409f107359d49f6dea8d9428a37b7f9682f89bd2d1604631ac02644bfd55a28e

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-nemytseq8v
SHA256 409f107359d49f6dea8d9428a37b7f9682f89bd2d1604631ac02644bfd55a28e
MD5 a9423b0c3163e2f19f94d2fd15358cf6
SHA1 26e1e0a495cf9b841562576b5b05eb12d587ed92
SHA512 080984ae4e542d34bb77b5f0b5cf6c83607c98e766136e856a93728778ac7d81707a596ae4ba9721e0c5c40d0a602fd348d979edad32d3f0c62b36a5a36f7719
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:8vMsLaOa3lLNngoqRttA7X
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2932	CP.exe
2024	mjezwuojhb.exe
2680	CP.exe
4892	CP.exe
4364	i_mjezwuojhb.exe
268	wrojhbztro.sys
4148	CP.exe
5116	jhbytrljge.exe
1436	CP.exe
1616	CP.exe
4568	i_jhbytrljge.exe
4000	ebwtrljdbv.sys
5076	CP.exe
5216	bytrojeywt.exe
4784	CP.exe
4284	CP.exe
3804	i_bytrojeywt.exe
1688	aysqoidbvt.sys
5404	CP.exe
3512	ayvqoigayw.exe
3344	CP.exe
4496	CP.exe
860	i_ayvqoigayw.exe
4448	ysqkigaysq.sys
2584	CP.exe
4800	nlfdxvtnig.exe
5032	CP.exe
4568	CP.exe
4120	i_nlfdxvtnig.exe
2648	spnkfdxvtn.sys
2244	CP.exe
5556	nhfaxvpkic.exe
4344	CP.exe
2444	CP.exe
2624	i_nhfaxvpkic.exe
2432	axspkifzxs.sys
4608	CP.exe
4164	ausqkhfzxv.exe
1632	CP.exe
3148	CP.exe
2088	i_ausqkhfzxv.exe
4628	xrpjhczusm.sys
3984	CP.exe
2540	xrpkhcausm.exe
3832	CP.exe
1400	CP.exe
1204	i_xrpkhcausm.exe
5740	hurpjhczur.sys
2288	CP.exe
3380	wuojhbzurm.exe
5664	CP.exe
3592	CP.exe
2248	i_wuojhbzurm.exe
3708	xrojhbztrp.sys
5140	CP.exe
5136	jhbztrmjeb.exe
4708	CP.exe
2404	CP.exe
304	i_jhbztrmjeb.exe
4348	omjebwtrlj.sys
1528	CP.exe
3372	ljhbztrlje.exe
2532	CP.exe
5100	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1962283015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1962283015\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1317293485\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_903755956\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_903755956\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5544_599239871\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1317293485\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_903755956\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5544_1406306676\_locales\fil\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwtoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwtoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjezwuojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuojhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzxrpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbytrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvtnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbytrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvtnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausqkhfzxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuojhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjezwuojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrojeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrojeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausqkhfzxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2628	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2284	ipconfig.exe
5948	ipconfig.exe
4980	ipconfig.exe
2308	ipconfig.exe
3284	ipconfig.exe
5632	ipconfig.exe
2432	ipconfig.exe
5324	ipconfig.exe
3024	ipconfig.exe
5464	ipconfig.exe
3016	ipconfig.exe
2328	ipconfig.exe
2844	ipconfig.exe
2452	ipconfig.exe
2248	ipconfig.exe
236	ipconfig.exe
4480	ipconfig.exe
5756	ipconfig.exe
3272	ipconfig.exe
728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299703320793490"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{4E1A0FBA-A016-4D4E-A9D9-CCC3DE51EAEF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe
5544	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4364	i_mjezwuojhb.exe
Token: SeDebugPrivilege	4568	i_jhbytrljge.exe
Token: SeDebugPrivilege	3804	i_bytrojeywt.exe
Token: SeDebugPrivilege	860	i_ayvqoigayw.exe
Token: SeDebugPrivilege	4120	i_nlfdxvtnig.exe
Token: SeDebugPrivilege	2624	i_nhfaxvpkic.exe
Token: SeDebugPrivilege	2088	i_ausqkhfzxv.exe
Token: SeDebugPrivilege	1204	i_xrpkhcausm.exe
Token: SeDebugPrivilege	2248	i_wuojhbzurm.exe
Token: SeDebugPrivilege	304	i_jhbztrmjeb.exe
Token: SeDebugPrivilege	5740	i_ljhbztrlje.exe
Token: SeDebugPrivilege	5792	i_tqljdbvtol.exe
Token: SeDebugPrivilege	368	i_qoigaysqki.exe
Token: SeDebugPrivilege	2452	i_vtqkifdxvq.exe
Token: SeDebugPrivilege	1532	i_xvpnhfaxvs.exe
Token: SeDebugPrivilege	4276	i_ecxupmhfca.exe
Token: SeDebugPrivilege	1916	i_cwuomkhfzx.exe
Token: SeDebugPrivilege	4380	i_jhbzxrpmhe.exe
Token: SeDebugPrivilege	892	i_mjebwtoljh.exe
Token: SeDebugPrivilege	4664	i_jdbytrljgb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3588	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	88
PID 3588 wrote to memory of 5544	3588	iexplore.exe	89
PID 5544 wrote to memory of 2484	5544	msedge.exe	91
PID 5544 wrote to memory of 2628	5544	msedge.exe	92
PID 5544 wrote to memory of 4360	5544	msedge.exe	93
PID 5544 wrote to memory of 4360	5544	msedge.exe	93
PID 5544 wrote to memory of 4360	5544	msedge.exe	93
PID 5544 wrote to memory of 4420	5544	msedge.exe	94
PID 5544 wrote to memory of 4420	5544	msedge.exe	94
PID 5544 wrote to memory of 3404	5544	msedge.exe	95
PID 5544 wrote to memory of 3404	5544	msedge.exe	95
PID 5544 wrote to memory of 3404	5544	msedge.exe	95
PID 5544 wrote to memory of 2076	5544	msedge.exe	96
PID 5544 wrote to memory of 2076	5544	msedge.exe	96
PID 5544 wrote to memory of 2076	5544	msedge.exe	96
PID 5544 wrote to memory of 2784	5544	msedge.exe	97
PID 5544 wrote to memory of 1452	5544	msedge.exe	98
PID 5544 wrote to memory of 2784	5544	msedge.exe	97
PID 5544 wrote to memory of 2784	5544	msedge.exe	97
PID 5544 wrote to memory of 1452	5544	msedge.exe	98
PID 5544 wrote to memory of 1452	5544	msedge.exe	98
PID 5544 wrote to memory of 3984	5544	msedge.exe	100
PID 5544 wrote to memory of 3984	5544	msedge.exe	100
PID 5544 wrote to memory of 1044	5544	msedge.exe	102
PID 5544 wrote to memory of 4520	5544	msedge.exe	103
PID 5544 wrote to memory of 1044	5544	msedge.exe	102
PID 5544 wrote to memory of 4520	5544	msedge.exe	103
PID 4292 wrote to memory of 2932	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	104
PID 2024 wrote to memory of 2680	2024	mjezwuojhb.exe	107
PID 5544 wrote to memory of 2756	5544	msedge.exe	111
PID 5544 wrote to memory of 2844	5544	msedge.exe	112
PID 5544 wrote to memory of 2844	5544	msedge.exe	112
PID 5544 wrote to memory of 3940	5544	msedge.exe	113
PID 5544 wrote to memory of 3940	5544	msedge.exe	113
PID 5544 wrote to memory of 4860	5544	msedge.exe	116
PID 5544 wrote to memory of 4860	5544	msedge.exe	116
PID 5544 wrote to memory of 4388	5544	msedge.exe	117
PID 5544 wrote to memory of 4388	5544	msedge.exe	117
PID 4292 wrote to memory of 4892	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	118
PID 4292 wrote to memory of 4148	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	122
PID 5116 wrote to memory of 1436	5116	jhbytrljge.exe	124
PID 4292 wrote to memory of 1616	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	127
PID 4292 wrote to memory of 5076	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	131
PID 5216 wrote to memory of 4784	5216	bytrojeywt.exe	133
PID 4292 wrote to memory of 4284	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	136
PID 4292 wrote to memory of 5404	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	140
PID 3512 wrote to memory of 3344	3512	ayvqoigayw.exe	142
PID 4292 wrote to memory of 4496	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	145
PID 5544 wrote to memory of 248	5544	msedge.exe	148
PID 5544 wrote to memory of 244	5544	msedge.exe	149
PID 5544 wrote to memory of 1668	5544	msedge.exe	150
PID 4292 wrote to memory of 2584	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	153
PID 4800 wrote to memory of 5032	4800	nlfdxvtnig.exe	155
PID 4292 wrote to memory of 4568	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	158
PID 4292 wrote to memory of 2244	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	162
PID 5556 wrote to memory of 4344	5556	nhfaxvpkic.exe	164
PID 4292 wrote to memory of 2444	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	167
PID 4292 wrote to memory of 4608	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	171
PID 4164 wrote to memory of 1632	4164	ausqkhfzxv.exe	173
PID 4292 wrote to memory of 3148	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	176
PID 4292 wrote to memory of 3984	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	180
PID 2540 wrote to memory of 3832	2540	xrpkhcausm.exe	182
PID 4292 wrote to memory of 1400	4292	2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe	185
PID 5544 wrote to memory of 4600	5544	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a9423b0c3163e2f19f94d2fd15358cf6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffd8cc1c188,0x7ffd8cc1c194,0x7ffd8cc1c1a0
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16258860848149439377,18269774513507297026,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:11
      4⤵
      System Time Discovery
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,7480952983114686174,5899543738455505483,262144 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:2
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,16154506539962563557,14478274267631288362,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,15928661517314257943,9663546011810912680,2097152 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,13710044914784713890,10977652127050277774,2097152 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,18175413573063240118,6475671763917881412,2097152 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:9
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,3497994543372049846,12930591351054757042,2097152 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:1
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12716823546772075258,6126610186907848821,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8358623440668771829,3429105014142988287,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6444560804758716867,13122911283398691052,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8885454844082772652,10613943531577551874,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8885454844082772652,10613943531577551874,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17589591462401077295,16596316644154921041,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,7062585639691961165,3458634141792300390,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15726694322261416893,14569085106314113035,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,4651440779397762926,14405026437403347319,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,2933583324732690142,11293750698487488876,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,14956789336602430008,11535505262810534589,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,1795766699845553577,17508725796600370747,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,13115489689628473474,10484795046948536022,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,2166182414788082575,11979691918805284203,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,9461412802227698070,4545511302942566092,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2760,i,12441941162094831767,15447366098747953680,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4556,i,5470879937854023867,9377763392919239450,262144 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,7483828800928063719,2832371198481810767,524288 --field-trial-handle=2588,i,7159969827842764720,7216683900993657464,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:14
      4⤵
      PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjezwuojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2932
- - C:\Temp\mjezwuojhb.exe
    C:\Temp\mjezwuojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjezwuojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\i_mjezwuojhb.exe
    C:\Temp\i_mjezwuojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbytrljge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4148
- - C:\Temp\jhbytrljge.exe
    C:\Temp\jhbytrljge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbytrljge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\i_jhbytrljge.exe
    C:\Temp\i_jhbytrljge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrojeywt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\bytrojeywt.exe
    C:\Temp\bytrojeywt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrojeywt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4284
- - C:\Temp\i_bytrojeywt.exe
    C:\Temp\i_bytrojeywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqoigayw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5404
- - C:\Temp\ayvqoigayw.exe
    C:\Temp\ayvqoigayw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqoigayw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\i_ayvqoigayw.exe
    C:\Temp\i_ayvqoigayw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvtnig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2584
- - C:\Temp\nlfdxvtnig.exe
    C:\Temp\nlfdxvtnig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvtnig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\i_nlfdxvtnig.exe
    C:\Temp\i_nlfdxvtnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxvpkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Temp\nhfaxvpkic.exe
    C:\Temp\nhfaxvpkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxvpkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2444
- - C:\Temp\i_nhfaxvpkic.exe
    C:\Temp\i_nhfaxvpkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausqkhfzxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\ausqkhfzxv.exe
    C:\Temp\ausqkhfzxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausqkhfzxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Temp\i_ausqkhfzxv.exe
    C:\Temp\i_ausqkhfzxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3984
- - C:\Temp\xrpkhcausm.exe
    C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\i_xrpkhcausm.exe
    C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuojhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2288
- - C:\Temp\wuojhbzurm.exe
    C:\Temp\wuojhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuojhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\i_wuojhbzurm.exe
    C:\Temp\i_wuojhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\jhbztrmjeb.exe
    C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\i_jhbztrmjeb.exe
    C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1528
- - C:\Temp\ljhbztrlje.exe
    C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5100
- - C:\Temp\i_ljhbztrlje.exe
    C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtol.exe ups_run
  2⤵
  PID:4180
- - C:\Temp\tqljdbvtol.exe
    C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtol.exe ups_ins
  2⤵
  PID:4564
- - C:\Temp\i_tqljdbvtol.exe
    C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqki.exe ups_run
  2⤵
  PID:2072
- - C:\Temp\qoigaysqki.exe
    C:\Temp\qoigaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqki.exe ups_ins
  2⤵
  PID:236
- - C:\Temp\i_qoigaysqki.exe
    C:\Temp\i_qoigaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqkifdxvq.exe ups_run
  2⤵
  PID:5872
- - C:\Temp\vtqkifdxvq.exe
    C:\Temp\vtqkifdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqkifdxvq.exe ups_ins
  2⤵
  PID:5520
- - C:\Temp\i_vtqkifdxvq.exe
    C:\Temp\i_vtqkifdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxvs.exe ups_run
  2⤵
  PID:2852
- - C:\Temp\xvpnhfaxvs.exe
    C:\Temp\xvpnhfaxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxvs.exe ups_ins
  2⤵
  PID:4856
- - C:\Temp\i_xvpnhfaxvs.exe
    C:\Temp\i_xvpnhfaxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupmhfca.exe ups_run
  2⤵
  PID:4752
- - C:\Temp\ecxupmhfca.exe
    C:\Temp\ecxupmhfca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupmhfca.exe ups_ins
  2⤵
  PID:2136
- - C:\Temp\i_ecxupmhfca.exe
    C:\Temp\i_ecxupmhfca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomkhfzx.exe ups_run
  2⤵
  PID:372
- - C:\Temp\cwuomkhfzx.exe
    C:\Temp\cwuomkhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomkhfzx.exe ups_ins
  2⤵
  PID:3972
- - C:\Temp\i_cwuomkhfzx.exe
    C:\Temp\i_cwuomkhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzxrpmhe.exe ups_run
  2⤵
  PID:1488
- - C:\Temp\jhbzxrpmhe.exe
    C:\Temp\jhbzxrpmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzxrpmhe.exe ups_ins
  2⤵
  PID:3464
- - C:\Temp\i_jhbzxrpmhe.exe
    C:\Temp\i_jhbzxrpmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwtoljh.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\mjebwtoljh.exe
    C:\Temp\mjebwtoljh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwtoljh.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_mjebwtoljh.exe
    C:\Temp\i_mjebwtoljh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbytrljgb.exe ups_run
  2⤵
  PID:5256
- - C:\Temp\jdbytrljgb.exe
    C:\Temp\jdbytrljgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbytrljgb.exe ups_ins
  2⤵
  PID:5776
- - C:\Temp\i_jdbytrljgb.exe
    C:\Temp\i_jdbytrljgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

C:\Temp\wrojhbztro.sys
C:\Temp\wrojhbztro.sys
1⤵
- Executes dropped EXE
PID:268

C:\Temp\ebwtrljdbv.sys
C:\Temp\ebwtrljdbv.sys
1⤵
- Executes dropped EXE
PID:4000

C:\Temp\aysqoidbvt.sys
C:\Temp\aysqoidbvt.sys
1⤵
- Executes dropped EXE
PID:1688

C:\Temp\ysqkigaysq.sys
C:\Temp\ysqkigaysq.sys
1⤵
- Executes dropped EXE
PID:4448

C:\Temp\spnkfdxvtn.sys
C:\Temp\spnkfdxvtn.sys
1⤵
- Executes dropped EXE
PID:2648

C:\Temp\axspkifzxs.sys
C:\Temp\axspkifzxs.sys
1⤵
- Executes dropped EXE
PID:2432

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\hurpjhczur.sys
C:\Temp\hurpjhczur.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\xrojhbztrp.sys
C:\Temp\xrojhbztrp.sys
1⤵
- Executes dropped EXE
PID:3708

C:\Temp\omjebwtrlj.sys
C:\Temp\omjebwtrlj.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Temp\qoigdyvtrl.sys
C:\Temp\qoigdyvtrl.sys
1⤵
PID:1520

C:\Temp\aytqoigbyk.sys
C:\Temp\aytqoigbyk.sys
1⤵
PID:3060

C:\Temp\ysqligaysq.sys
C:\Temp\ysqligaysq.sys
1⤵
PID:1760

C:\Temp\xvpnkifays.sys
C:\Temp\xvpnkifays.sys
1⤵
PID:2360

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
PID:4516

C:\Temp\mkfcxupmke.sys
C:\Temp\mkfcxupmke.sys
1⤵
PID:6048

C:\Temp\mkecwuomhf.sys
C:\Temp\mkecwuomhf.sys
1⤵
PID:2428

C:\Temp\ojhecwrojg.sys
C:\Temp\ojhecwrojg.sys
1⤵
PID:3428

C:\Temp\gebvtromge.sys
C:\Temp\gebvtromge.sys
1⤵
PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqoidbvt.sys

Path C:\Temp\aysqoidbvt.sys
Size 141KB
SHA256 580f0b2193ac383f859f8c5b26a39babf5349153ed470a3b4f2daee85acced62
MD5 54d7d26ed8a9ad551e5723c4774e0be4
SHA1 37ff5e3ce25b2e295a83c1726b212a82606aff79
SHA512 9fc2e5a418aaa462d922517f5fa4e93f3014a0830eef226f28b68b30d45ca6933ad54e5cb3fc8ef84916379f48c6f6aeb39ae1c5cc2cee3fd99399a880c12c2f
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T197E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqoigayw.exe

Path C:\Temp\ayvqoigayw.exe
Size 243KB
SHA256 39e880a303be35ce60c91fc465ef31eda3b2c90672071953a06f5c955d64b7a2
MD5 d99167a51946f29d6d709c9f81706163
SHA1 eafaa80681379b2e2f44964ca98d8db9cfcdc3a1
SHA512 59044930a8150e5d52ddc546e9373a3908d383f49c1192214c699b766366b6f18726bca060cabc40c989f31e25ffef54e28a255642de2072b9f94198959802e5
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:evMsLaOa3lLNngoqRttA71
TLSH
T1EF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrojeywt.exe

Path C:\Temp\bytrojeywt.exe
Size 243KB
SHA256 8ae6ee03c2ba77c6d0c4938464a1b3e35881a7f8dd0b21dc000c621fdaf2778a
MD5 c7e0927daa6c5aeb931b33aba40bfce9
SHA1 47073d335cff17a8781dea264383284b87765bf7
SHA512 93d11326a65bd8f1d6c00a30fd9655c90b9f15dff2bce4730073833a4690db281afcff4e6aa8a02e31eb9b474f282d0cf442d86f99ee019a019389f4b18fea91
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:8vMsLaOa3lLNngoqRttA7r
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtrljdbv.sys

Path C:\Temp\ebwtrljdbv.sys
Size 141KB
SHA256 6b704f4305f31d5b1f41a38293d9c8018083a03571e01e7ea03f1f221face3d6
MD5 6081a4b88f3abc77b0d538b659dd5dad
SHA1 58100c5ad37bffbfa551dceef2eb13669cce8a57
SHA512 f3d2749e2277c42065be09745a6c2310418d6cf44fd455718c94e0ecb6d7a53cb5d40b12aa3ffc3dc9b28c9f5213ec8936f787828574cc247bd502a25e2960e5
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvqoigayw.exe

Path C:\Temp\i_ayvqoigayw.exe
Size 243KB
SHA256 82135a418c97590b6b0d201a206303d12049de0a0b5fbf32e5b442d771ed7ee9
MD5 276ce8ea9b6689a257473c08548a5d72
SHA1 54852dadb18967aa9ae2b5603a5ba76f5c29e8d4
SHA512 f8376a8a349c41e87eabd9da2d014e6d22f21a82edca745e77645812c0b05c603013bcd3c62055bcc7a535f44b4c734208a30145194e55e816cc1f067d4f5158
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:/vMsLaOa3lLNngoqRttA7q
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytrojeywt.exe

Path C:\Temp\i_bytrojeywt.exe
Size 243KB
SHA256 96ab63abe31d092b531b062f59d79b8a2dcd7328a2ce4eb7487638334e736fc0
MD5 3ce585ea7e83ab0a9940cd02d25b9abe
SHA1 0a6518c2dbb090ae97860a5b382c1a93c22de600
SHA512 c17dc14644350dae15fd36d3dcded713baef9ce26f1a28bfc92c75f5e441689f2d069552bdf0fbfe8a3be3e0ec3a41f622c2f6e6dea92cb8899dc00c6a51d9f5
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:fvMsLaOa3lLNngoqRttA7G
TLSH
T1A2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbytrljge.exe

Path C:\Temp\i_jhbytrljge.exe
Size 243KB
SHA256 58291c069989a040a9c9ed11b6354d10eba1d33a27343945dad549ef9b28c302
MD5 81e42ec68a36cf10c639a8ac1ceff159
SHA1 3295d0cd6a31647454cddda4a1197f20214b1a03
SHA512 3283d4d19f9590c2f12d34e74c519cb63912fbf6d36ab1a288972fbee6911f06a911122fa3e9f69d633fb77e52f6aa4b0f351587d99f5008cc107a3940e0140e
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:2vMsLaOa3lLNngoqRttA7d
TLSH
T1F0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjezwuojhb.exe

Path C:\Temp\i_mjezwuojhb.exe
Size 243KB
SHA256 18db1803543314be2ba084eb4012bdf98ac4c7c61fa5930f04be338da148850c
MD5 dbe38c385fbf363f4df10c94f52e95ce
SHA1 640395404d7667d25fc7c25f9b983cde5f6aa67e
SHA512 b81d230aec1ccfd187dd99fd9d4f42d57a42d7d2567fff610e2a6fb16a7d168a7e0a43bf744bf72272702bd8dcf0cac129e46bad769f769098432b9e50fa3e9f
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:7vMsLaOa3lLNngoqRttA7K
TLSH
T140345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvtnig.exe

Path C:\Temp\i_nlfdxvtnig.exe
Size 243KB
SHA256 c6418d1a663411dcb3d677443b3cb3d8b53306d517bd3e3ae57bf245185ab6dc
MD5 fb9d8c68431a5e9d6eee3deaf9332864
SHA1 046a06fee60d22b57f58bdb1e3b6ca3e0b2c4792
SHA512 7025ee2c9eb9fae910050117a9ac35a342ba4f763c3f98329638cc966ed9c8aa76bffb2a0bbfad79972392c526c6bb2d6d86f5e2a5d9ecf1de80aced41eee755
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:evMsLaOa3lLNngoqRttA7N
TLSH
T1FA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbytrljge.exe

Path C:\Temp\jhbytrljge.exe
Size 243KB
SHA256 630540f897145d4852fd0560e31fdb18acef00a314ac87de1c3c33d8ba1c7f0b
MD5 3fa4beeb8f9cc62a40673916d4d63ebf
SHA1 161512e0a959cd3cc36c024674e3d3e3a3df9066
SHA512 5b82f92ce8441fe022f14975187fad68cdda36918bf93367705f48b76e1e8814067a443c35a838e2a972c524bbe5214488f7d7d7820ddd7ebc36b496a06d3192
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:GvMsLaOa3lLNngoqRttA7p
TLSH
T1A1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjezwuojhb.exe

Path C:\Temp\mjezwuojhb.exe
Size 243KB
SHA256 0f4e7087dd7b0e8a69fec6eb6a38d4a4ed53ad7e90a4b640a6bc996954884c2b
MD5 4fecc547fd561dbacc8b7dc5105e8982
SHA1 f4bd6bca0cb6711e6ea300712614cb304a340adc
SHA512 8f3eb95a2ed9c9218636431bd319fbcc8d1d5b53984cfc3c8c1d331b097326f28ccb01ecb22e525cac85a372a29cd10c94cd4cd84f295a26ca30dd87c0e76dc4
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:mvMsLaOa3lLNngoqRttA7Z
TLSH
T117345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxvpkic.exe

Path C:\Temp\nhfaxvpkic.exe
Size 243KB
SHA256 60482049109be4d1d0dd246dd0b43aa185ceeca3616d249d7f56ffc7f96f8cd2
MD5 b19cf002328656d583802746e4221163
SHA1 47d4c80e2f21bb6dacdbf132313587ae4e263087
SHA512 bd7aa42b9f13fe0f5e8b49102a4bed855cca678406ba282743aba2478a053a20ff7fc2607ba09ccb2bb96fe66ae790b250e645027e29224c0a3aa03d4c114da9
SSDEEP 3072:nyCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7JK:tvMsLaOa3lLNngoqRttA7M
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvtnig.exe

Path C:\Temp\nlfdxvtnig.exe
Size 243KB
SHA256 20c175a14db5d30a88ecd02f6817c0b8f126b7ed06b27ae52e874983e942716f
MD5 aeb842848c6d22be303580631471a126
SHA1 1c668e00c8b953f6ba37e4850ca2b53353e09170
SHA512 9fb360319f9a803e217df598656047928520e27be04110a43a8f89ec6b8db81e670622d672e0415ad8e913223a67c9f508070ece19b1991ee6fb26539c89e308
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:XvMsLaOa3lLNngoqRttA7m
TLSH
T1AF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnkfdxvtn.sys

Path C:\Temp\spnkfdxvtn.sys
Size 141KB
SHA256 024e70d20868131285b007623a2c3ec90932d40342bdd2821c213c22ea76a42f
MD5 61cdce0cc867f204950cc6b996f62de8
SHA1 00f164ecced59d6709cafb82e94b39ba947d4630
SHA512 ea3f644defff492e368c52576345119db6129284015f436ad11c4bbeac274c393f65e586de81c7fbe950eb92deaff8d7501f5c49dd2ee997f4839e09d47fe062
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E643D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztro.sys

Path C:\Temp\wrojhbztro.sys
Size 141KB
SHA256 2362b071716c678421eb55ca364bf632dff4d36d5fc88150103be114279d8815
MD5 b8211f3a5e57a3ceb7793c4efcfb8cd3
SHA1 ce8722e3626ab0b2503b73d7de82a32d03274e55
SHA512 7ab94b4dc4ba87b89ae864247389bf7bb77eedaf606d0cef93c8ba8478faead12551ec35c6747414286f20d052fbd98798077a7dc88b239f21dc4a91aea25509
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkigaysq.sys

Path C:\Temp\ysqkigaysq.sys
Size 141KB
SHA256 193b9fa1ce00f80c7d8d115d5254f7af4306d48c588e5b4668c73521874d4d40
MD5 4654bc46dc5fbe370e7d2f53af43ca58
SHA1 0ba30a05c310605c30ea0841d2cdf7ccd51ffc69
SHA512 b1856e64fe62e7e6a5003c8bab0f3168b252e82461858ee4b83667548cd73e6e55e9f0cdeb3868e9a255087027198027bd1d07b594cec3d5216d3f14a5d52b60
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 20c4099e9c6b5eda051038cbfd09361337fcd29a9e3e6bdc34625da172ee3c73
MD5 83b8fa17a98d21298656762a2885b826
SHA1 688443c0311792b0e58e446950a16bd4c61a10b7
SHA512 fa7fce026162340e11f3cc62f5ca5d1c7dbbb47ab20ef7441ded4391a1a27415bf01584af1b5f12b0d857f4515d1aa7a6150a81134e85583bdfd71487824fd8b
TLSH
T1845192536BAF8AE2E73D49F192F240CABE7D94160E8F2A2D11442173DBC739BA100230
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598488.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598488.TMP
Size 2KB
SHA256 357f6b743b98ed16659acbf8078e51441760a16cdb68357595f54b2bd23e5421
MD5 18d79769d724c6a85c870162c0c165d4
SHA1 d2a8ed5928669c857b943211869acc7079eb1a55
SHA512 f08cc5be7df36130fa321bf39d173021b7c2b0001e6f505159fcf7f970c61864274d953cc2cb2be54c448c7e5b039510f2e7c19f03886df9db098b38091cdb55
TLSH
T19B51A5537BAF8AD2E73D49F192F240CABE7D94160E8F2A1D11442177DBC735BA100230
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e5324dbe01b6591347daf25b1375bb2a25e97d3d3c2f5df05659ecc969b46bfe
MD5 b855c6334216612cdb6cbaef2df8392f
SHA1 eefc5597ae2317bfeef67c98bc3c029231b67d05
SHA512 57391442ee7ab09b03f94740da4c5a9aadf3e2d2279e5bf477c50dcc732cf5c0858ba2608fae9478de35e55db7963b958e2fcabf87d4a32ad527639786bf7ae9
TLSH
T17B51AEF3C3E8856D890156F0A7146E2FCE1D0914832C3D5AC9E4EE1BA3E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7e23b4f0337a1ba153ab09c467ddc0779ecf46d474d025ec1e779e425fb0ab6c
MD5 adb5c25ef5ee7d8491c311ca997414e6
SHA1 dbd88f361085a243700aaf7153cfd8c115b13200
SHA512 17d5cacb713560819c29aa53ccff2298d750e8123a37ed5f74838539cd9201026e055a35e66419468732e86bd78e9f4dee0ee74e92454ae00e0a699b9ab635aa
SSDEEP 192:sxR7RxC//f4sEz9eZg3MzoA8p9v/g6+WNCL5/YD9Z6Sje+GLhIgVNt+J:sxR7u//f4sEz9YgNN/5M/hSjefQ
TLSH
T10942B6566A28993B4CCBE21DBA55BF53D6F95032A1901E48E7FC8B0C00EA6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a5b42e77134eff99f3c15dc4ee572f0f45b199beb0587f836dc0470745bfb7e9
MD5 dbbced81be74578355090aa5d3e9456f
SHA1 56cb021c834c7be3f2d79a9477707d3c45c32997
SHA512 5d9ea132bbbb2f68bdd9bcd8067632cb0f4925dbc96f302af45dfcaf38b09f0f43cbd6b0eda7cc2bba5f85122e6dc91b0b7eca6ebcfa6d7d48de8fd244527220
SSDEEP 192:sxRERxC//f4sez9eZg3MzoA8p9v/g6+WNCL5/YD9Z6Sje+GLhIgDziNt+J:sxREu//f4sez9YgNN/5M/hSjef3j
TLSH
T15C42B756AA28993B4CCBD21DBA55BF53D6F95032A1911E48A7FC9B0C00EA6DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 34cbf9402cd6219439f1a5e40334ec299fefbb30a4f1cb471fe73fb061e5d3d8
MD5 f870588c7ff2347d8da59a4f87d5127b
SHA1 2ffb5a787079d3e297a80a7d6124066db875b8a6
SHA512 f623505f73ef674fb771b2b7f0d0cc3d08d2f0eb4899a0de2cf61255da8a0b329aca1a4a4e4c98351798922b0c41f62eecce053911343b9d1151208a2a4ca3de
SSDEEP 192:sxRERxC//f4sezreZg3MzoA8p9v/g6+WNCL5/YD9X6Sje+GLhIgDz4Nt+J:sxREu//f4sezrYgNN/5M/lSjef3l
TLSH
T1CE42C8566A289D3B4CC7E61DBB55BF53D6F95032A1911E48A7FC8B0C00EB6DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 40eccbe23eebc11e27071ff966406b9dbe4e5d96c9f226a7aa4e6b1e8a0b9edf
MD5 d63868bf15aa7a671a385d3d106149f6
SHA1 2bb024a19c3ff9a06c2c5fafcaa299c401c91f11
SHA512 f3368086b9695caac92b3719ece0aa001ca88a1e522c30df80dc9f2d5107c57c89a2973c0137a34db4adc6856bbe286610eff8555ed0b390a4187d38a1a19101
SSDEEP 768:azfW297pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCmYc16PropJqMj:azfW2rEf30Wg/XfHfu1jadmYy6cpJl
TLSH
T1AAD2EA7B640CCA7F4F800ADDAD197EDF6DA802CB9698CD5047FE851C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1faf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1faf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7659ba8ee573e14bfff4e9462d90f7110122ab1c56890df3509e57446d129d7f
MD5 e8d330564ab199143ea9038621b713f9
SHA1 cfb916c8719f17ddcba0479f69783280107c2090
SHA512 eaa3f702be8347355691f701dcd2c492f4f3fd08ee44f413001ab4d194f979def2d9ee8a5e18295d94d3545218eb60b5fe1dd5495cb396e8f82d1a44e3a88490
SSDEEP 384:nRZcI838N1VEwSVK7WZlf8hyEG2dUGyfbFCy2rEoajo4cdR8eHhVODjYPNDUMahx:583WAi0anrEnjN3Gac1Fab9M4
TLSH
T1F9F2BF747864CEB388EFE356B5837B52AEE052A3C5D80E98D6D9E70D05439AC170B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1ea63a3af01804832e45573760dad4bada13fb7bbe39c33cdb141f013d66ffd8
MD5 5f97ec83c4dadcb53e3ebd0477264951
SHA1 7784ecf54527770ff5d967605f4e806822a7d1ab
SHA512 cac8c3fe1473cbc52ac7f5c937347cde59e4c77e7c4d050112099918bb18283ece2bfba5885f969152c480f3bd0759e1e952a0e18b40dd48e86b3c36842fe189
SSDEEP 768:Xrv+4UNbdL3qAi0aprEnjN3Gac1Fab9MR:Xbsbt3nkQnjMaFb+R
TLSH
T14213C0357968CE738CEBE355B0877A437EE416A7C5D40B98D6C9AB0D05874EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 573f63c7400b043aa3aabc4d95cef5e2280010bd64839b88dfcb1f46667b9967
MD5 b69c3c1278d72dd26ad0d06372342335
SHA1 406476a6bf0893f5e371b68cdec3826f28e9b711
SHA512 0cab5696779958d70f7c0c771500e0075c34539013a806a88ab1ec56e01c0196c23d0facfda5857df31823f33c411c03171c4b200185e6e3417f652eae5734ef
SSDEEP 384:nViFiZcIp38NP8TUNTUlIlVEwSVl74Hfc5yEG2dUGyfbFdy2rEoajo4cdR8eHhV2:cFQp3YwgovsaqrEnjN3Gac1Fab9M4
TLSH
T12E1328F598D78A76D8AE9743A37D6E429DFCC163B5984994B7C49E0CCC420BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 db9ffc78bb58912c1fffdbe8e66c0f3f25bf8b676f68e28d028f7ade29340ee0
MD5 b84194c1cf41388c106ccb3fb5405423
SHA1 bba9a59facd2bc099b4f2681a30b3a2fd02ef003
SHA512 1010e7f5225998239f1566e1b05ed9a67bd869b2c01a29ca51927dbfc80784fcdd9ef6f6991ed8b5929bf5011484d478b4cc6211c90e63508ae18313127af3ee
SSDEEP 768:rrv+4UNbdS3Qmi0aNrEnjN3Gac1ZveVH1SCz:rbsbg3H0QnjMaAEH1V
TLSH
T12E03CF3669A89E738CEBE38575837A037EF4525386940BE4C6DD6B0D029B5EC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3ea62d08ddd6e6c396c6d5de4dcddd0c9bfe4a3e2877d93030ce45da8e619dea
MD5 18f30153443ed9e3d9c06d7b6c3919c5
SHA1 fdb7db8a178a4b0f5fda47716a313739cd794824
SHA512 dbf726764dfc017f788e64f6258f03c93d59e50a3f697d85b233b083900ffe2ad02098dbcb75a189096d53fb8fb13ce01520c2e76bd5247dfe21666e9d8cbead
SSDEEP 384:nVZcI838N1MEwSVK7WZlf8hyEG2dUGyfbFCy2rEoajo4cdR8eHhVODjYPNDUMahx:t83BAi0anrEnjN3Gac1Fab9M4
TLSH
T143F2BF747864CEB388EBE356B5837B42AEE052A3C5D80E98D6C9E70D05439AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

09417e02-1987-4b9e-9bb9-a3116b4e1f3a.tmp

Path C:\Users\Admin\AppData\Local\Temp\09417e02-1987-4b9e-9bb9-a3116b4e1f3a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5544_324774258\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/268-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1520-608-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1760-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2360-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2648-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2648-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3060-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3428-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3428-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3708-567-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4000-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4000-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4348-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-671-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4516-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5584-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6048-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download