
PID 5884 wrote to memory of 4564	5884	msedge.exe	93
PID 5884 wrote to memory of 4136	5884	msedge.exe	95
PID 5884 wrote to memory of 4136	5884	msedge.exe	95
PID 5884 wrote to memory of 3480	5884	msedge.exe	98
PID 5884 wrote to memory of 1496	5884	msedge.exe	97
PID 5884 wrote to memory of 3480	5884	msedge.exe	98
PID 5884 wrote to memory of 3480	5884	msedge.exe	98
PID 5884 wrote to memory of 1496	5884	msedge.exe	97
PID 5884 wrote to memory of 1496	5884	msedge.exe	97
PID 5884 wrote to memory of 3088	5884	msedge.exe	99
PID 5884 wrote to memory of 3088	5884	msedge.exe	99
PID 5884 wrote to memory of 3088	5884	msedge.exe	99
PID 5884 wrote to memory of 1664	5884	msedge.exe	100
PID 5884 wrote to memory of 1664	5884	msedge.exe	100
PID 5884 wrote to memory of 1664	5884	msedge.exe	100
PID 5132 wrote to memory of 6832	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	101
PID 7112 wrote to memory of 2624	7112	mhbztrmjez.exe	104
PID 5884 wrote to memory of 6724	5884	msedge.exe	107
PID 5884 wrote to memory of 6724	5884	msedge.exe	107
PID 5884 wrote to memory of 4272	5884	msedge.exe	108
PID 5884 wrote to memory of 4272	5884	msedge.exe	108
PID 5884 wrote to memory of 3136	5884	msedge.exe	110
PID 5132 wrote to memory of 2952	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	113
PID 5132 wrote to memory of 3616	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	117
PID 4552 wrote to memory of 4260	4552	gebztrojge.exe	119
PID 5132 wrote to memory of 2000	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	122
PID 5132 wrote to memory of 3044	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	126
PID 6016 wrote to memory of 5340	6016	jdbvtoljgb.exe	128
PID 5132 wrote to memory of 2348	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	131
PID 5132 wrote to memory of 4472	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	135
PID 4480 wrote to memory of 2816	4480	bvtnligays.exe	137
PID 5132 wrote to memory of 2920	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	140
PID 5884 wrote to memory of 2832	5884	msedge.exe	143
PID 5884 wrote to memory of 3228	5884	msedge.exe	144
PID 5884 wrote to memory of 3132	5884	msedge.exe	145
PID 5884 wrote to memory of 6268	5884	msedge.exe	147
PID 5884 wrote to memory of 6268	5884	msedge.exe	147
PID 5884 wrote to memory of 6032	5884	msedge.exe	149
PID 5884 wrote to memory of 6032	5884	msedge.exe	149
PID 5132 wrote to memory of 4276	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	150
PID 5420 wrote to memory of 4296	5420	vsnlfdxvqn.exe	152
PID 5132 wrote to memory of 5880	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	155
PID 5132 wrote to memory of 6920	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	159
PID 5100 wrote to memory of 1088	5100	kicausnkfd.exe	161
PID 5132 wrote to memory of 3444	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	164
PID 5132 wrote to memory of 3640	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	168
PID 6812 wrote to memory of 5028	6812	kifzxspkhc.exe	170
PID 5132 wrote to memory of 4368	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	173
PID 5132 wrote to memory of 6056	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	177
PID 6296 wrote to memory of 6384	6296	pnhfzxrpjh.exe	179
PID 5132 wrote to memory of 4984	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	182
PID 5884 wrote to memory of 1208	5884	msedge.exe	184
PID 5884 wrote to memory of 1208	5884	msedge.exe	184
PID 5132 wrote to memory of 2192	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	189
PID 4452 wrote to memory of 5536	4452	jecwuomhez.exe	191
PID 5132 wrote to memory of 6520	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	194
PID 5132 wrote to memory of 6956	5132	2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe	198
PID 1540 wrote to memory of 3776	1540	omgezwjgby.exe	200

C:\Users\Admin\AppData\Local\Temp\2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_abc2eb0b611ed309fdd5cf45dbf923db_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9339ac188,0x7ff9339ac194,0x7ff9339ac1a0
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,3276034796160177749,591152355116676172,262144 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:2
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6924673437212331613,17790543972167410727,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
      4⤵
      System Time Discovery
      PID:6240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,10205719435977586302,773865428358821442,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2280002722809381228,15792291937681465938,2097152 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,7616445852869796869,1463093767002157565,2097152 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3524,i,2193892474359560744,5823136304075911821,2097152 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5180,i,14204393274484686554,15568852186647814005,2097152 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,11775776323044172737,11293986005750328569,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,1401482055778133721,7109805907066098381,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,15030415672975188336,13453353709788748386,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,15030415672975188336,13453353709788748386,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,3202531374344770736,6735586225922906505,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,14829466672305968718,2176958072129669962,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,8356381407053528093,6519996322484804506,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11400305662692176828,6694256401308694615,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:14
      4⤵
      PID:6268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,13403675416901288768,15495978926701581170,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,1237538817960229634,6827884940200931104,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,8436862171937023699,23194274174545870,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,17614665333531408946,13045217035436604663,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:14
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16469369971091598657,4644800714732071240,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,868117105954345886,138417925534588210,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5940,i,9231071691151514331,18404800256344394269,262144 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12871776740010294933,8539367001175349008,524288 --field-trial-handle=2684,i,14977161103084195599,4248333365150724183,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbztrmjez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6832
- - C:\Temp\mhbztrmjez.exe
    C:\Temp\mhbztrmjez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbztrmjez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2952
- - C:\Temp\i_mhbztrmjez.exe
    C:\Temp\i_mhbztrmjez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebztrojge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3616
- - C:\Temp\gebztrojge.exe
    C:\Temp\gebztrojge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebztrojge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_gebztrojge.exe
    C:\Temp\i_gebztrojge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtoljgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3044
- - C:\Temp\jdbvtoljgb.exe
    C:\Temp\jdbvtoljgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtoljgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\i_jdbvtoljgb.exe
    C:\Temp\i_jdbvtoljgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnligays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4472
- - C:\Temp\bvtnligays.exe
    C:\Temp\bvtnligays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnligays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2920
- - C:\Temp\i_bvtnligays.exe
    C:\Temp\i_bvtnligays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Temp\vsnlfdxvqn.exe
    C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5880
- - C:\Temp\i_vsnlfdxvqn.exe
    C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6920
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\i_kicausnkfd.exe
    C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3640
- - C:\Temp\kifzxspkhc.exe
    C:\Temp\kifzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Temp\i_kifzxspkhc.exe
    C:\Temp\i_kifzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6056
- - C:\Temp\pnhfzxrpjh.exe
    C:\Temp\pnhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\i_pnhfzxrpjh.exe
    C:\Temp\i_pnhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Temp\jecwuomhez.exe
    C:\Temp\jecwuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6520
- - C:\Temp\i_jecwuomhez.exe
    C:\Temp\i_jecwuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwjgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6956
- - C:\Temp\omgezwjgby.exe
    C:\Temp\omgezwjgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwjgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7004
- - C:\Temp\i_omgezwjgby.exe
    C:\Temp\i_omgezwjgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywrojhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2520
- - C:\Temp\eywrojhbzt.exe
    C:\Temp\eywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywrojhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Temp\i_eywrojhbzt.exe
    C:\Temp\i_eywrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbytrlj.exe ups_run
  2⤵
  PID:6736
- - C:\Temp\qljdbytrlj.exe
    C:\Temp\qljdbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbytrlj.exe ups_ins
  2⤵
  PID:2708
- - C:\Temp\i_qljdbytrlj.exe
    C:\Temp\i_qljdbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  PID:6372
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  PID:6968
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqdavsnl.exe ups_run
  2⤵
  PID:5228
- - C:\Temp\aysqdavsnl.exe
    C:\Temp\aysqdavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqdavsnl.exe ups_ins
  2⤵
  PID:3132
- - C:\Temp\i_aysqdavsnl.exe
    C:\Temp\i_aysqdavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:7044
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:3284
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxupnhfz.exe ups_run
  2⤵
  PID:1888
- - C:\Temp\hfzxupnhfz.exe
    C:\Temp\hfzxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxupnhfz.exe ups_ins
  2⤵
  PID:5096
- - C:\Temp\i_hfzxupnhfz.exe
    C:\Temp\i_hfzxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmkecwu.exe ups_run
  2⤵
  PID:1592
- - C:\Temp\bzurmkecwu.exe
    C:\Temp\bzurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmkecwu.exe ups_ins
  2⤵
  PID:1712
- - C:\Temp\i_bzurmkecwu.exe
    C:\Temp\i_bzurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcztrpjztr.exe ups_run
  2⤵
  PID:3580
- - C:\Temp\hcztrpjztr.exe
    C:\Temp\hcztrpjztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcztrpjztr.exe ups_ins
  2⤵
  PID:3728
- - C:\Temp\i_hcztrpjztr.exe
    C:\Temp\i_hcztrpjztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljdbz.exe ups_run
  2⤵
  PID:3100
- - C:\Temp\hbztrljdbz.exe
    C:\Temp\hbztrljdbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljdbz.exe ups_ins
  2⤵
  PID:4908
- - C:\Temp\i_hbztrljdbz.exe
    C:\Temp\i_hbztrljdbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqoigbyt.exe ups_run
  2⤵
  PID:6304
- - C:\Temp\bywqoigbyt.exe
    C:\Temp\bywqoigbyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqoigbyt.exe ups_ins
  2⤵
  PID:4324
- - C:\Temp\i_bywqoigbyt.exe
    C:\Temp\i_bywqoigbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1224

C:\Temp\ezwuomgezw.sys
C:\Temp\ezwuomgezw.sys
1⤵
- Executes dropped EXE
PID:6272

C:\Temp\mgeywqolge.sys
C:\Temp\mgeywqolge.sys
1⤵
- Executes dropped EXE
PID:6280

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\lyvqnlfdav.sys
C:\Temp\lyvqnlfdav.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:5272

C:\Temp\kicaxspnki.sys
C:\Temp\kicaxspnki.sys
1⤵
- Executes dropped EXE
PID:6276

C:\Temp\smkhcausmk.sys
C:\Temp\smkhcausmk.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\xupmheurpj.sys
C:\Temp\xupmheurpj.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\rpjhbzurpj.sys
C:\Temp\rpjhbzurpj.sys
1⤵
- Executes dropped EXE
PID:6488

C:\Temp\ojdbwtomge.sys
C:\Temp\ojdbwtomge.sys
1⤵
- Executes dropped EXE
PID:1592

C:\Temp\oljdbvtolg.sys
C:\Temp\oljdbvtolg.sys
1⤵
PID:4964

C:\Temp\qoigdynlid.sys
C:\Temp\qoigdynlid.sys
1⤵
PID:940

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
PID:1852

C:\Temp\pkicaxvsnk.sys
C:\Temp\pkicaxvsnk.sys
1⤵
PID:2432

C:\Temp\kicaurpkhc.sys
C:\Temp\kicaurpkhc.sys
1⤵
PID:5672

C:\Temp\rpjhczukec.sys
C:\Temp\rpjhczukec.sys
1⤵
PID:1548

C:\Temp\ecwurmjebz.sys
C:\Temp\ecwurmjebz.sys
1⤵
PID:4184

C:\Temp\ebwurmjecw.sys
C:\Temp\ebwurmjecw.sys
1⤵
PID:6628

C:\Temp\gbztrljgey.sys
C:\Temp\gbztrljgey.sys
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnligays.exe

Path C:\Temp\bvtnligays.exe
Size 243KB
SHA256 6086c9b6955cbdbede843472cbc8e1276562b548b0c7586c422eabbb3b0e680b
MD5 5ca5867f47c0acafd89802a3e050c4eb
SHA1 3f9d62b0402cf05659ec24d09dd92b23b8514769
SHA512 3668220a1bf5a012d15027d499cdc66c350027f720bba7135d5d2ce476a1fc7c000f4129a7e3ea250b989deba2988e8cc44eb6de8bc5e6d1e575196bfd41e15f
SSDEEP 3072:ZMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:dGii9IL8Xa3lLNngoqRttA7T
TLSH
T15934490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwuomgezw.sys

Path C:\Temp\ezwuomgezw.sys
Size 141KB
SHA256 357f78ca389fa7075e82fddae1ec6bac33e211035c66451d7c8a3e3e8d7293b7
MD5 03d5b2e99dc804d34aec34d19f63a720
SHA1 2b8973ecf3f6a9be98b80a1de9ab3005898bbb85
SHA512 67c8c925e3305226ab5c2f6c87add1d75ce2b9be1b0e55bdcbd27fd131bfafc92f4cdba430495a05a14285540297042acb468e910486d8b1d355ed03899409e6
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.sys

Path C:\Temp\fdyvqoigay.sys
Size 141KB
SHA256 da0d65af2bff5f0588517828734674a6dd9ce4d22d8b5603522db40b7aa8c1ba
MD5 3576d75b005687865b1eaa94bc37603a
SHA1 20e04b5be4b69adf8d8dedd5cdaa3b28d2ed2053
SHA512 80e322b4a8cbb68e7468c0ad53db660f5e8c4d5dcebb9ee1ee742f7e3310eabb455c48ebfade4e5acfcd08b1e277f77459f573443ba5890283fc896fa692581a
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebztrojge.exe

Path C:\Temp\gebztrojge.exe
Size 243KB
SHA256 618044020244f1c91cf6785868fe4a5ae2e1b2f373807e7f1cbd476c57738679
MD5 baa690aa62844bbc372d1884d0f90a66
SHA1 37c1ae5a8e2b17a3619bd276756f5368f74fd91b
SHA512 fdb4390185421f80aa12c5213e7be5601a03ec596760309d6325dd855d35f14dc7b7e3cb61b9afa98ec013b930bb9d9b48f5954040bc6ed3bc4ee4ad8be45da9
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:FGii9IL8Xa3lLNngoqRttA7X
TLSH
T15B34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnligays.exe

Path C:\Temp\i_bvtnligays.exe
Size 243KB
SHA256 88cf58dc2aadfd47fb789a5dff10291ab5d039174cbf8a9f02bd831d1274a446
MD5 713a6eb86a2125089a4a7f04e9e56528
SHA1 b477653e1b8afbd0636493dbe01e6c27b5bfad3b
SHA512 cd8c07ba9f70c64d03591c79f3e96352097c3367cd46215cec9c90669accbd5d0137b6811b18a895205996e63078f46121389e9ccacc02b08c32f55d951c4f30
SSDEEP 3072:EMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:GGii9IL8Xa3lLNngoqRttA7W
TLSH
T12E34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gebztrojge.exe

Path C:\Temp\i_gebztrojge.exe
Size 243KB
SHA256 9de365690c7c7ba7e939d83683dacd413390d7bb66735edd010c51abba5af800
MD5 c8a00926d8a08dabe3c331939f96d73d
SHA1 677357b35aa9700fcf5ea0722607e618e1f47609
SHA512 d20490d764beb6095434ba2d21f9ca598de92f63245ac56fb80f1d39012923eb6eeb995e8b36d6980609088d14aca051516226ded4cc8b3764afcdf8d88a7553
SSDEEP 3072:CMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:0Gii9IL8Xa3lLNngoqRttA7Q
TLSH
T18A34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtoljgb.exe

Path C:\Temp\i_jdbvtoljgb.exe
Size 243KB
SHA256 6a6b82af614f75d69e14215e588d25393fcd300af648f453c051099d423707ca
MD5 6de90ff43349b634010bda95fb004f7c
SHA1 9d984cc0f215c085f1e5d4511efe15e3a33f0727
SHA512 9816c890c60795fd62f767cf021576de7bd5b6a472f648bcfebaf0e2b76fc26e0a08f36b3c649a70313dccc1439cd7306d56d7a9c5f64ba0f6a2a9fa99c4296e
SSDEEP 3072:sMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:+Gii9IL8Xa3lLNngoqRttA7+
TLSH
T19B34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausnkfd.exe

Path C:\Temp\i_kicausnkfd.exe
Size 243KB
SHA256 f9053b2524159170de6692dfeca4610da795444ea86aa9955e5a2766225dbee9
MD5 936e4abd4313534d8071abc77acff474
SHA1 22435bb14dbd8be9e1c456b870a3a0ea9cb53ed4
SHA512 a9b8156e648cf2b3a9f3c798e72205d780c40678307860f09e7fa8c668174b0899c26ddd3fc21e6a8bacba7cdc2c82c544f49a2e85f14b5e4a646f1894225853
SSDEEP 3072:WMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:gGii9IL8Xa3lLNngoqRttA7c
TLSH
T1E034490272818031E75A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhbztrmjez.exe

Path C:\Temp\i_mhbztrmjez.exe
Size 243KB
SHA256 4f43e63f7d90d74023af6aed194c93200f84dbc8d68cb9cf5b91da39abc529dc
MD5 04e32c9f0654cab9f0fc74e7f3021f22
SHA1 7627f6d18659e5ced84d7c697bae307c92a85da6
SHA512 a7fae93d682887fd15c05f85e1448859fe8d616661a8716fbc8ee4046703376a122faa907d4d9db47b11d894c6b4fcbdfcde686ecdb2a580eeccc08e7cb47785
SSDEEP 3072:0MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:WGii9IL8Xa3lLNngoqRttA7O
TLSH
T17534490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvqn.exe

Path C:\Temp\i_vsnlfdxvqn.exe
Size 243KB
SHA256 da1a7ce77c9ffd90837f268174754e0f90d2f47120d73c16b6fb5194a9104559
MD5 84f9aaf2ba6d1689227e27e0ad84d689
SHA1 ddfc2018b5dd350a33f91346b77eca7ea3e1fcdd
SHA512 c70a602005efa0a41422c5e1205487402611e144123520f139b5d429dcadd7639bd17859df582f9f917e0d0491f521b98d60e1f101e15559490adbe706853e58
SSDEEP 3072:dMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:5Gii9IL8Xa3lLNngoqRttA7H
TLSH
T13D34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoljgb.exe

Path C:\Temp\jdbvtoljgb.exe
Size 243KB
SHA256 383fca03418925124de9c5187b7553a39918f91f51cdd2319efecdf8577df471
MD5 b0fd5b31b4b9f8c2295e536be32f7c84
SHA1 8b685c9bbe696c39c5a690c7f8fe9849c30277c0
SHA512 25cc8ef6253c27e40352737a3e1d29f549c5a81ec12d0d672d4481375b5863692ea37068e0fce821d3175c96ef8e5d06c973beb3b21ad39f6b71f73d108dcc26
SSDEEP 3072:fMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:7Gii9IL8Xa3lLNngoqRttA7p
TLSH
T13534490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfd.exe

Path C:\Temp\kicausnkfd.exe
Size 243KB
SHA256 76c7a694625800b797f602b02d0300b6d92dc024c490990be1de7d784f172fbc
MD5 36d02dcdd1afd5424883813edf0596ad
SHA1 676f842d81f7091b97a61340ddcb3439ff77aaf4
SHA512 3cac4b15217ec15e437d680993d493cf42f636b1ad64ca5df42edea2f6a451f8bcdc60ff09d5c4dd6a6308f71912b85d4a315ec44e53b99f487665a4c50ddb67
SSDEEP 3072:sMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:+Gii9IL8Xa3lLNngoqRttA7i
TLSH
T1CB34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspnki.sys

Path C:\Temp\kicaxspnki.sys
Size 141KB
SHA256 0331c82790e4697adbe0483681aed1fb88a8ee6d98aa212cde5d9d34822c0378
MD5 02de018f93e2859943d2ac52aa373d7d
SHA1 cc58fa18ea5876625170ed48730cd178bfca393f
SHA512 10724cb3560d1aae3bcdf493e0c24051c7a7f6699255d19393f17cd59fd5f05b9945cf2ae15af24e813bc9f86ab3b093830142d327f6112901f6dd4d3bb388fd
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lyvqnlfdav.sys

Path C:\Temp\lyvqnlfdav.sys
Size 141KB
SHA256 a312d7630a717ee4ce6b0f626c729e58ee932a33baf0bffd24d77e0efb259545
MD5 3b756def976e164c018a0ade64a508e2
SHA1 a6cfb37d919edca6d8271a38dfea34fc09e78e75
SHA512 31f048e6b42024b99ae6755c0ecacbf8a06477ae17ab591acdb74998cd22011df57ad77fed45636b1f5f623e2462cd684265fc9d800bb82b6c7b10d08905dcc7
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T194E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqolge.sys

Path C:\Temp\mgeywqolge.sys
Size 141KB
SHA256 8bae7289f6ed79d22951e1ef07a8b4016a9e22c22970dd4706fa445df321a9b0
MD5 dc0ba1176f48965ea094875e6a1fd17f
SHA1 a20b01c40ffb60e50d40574ab38e92bab1d97fec
SHA512 26c6b0813a93a43f38fb3dabba78a59e52102a00ffe04c3568f69d7ac988d0a00b5e34761bd7c6c25e02df400454afb3c04814b0ddacf1687d9921db7bb2ef74
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbztrmjez.exe

Path C:\Temp\mhbztrmjez.exe
Size 243KB
SHA256 f0486d2177d4b02649beaf6bb0c09d9209fc7c92217487f44f85a0ced1c52e16
MD5 66d28e4ff4316d35c257b325e397dd0c
SHA1 700ebb8fba4e301f1229bb13290b0af8e642032c
SHA512 bf03ba9e841a5e648611ebfa0295fa25f169858e8db05bf090adab2773889e7a04188e5d09cfef76640bd6d90e75ea45af35cd75727754604f96569b406a7acb
SSDEEP 3072:eMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:4Gii9IL8Xa3lLNngoqRttA7M
TLSH
T13334490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysqk.sys

Path C:\Temp\vqnigaysqk.sys
Size 141KB
SHA256 5225ad4a561fdc459ab614265d5476fb10a99dbd78a8869b072ea9f7e2b0f889
MD5 33a0a190e3b3eedb2ccbf3fd50129f98
SHA1 0cf959de17c684963c79cf30785629fd6fed34db
SHA512 ef64ca846c0d415c02edd145d6eefa234d4cacafcca956721f66ae61cfaa10117951ff79e2d99915602860f481aeedfa9de6f1a4d2a729bc6313ced528a152c0
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T102E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 243KB
SHA256 ede30febeab4e8f036345882103d7217ac7966cd8d37e5564944c0bb37c81d60
MD5 7b7a52bd8361841e68b657e49126dc5b
SHA1 47858a13bb460a37199c3ea2823cddc4e7a705fc
SHA512 18201ead01a8d362c0f1341d9fcbaa69bcb3a0628822e5958dfda2091f9ad179e328a3f8cd9e6e7f0e0e629559fee7084380d589509edf24c3f64314198669dc
SSDEEP 3072:bMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:fGii9IL8Xa3lLNngoqRttA7B
TLSH
T1FA34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

07dbc4d7-65cd-4673-91ac-c540dff9283a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07dbc4d7-65cd-4673-91ac-c540dff9283a.tmp
Size 15KB
SHA256 35a2f408069ff2a01fbde947459e2308fd6c125014d8ec41fb8f14185bb28c10
MD5 ae1f8f354506919df78064d5a5f88844
SHA1 1e21fafc6b0e95b3b0cfef99c3d1ce3a51e5bc0c
SHA512 52f6fffdc405db3b3d169051c8504ebdb0715b6f982cd63064a0de2a7df7f6482f7c96ebc3d4e9f0d86fb3ebe1ed9049a6fa4d2dd5d56923dfa5e539cb34bf1c
SSDEEP 384:sxRN78z/fTs7KN/RI6iI/51/WXEsGQnBjX:sJYz/fW4Ws/5JWXEsGQnl
TLSH
T19472D9166A249D7B8CDBD209FA557F53D2F81173A1945E44AAFCCA0C04EA6ED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 fdf0d2da74cbcb66b04b642c5e7ac608685888650061a3507f8a7b7c7d0c6678
MD5 d4cb16f65cc257842cabea841e3d6766
SHA1 21bb634fc92026c4e49f81e752e885c2440c5afc
SHA512 ebd53cf9b077cb0b47f994431c4180da086bc515c8a6bfec4163b07152b372fc9282d98604adf084f80f0b135bb0417be7d73d6aacc908a5b17c67905d5fedce
TLSH
T195E0D8CC828CCA5547C999878259A294585464C596CB949F3A44709C7441002535FECC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 bf86fcdd92d1c64d0c66b91b46e7acdf161c19565368b613f7ccb92edf129a21
MD5 76786c1e819ab881ffd257aca6beb8f7
SHA1 bbc009dfbb508870440face99017d6199e3bb40e
SHA512 c87398fb4338af7e19a8705679427e4b96e02f44667dfa1c049dab4417bf42bb52fa35d95bb240a62ac3ed5c708b8b39155d4f6547d2f41e77b348c15a999f78
TLSH
T190F0A9A6D921BC3719FD1B1870984B4BE750136B3B41995B3B3D921D4FB463B8B4681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e269d3f08fa1bed291e32ec5ce0de7168bf43b7a57cfdd45e5c10464320fe414
MD5 02e65540e394b244272e01a0694ae776
SHA1 010757d220d6dc2c8ad5cafe6a3160504486d218
SHA512 7957b1c7c7bd8cb8b793dfbe6b99305416a68f6f7b5ed34453c3a73c5c4562ce8ed3c661627a973ad72c96710ac2e5e862db7f9bf306584d3f324da45964fd4c
TLSH
T111519EF783E4866DCA1156F0AB187E2BCE2D0914432C7D5A89E4AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 12d54b4977385a64fc121068120a05dde4019c0c7274181cea585c419e4e8f20
MD5 4be86a07cd338183bcc72f8cdb617adf
SHA1 c6bf95f4bad69ee12428434b837012f3bd393b6f
SHA512 8ed3811f4950ccef520e763e50754fcfb22ec2830cc6960540015b4852eb5d08ff9ca1f3e726d7dd6ff6a5cd5b48cbbed28bb7c44007b447f8b62a4dbc81a297
SSDEEP 384:sxRN7qZz/fTsf5N/RI6iI/51/WX9sGQnBomy:sJ2Zz/fWbWs/5JWX9sGQnSR
TLSH
T17472E91AAA248D778CCBD609F6957F53D2F85163A1905E44AAFCCB0C04EA6DD6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4965ffa92be5999106198906999dd9cde5960e771d2a3c840751c81af45603f6
MD5 21fc739b9aab186b54e874890571ddbb
SHA1 a09c6569525f637b9b39b67d918407c344b290ab
SHA512 7ab0fb760bdc965fa5f0b2f50fe11ccf4ba80e2085c262aef617e0a454705618a6322a6c8b54671f27c13efdfbf7949676bc8e84c384f744644021e633f95944
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCobbDwzroM4C:Ob4YZnE7yTWg1NfwBu1jaJobHwATC
TLSH
T160E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 8bd38beb92f5ac1eebce8b5d0f710bb25509a678f469cdcebdbb8c27bbeb2f87
MD5 c9364afce8d6c983098ec31fcdaff047
SHA1 00fcce122dc22d97d27b158ab490180bfda16d3a
SHA512 bcbb9db4f4882a6261e92b2a0334a12c1e36b1e5c664cc716edd95e38184c128d6b4c8ed10e5f91feb52d6fc07ae827a577d0d3e93f56e7ac32c6e2649dd67d7
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9pFD:yv+RpPYDDRPbIhJ9pFD
TLSH
T1C4B26B11713F4690387EB90891B9981F86C2B4637119F53F7BA802A65F67E138DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5cbc18450d2703888c5fd556eeb664a4d6e6c0472f388476c07e727dcb62091d
MD5 5df38c74e2932cf189d96f09b8f0297a
SHA1 b261147a00006407aeee5505be731415defc6cb4
SHA512 7837e266a5c3fc4b21817295924981c26e7dc57ee20743a6f0ee8002abe378803f32e545975a2e2e9f82ff5a4d5b7a665c79d3bbc5625cedde40c9f45d2843de
SSDEEP 384:nQiF1tNn/s3n9Sn8NgP8TUNTUlIRiPvuTuqRenf+GGeuXFLkOObjI9G6w7tr8LEk:rF1j+9SXPwgUubyGeuhk29MZM
TLSH
T1BBC24A36EC59CEB7EDE68FD9B70A7A1AEEE0126785D85AC4DAD85D0C00871EC4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e41b573c10a224a6274f98e3b13ab46e4003dc50bf80fd7e3da0047b1844f8ab
MD5 2927c620b94cfda02e49c715ce7da5a9
SHA1 881cdb76975a1d669134a8cf2762d1c95150149c
SHA512 7ba37d36cdd9eb5a30f88832660e0a3dbfd7a457137bd9701d2b70a57c881b6ebe383bef28ccdbfcb2c265cd27cac276663cd66c7b7eb931a02f69199495b310
SSDEEP 384:niiFiZcIz8NLj8TUNTUlIRrPvuTchOenf+GGeuXkdLBG5OObjI9G6w7b8LEEIzQ:pFQzQjwgBuqjGeuUq529Mq
TLSH
T155D25B32EC54CEB7ECEB8F95B6497646EEE05163C59C9AC8E6D89E0C00971ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c259abbef2e9fd0026cfff8174c34c47782ec79df68c7db1eb9272672901ecaa
MD5 34ca43f9b42af2ec0e42f7292fa33c46
SHA1 4d2d611f3041ffe8c2e40e802d2126eef3b78f05
SHA512 ca57c6fa7259f3cbb4a97aa240680a9c3eabb2939d6a65c8be7b89e64330dbe5b0aa4d70e4a5f7567cfb9936a8121f5fde4414dba99d15f5cb91b62b5b9f0adf
SSDEEP 384:nSiFiZcIr8NLj8TUNTUlIRrPvuTAhOenf+GGeuXkdLBG5OObjI9G6w7b8LEEIzQ:ZFQrQjwgBuejGeuUq529Mq
TLSH
T142D25B32EC54CEB7ECEB8F95B6497646EEE05163C59C5AC8E6D89E0C00971ED070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8c0f015461f317e6675034ce347a7df82060167c12c3822f67bac4abd0c2919b
MD5 218aab68926c551cff679c4850790c1a
SHA1 160be9e9ff10885f0f66f2e36c4c65bfc3201be0
SHA512 d0ab76fc62c0f3171c8895dfaa87d30b71a91e405fc17abc4dbacfda7b4d72cde9b5cb22e5e63a90529fec2fbc5dfacdd97e949ea22eaa9cdc06986431e02e9f
SSDEEP 384:nViFiZcIv8NLj8TUNTUlIRrPvuTAGOenf+GGeuXkdL7+5OObjI9G6w7b8LEEIzQ:cFQvQjwgBudjGeuU0529Mq
TLSH
T1E4E2D4F298D78A72E8AE4B87677D2D069DFCD163B5884A84B7D44D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b2d1b954e6e34b183d36d141c916b8de5bb0c127b2b0eb6bae66d47541cabc22
MD5 21b975ecac4bfdc81010d16e71c053e9
SHA1 0a6a0d7e857bce082c942d34790a0e778d88ade5
SHA512 37a7d22a609b8f2be377bc7c44c0a6776b42d134486eddee30046ef2705f7a973596c0039f17cceb314987734115d4512d742e26e8907041091c0d701fbd187c
TLSH
T1574121E05C381AC1D4FD0DAF748B39FC94E8D726F4A430782899E958567A65E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 cc19df76f9f1db600f00828a3487a85b5d03d0608fb49959b6705fa40dd6764e
MD5 c0c72a912cf765835354581b6bb104ba
SHA1 61bcd561c30b77f6058de64f7fe0796ca1634296
SHA512 8441c2d8e752d6471e049aa1377346dde3baba0bfdd5081b09e414e06e145622069db117af2048409e17a14de1a2d0ca036abf08469640ccb1a0f568bee50a1c
TLSH
T1204121E04C381AC1D4BD0DAF749B38FC84E8D726F5A434386899EA58567E25E764483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0d852e179d452dbbdf34a431e20905aa18f912ad3fe2964ebb15c02c6df9f4d7
MD5 66ac37fc8fed13c79aff0afaae3cf89e
SHA1 8ea1e2464a35ea777e7486fd5bd82689bbd783aa
SHA512 1558c19dab1fd8c839b30eb248e1e3014dc62c2df4a57bc6b2e8a41954c13cfe45242c7987bee7fa2a5615243bd86596ea721f2750917c22ff1533c416223f4e
TLSH
T1194131E05C391AC1D4BE0D6F745729FC94E8D726F49434382899E9A8567A65D314083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/940-564-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1548-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1592-559-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1592-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-593-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-613-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-634-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4392-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-221-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5272-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6128-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6272-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6276-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6280-175-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6488-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6628-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download