0c6e6d89320bbd1baa7e2115b2b5a772ca16072a6e953c4f9e6cfa8ee1d1c7f3

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-tyedpawdnb
SHA256 0c6e6d89320bbd1baa7e2115b2b5a772ca16072a6e953c4f9e6cfa8ee1d1c7f3
MD5 dd38fa39f772d892cb3ba336a809c44c
SHA1 1d8ead6c26cadbee90083866b2542284b00ac36c
SHA512 f492c92cb1d29fbfadf8e0a57bc0255bcd288276e4e4a48c036aafdbb4bee41b1f3e2776463a598e33177684e1bb29eb66da5ff4f5ed6b3cb74449e412526588
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:fvMsLaOa3lLNngoqRttA7a
TLSH
T14C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3372	CP.exe
2944	wtojgbztoj.exe
2544	CP.exe
4244	CP.exe
1972	i_wtojgbztoj.exe
1084	toljdbywqo.sys
2304	CP.exe
1592	igdyvtqlig.exe
4512	CP.exe
4276	CP.exe
5536	i_igdyvtqlig.exe
5228	lidbvtqoig.sys
1336	CP.exe
4680	fdbvtnlfdy.exe
4784	CP.exe
5552	CP.exe
2912	i_fdbvtnlfdy.exe
3900	avsqkidays.sys
2016	CP.exe
5880	yvqnlfdxvs.exe
2664	CP.exe
1660	CP.exe
1684	i_yvqnlfdxvs.exe
3784	vpnkicausq.sys
3524	CP.exe
1348	hfcxvsnkfd.exe
2436	CP.exe
4360	CP.exe
4464	i_hfcxvsnkfd.exe
4380	pnhfzxvpnk.sys
2424	CP.exe
5708	hfcaxspnkh.exe
3952	CP.exe
4948	CP.exe
480	i_hfcaxspnkh.exe
2736	spkhfcwupm.sys
3392	CP.exe
3436	pmhezxrpjh.exe
1972	CP.exe
4204	CP.exe
2040	i_pmhezxrpjh.exe
2556	rmjeczuomh.sys
864	CP.exe
1728	omhezxrpjh.exe
3924	CP.exe
3160	CP.exe
5056	i_omhezxrpjh.exe
1208	trljebzwqo.sys
1544	CP.exe
5316	rljebwtomg.exe
5332	CP.exe
3400	CP.exe
4120	i_rljebwtomg.exe
4732	ywuomgeywr.sys
908	CP.exe
2832	lgeywqojgb.exe
2052	CP.exe
4236	CP.exe
4600	i_lgeywqojgb.exe
2456	qljdbytqlj.sys
3784	CP.exe
4528	lgeywqoigb.exe
1684	CP.exe
3660	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_562862712\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_562862712\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3336_2078814535\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_634704633\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtojgbztoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgebolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcaxspnkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcaxspnkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtojgbztoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxvsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxvsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgebolj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2316	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3112	ipconfig.exe
5984	ipconfig.exe
1152	ipconfig.exe
4060	ipconfig.exe
2784	ipconfig.exe
3740	ipconfig.exe
636	ipconfig.exe
1512	ipconfig.exe
3076	ipconfig.exe
4372	ipconfig.exe
5104	ipconfig.exe
4932	ipconfig.exe
4692	ipconfig.exe
3016	ipconfig.exe
5268	ipconfig.exe
4296	ipconfig.exe
6016	ipconfig.exe
4372	ipconfig.exe
4420	ipconfig.exe
5984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299888684716707"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{0CA3D01A-855B-459B-80F0-AE8838C9F03F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5124	msedge.exe
5124	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	i_wtojgbztoj.exe
Token: SeDebugPrivilege	5536	i_igdyvtqlig.exe
Token: SeDebugPrivilege	2912	i_fdbvtnlfdy.exe
Token: SeDebugPrivilege	1684	i_yvqnlfdxvs.exe
Token: SeDebugPrivilege	4464	i_hfcxvsnkfd.exe
Token: SeDebugPrivilege	480	i_hfcaxspnkh.exe
Token: SeDebugPrivilege	2040	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	5056	i_omhezxrpjh.exe
Token: SeDebugPrivilege	4120	i_rljebwtomg.exe
Token: SeDebugPrivilege	4600	i_lgeywqojgb.exe
Token: SeDebugPrivilege	3932	i_lgeywqoigb.exe
Token: SeDebugPrivilege	4120	i_idavtnlidx.exe
Token: SeDebugPrivilege	3452	i_ysqkicavsn.exe
Token: SeDebugPrivilege	4296	i_xspnhfaxrp.exe
Token: SeDebugPrivilege	2056	i_fcxupnhfzx.exe
Token: SeDebugPrivilege	6016	i_bzwupmhfzx.exe
Token: SeDebugPrivilege	4600	i_jgezwrojge.exe
Token: SeDebugPrivilege	4764	i_trljgebolj.exe
Token: SeDebugPrivilege	5412	i_tqligbytrl.exe
Token: SeDebugPrivilege	4460	i_vtqljdbvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 3692	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	88
PID 3692 wrote to memory of 3336	3692	iexplore.exe	90
PID 3336 wrote to memory of 3396	3336	msedge.exe	91
PID 3336 wrote to memory of 4200	3336	msedge.exe	93
PID 3336 wrote to memory of 2316	3336	msedge.exe	92
PID 3336 wrote to memory of 4200	3336	msedge.exe	93
PID 3336 wrote to memory of 4200	3336	msedge.exe	93
PID 3336 wrote to memory of 5704	3336	msedge.exe	94
PID 3336 wrote to memory of 5704	3336	msedge.exe	94
PID 3336 wrote to memory of 4244	3336	msedge.exe	118
PID 3336 wrote to memory of 4244	3336	msedge.exe	118
PID 3336 wrote to memory of 4244	3336	msedge.exe	118
PID 3336 wrote to memory of 1936	3336	msedge.exe	97
PID 3336 wrote to memory of 1936	3336	msedge.exe	97
PID 3336 wrote to memory of 1936	3336	msedge.exe	97
PID 3336 wrote to memory of 4772	3336	msedge.exe	99
PID 3336 wrote to memory of 1104	3336	msedge.exe	98
PID 3336 wrote to memory of 4772	3336	msedge.exe	99
PID 3336 wrote to memory of 4772	3336	msedge.exe	99
PID 3336 wrote to memory of 1104	3336	msedge.exe	98
PID 3336 wrote to memory of 1104	3336	msedge.exe	98
PID 3336 wrote to memory of 1780	3336	msedge.exe	100
PID 3336 wrote to memory of 1780	3336	msedge.exe	100
PID 3336 wrote to memory of 1176	3336	msedge.exe	103
PID 3336 wrote to memory of 3000	3336	msedge.exe	102
PID 3336 wrote to memory of 1176	3336	msedge.exe	103
PID 3336 wrote to memory of 3000	3336	msedge.exe	102
PID 3664 wrote to memory of 3372	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	104
PID 2944 wrote to memory of 2544	2944	wtojgbztoj.exe	107
PID 3336 wrote to memory of 3944	3336	msedge.exe	111
PID 3336 wrote to memory of 4104	3336	msedge.exe	112
PID 3336 wrote to memory of 4104	3336	msedge.exe	112
PID 3336 wrote to memory of 4712	3336	msedge.exe	113
PID 3336 wrote to memory of 4712	3336	msedge.exe	113
PID 3336 wrote to memory of 3268	3336	msedge.exe	116
PID 3336 wrote to memory of 3268	3336	msedge.exe	116
PID 3336 wrote to memory of 4092	3336	msedge.exe	117
PID 3336 wrote to memory of 4092	3336	msedge.exe	117
PID 3664 wrote to memory of 4244	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	118
PID 3664 wrote to memory of 2304	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	122
PID 1592 wrote to memory of 4512	1592	igdyvtqlig.exe	124
PID 3664 wrote to memory of 4276	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	127
PID 3664 wrote to memory of 1336	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	131
PID 4680 wrote to memory of 4784	4680	fdbvtnlfdy.exe	133
PID 3664 wrote to memory of 5552	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	136
PID 3664 wrote to memory of 2016	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	140
PID 5880 wrote to memory of 2664	5880	yvqnlfdxvs.exe	142
PID 3664 wrote to memory of 1660	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	145
PID 3336 wrote to memory of 4932	3336	msedge.exe	148
PID 3336 wrote to memory of 2872	3336	msedge.exe	149
PID 3336 wrote to memory of 5788	3336	msedge.exe	150
PID 3664 wrote to memory of 3524	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	153
PID 1348 wrote to memory of 2436	1348	hfcxvsnkfd.exe	155
PID 3664 wrote to memory of 4360	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	158
PID 3664 wrote to memory of 2424	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	162
PID 5708 wrote to memory of 3952	5708	hfcaxspnkh.exe	164
PID 3664 wrote to memory of 4948	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	167
PID 3664 wrote to memory of 3392	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	171
PID 3436 wrote to memory of 1972	3436	pmhezxrpjh.exe	173
PID 3664 wrote to memory of 4204	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	176
PID 3664 wrote to memory of 864	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	180
PID 1728 wrote to memory of 3924	1728	omhezxrpjh.exe	182
PID 3664 wrote to memory of 3160	3664	2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe	185
PID 3336 wrote to memory of 4336	3336	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_dd38fa39f772d892cb3ba336a809c44c_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x390,0x7ff8b7a6c188,0x7ff8b7a6c194,0x7ff8b7a6c1a0
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,15909234569985966271,14822398459052717430,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
      4⤵
      System Time Discovery
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,15694700224997801650,9131077175383444313,262144 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,7000469390279449254,18003665120563249972,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,16138981645809182483,16873950219523210109,2097152 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,15381381926517676451,18134863805840428868,2097152 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,15898247093113555190,7163571231157289901,2097152 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,867725614817568533,15626637142615963496,2097152 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:9
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,999458268596270265,3624752566922712131,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,12056010109448445181,11588288922628727486,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,426243952390876816,3523243210163392933,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15577371169647361968,1927484027028812257,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,15577371169647361968,1927484027028812257,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,15561454848534201666,18280982608678670505,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,12856672579698125023,11830086634739602809,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,285786086556923612,12562378034673293674,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,15587396561936870132,3104635931498543110,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,2792614181734802526,10787593034532990089,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,5715042243260410760,11598693128470836405,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,14718487361311702197,9121500027588772538,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10667258645320682001,9760825315925030325,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,2845282500581849764,14892990871043755688,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3816,i,8656312022898190045,16040249513894854019,262144 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,5067852742933312017,12824503937828333500,524288 --field-trial-handle=2396,i,7736155298636764087,1999048527538267253,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:14
      4⤵
      PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtojgbztoj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3372
- - C:\Temp\wtojgbztoj.exe
    C:\Temp\wtojgbztoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtojgbztoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Temp\i_wtojgbztoj.exe
    C:\Temp\i_wtojgbztoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igdyvtqlig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\igdyvtqlig.exe
    C:\Temp\igdyvtqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igdyvtqlig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Temp\i_igdyvtqlig.exe
    C:\Temp\i_igdyvtqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbvtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1336
- - C:\Temp\fdbvtnlfdy.exe
    C:\Temp\fdbvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbvtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5552
- - C:\Temp\i_fdbvtnlfdy.exe
    C:\Temp\i_fdbvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlfdxvs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2016
- - C:\Temp\yvqnlfdxvs.exe
    C:\Temp\yvqnlfdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlfdxvs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\i_yvqnlfdxvs.exe
    C:\Temp\i_yvqnlfdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcxvsnkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Temp\hfcxvsnkfd.exe
    C:\Temp\hfcxvsnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcxvsnkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\i_hfcxvsnkfd.exe
    C:\Temp\i_hfcxvsnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcaxspnkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2424
- - C:\Temp\hfcaxspnkh.exe
    C:\Temp\hfcaxspnkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcaxspnkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_hfcaxspnkh.exe
    C:\Temp\i_hfcaxspnkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\pmhezxrpjh.exe
    C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4204
- - C:\Temp\i_pmhezxrpjh.exe
    C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:864
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3160
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\rljebwtomg.exe
    C:\Temp\rljebwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\i_rljebwtomg.exe
    C:\Temp\i_rljebwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:908
- - C:\Temp\lgeywqojgb.exe
    C:\Temp\lgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Temp\i_lgeywqojgb.exe
    C:\Temp\i_lgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlidx.exe ups_run
  2⤵
  PID:4892
- - C:\Temp\idavtnlidx.exe
    C:\Temp\idavtnlidx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlidx.exe ups_ins
  2⤵
  PID:3148
- - C:\Temp\i_idavtnlidx.exe
    C:\Temp\i_idavtnlidx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  PID:4524
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  PID:5404
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspnhfaxrp.exe ups_run
  2⤵
  PID:2872
- - C:\Temp\xspnhfaxrp.exe
    C:\Temp\xspnhfaxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspnhfaxrp.exe ups_ins
  2⤵
  PID:472
- - C:\Temp\i_xspnhfaxrp.exe
    C:\Temp\i_xspnhfaxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupnhfzx.exe ups_run
  2⤵
  PID:1676
- - C:\Temp\fcxupnhfzx.exe
    C:\Temp\fcxupnhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupnhfzx.exe ups_ins
  2⤵
  PID:3416
- - C:\Temp\i_fcxupnhfzx.exe
    C:\Temp\i_fcxupnhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwupmhfzx.exe ups_run
  2⤵
  PID:5008
- - C:\Temp\bzwupmhfzx.exe
    C:\Temp\bzwupmhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwupmhfzx.exe ups_ins
  2⤵
  PID:5616
- - C:\Temp\i_bzwupmhfzx.exe
    C:\Temp\i_bzwupmhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgezwrojge.exe ups_run
  2⤵
  PID:2972
- - C:\Temp\jgezwrojge.exe
    C:\Temp\jgezwrojge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgezwrojge.exe ups_ins
  2⤵
  PID:5908
- - C:\Temp\i_jgezwrojge.exe
    C:\Temp\i_jgezwrojge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljgebolj.exe ups_run
  2⤵
  PID:2932
- - C:\Temp\trljgebolj.exe
    C:\Temp\trljgebolj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljgebolj.exe ups_ins
  2⤵
  PID:1120
- - C:\Temp\i_trljgebolj.exe
    C:\Temp\i_trljgebolj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqligbytrl.exe ups_run
  2⤵
  PID:5800
- - C:\Temp\tqligbytrl.exe
    C:\Temp\tqligbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqligbytrl.exe ups_ins
  2⤵
  PID:5624
- - C:\Temp\i_tqligbytrl.exe
    C:\Temp\i_tqligbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqljdbvtn.exe ups_run
  2⤵
  PID:5972
- - C:\Temp\vtqljdbvtn.exe
    C:\Temp\vtqljdbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqljdbvtn.exe ups_ins
  2⤵
  PID:5060
- - C:\Temp\i_vtqljdbvtn.exe
    C:\Temp\i_vtqljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1028

C:\Temp\toljdbywqo.sys
C:\Temp\toljdbywqo.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\lidbvtqoig.sys
C:\Temp\lidbvtqoig.sys
1⤵
- Executes dropped EXE
PID:5228

C:\Temp\avsqkidays.sys
C:\Temp\avsqkidays.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Temp\vpnkicausq.sys
C:\Temp\vpnkicausq.sys
1⤵
- Executes dropped EXE
PID:3784

C:\Temp\pnhfzxvpnk.sys
C:\Temp\pnhfzxvpnk.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Temp\spkhfcwupm.sys
C:\Temp\spkhfcwupm.sys
1⤵
- Executes dropped EXE
PID:2736

C:\Temp\rmjeczuomh.sys
C:\Temp\rmjeczuomh.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\trljebzwqo.sys
C:\Temp\trljebzwqo.sys
1⤵
- Executes dropped EXE
PID:1208

C:\Temp\ywuomgeywr.sys
C:\Temp\ywuomgeywr.sys
1⤵
- Executes dropped EXE
PID:4732

C:\Temp\qljdbytqlj.sys
C:\Temp\qljdbytqlj.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\idavsqlidb.sys
C:\Temp\idavsqlidb.sys
1⤵
PID:3448

C:\Temp\davpnkicay.sys
C:\Temp\davpnkicay.sys
1⤵
PID:1360

C:\Temp\fcxvsnkfdx.sys
C:\Temp\fcxvsnkfdx.sys
1⤵
PID:5828

C:\Temp\causpkhcau.sys
C:\Temp\causpkhcau.sys
1⤵
PID:5268

C:\Temp\cwurmkhczu.sys
C:\Temp\cwurmkhczu.sys
1⤵
PID:3812

C:\Temp\tromzwromg.sys
C:\Temp\tromzwromg.sys
1⤵
PID:2820

C:\Temp\ztrmjebwuo.sys
C:\Temp\ztrmjebwuo.sys
1⤵
PID:4760

C:\Temp\wqoljdbytr.sys
C:\Temp\wqoljdbytr.sys
1⤵
PID:3200

C:\Temp\yvtnlgdysq.sys
C:\Temp\yvtnlgdysq.sys
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsqkidays.sys

Path C:\Temp\avsqkidays.sys
Size 141KB
SHA256 d77a7fe31a104746917165a35c366f6622cea98f31a5385e687dc2ccf4131466
MD5 a3e180aa6e68cc1c0505b0f1bd929e6b
SHA1 a509f9e54cbc9ff39bcdea61e43b1ccdbcd2eb9e
SHA512 ab79283f8138c65fbe725310fae6bcc484f8badd34b2df718a2cbfc03727a19d9c352e4822ffe7e09e4c73a6b170be4d9f56ade3fb93d49ce1850ded5471755f
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdbvtnlfdy.exe

Path C:\Temp\fdbvtnlfdy.exe
Size 243KB
SHA256 fad9e99d32a83b242c638cfaebfb5ea0a6d83c6bc82e93059ebd65de88e98bed
MD5 fa3c589f30e36f53b2f171bad824ca1c
SHA1 037e8b564941b95761687df5d39895937089d7d7
SHA512 4e54ad1533a3ea17b122d15978cf408b8facdcec2cd9340534ec0686c1dc86a3df2e8d01bce67180c53a1c35d96036e0d7caee776c3e5400ab76a5b24d0e100f
SSDEEP 3072:bCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:OvMsLaOa3lLNngoqRttA7Z
TLSH
T171345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcaxspnkh.exe

Path C:\Temp\hfcaxspnkh.exe
Size 243KB
SHA256 33aa3c312b3c0b681cd6200a7ff3532473b0c89fd6d1fe79a17f9091ba4707e2
MD5 4b7b5ac9f35df70692b7eb1b04fd0a35
SHA1 d1056d2a86b2c84212a09aa303d57e0908819395
SHA512 6031e23f96e94e4a81fd8b49657ac1cbf59de5148fc8fa22a06f4e657fb9b354f8ac4b157879f6e7d1318886d5f120ae4030ea8dffa42cf755ba2c8bb65064b3
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:wvMsLaOa3lLNngoqRttA7X
TLSH
T162345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxvsnkfd.exe

Path C:\Temp\hfcxvsnkfd.exe
Size 243KB
SHA256 5edcdd9ec8a0028b463db2fc1a3bffe3b9470a718b4ab48b6c6d1eb124f18621
MD5 9248bc556c2585e64e772d3d08fa664f
SHA1 8caab3b8d701ceb26215f7dda210e133246c5d1f
SHA512 66f9c5df0267b0ab24193fac609d619869e65e644f81af553c6887f683c7bf2a121ae23048b6a9cf7d7047258bf0eaf5f9c070334f74800fa2b267937139d397
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:fvMsLaOa3lLNngoqRttA7q
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdbvtnlfdy.exe

Path C:\Temp\i_fdbvtnlfdy.exe
Size 243KB
SHA256 e6f54dce772293d20f477925cde28b7926c9f8270c4ba5a16d7b0e2f00973faf
MD5 bd3b5d285de505b25faf2d3f7c74a35e
SHA1 b390c4a1093504836f8ff48dab5e93e7901825d0
SHA512 28bd15ee34082925a5ae443e5f9de2f77485fb357bdbc568572bda6a50293c0b6a05354268b5beabffa4ab2e87366756f604f1675cc7e956e92f3999223d7c14
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:WvMsLaOa3lLNngoqRttA7h
TLSH
T166345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcxvsnkfd.exe

Path C:\Temp\i_hfcxvsnkfd.exe
Size 243KB
SHA256 2a8a0222024c7343fb49e0d6903d04c42fd0bcadb3472548021177fbfaa56aeb
MD5 df116383eb25c3d8c453c410aae2c044
SHA1 508899fcd275c23146cdb03614ec728af68fa9de
SHA512 6135a80f9ee8213a13f52edb98419db364fa5bdaa12df0ea78f142dd73b527f34c1f17787f653121448217f13c4445e786eac334cc5baa27f52ad8534bd05aa7
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:XvMsLaOa3lLNngoqRttA7y
TLSH
T1A3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdyvtqlig.exe

Path C:\Temp\i_igdyvtqlig.exe
Size 243KB
SHA256 ca74a3344b4bb31dc4c76b876f7ecf9ff56d0ebd24113b723f404eb39ebb1dce
MD5 6a1c637b0f360a05f36183149db713bf
SHA1 591e201ce651ff2c3c3b76f9dac3a28b57005df9
SHA512 f1faa08fea475d8619c028e2d263559c7c7402a71ec6f8e39a26002eba4b149bf9b6902c1db5dd036217b39547c1ba31db6a33ecbf0fd0b2d7dacda0c788ec19
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:KvMsLaOa3lLNngoqRttA7V
TLSH
T189345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtojgbztoj.exe

Path C:\Temp\i_wtojgbztoj.exe
Size 243KB
SHA256 4c9a2d413d49fa5dfd311c0cb1cb8871aadf8f498c993e4789f0c2605a4cd41e
MD5 60903f77d6718f070a3912ae2772f19e
SHA1 336e16e50d6e0ac539bab56ff00f0da67b646672
SHA512 61033811d2c55fd5e8aec862bd7811167517b305ee6c16d5239916cdbe36e6f1d348a35cfb1871361eae5f81034d84500b4d81ff03a5657c5bdb29b01076b195
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:8vMsLaOa3lLNngoqRttA7z
TLSH
T112345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnlfdxvs.exe

Path C:\Temp\i_yvqnlfdxvs.exe
Size 243KB
SHA256 1bba18d0452d78cfb9e4c3dd3eeae17fcc15e9eb383e8fdd2195ba1ec95790c0
MD5 d2468966a3aa5289495a5f4b4aadc80a
SHA1 ba3e1b863b90e634b402095a07572847fa8cd3fd
SHA512 7b06f3f82c1e0e925c141da152b4c74dc1ba6386296b273cda84fbe9481c30b3151e71dd91a4a04c06659296479a0f54a9dd4dec29f5b7843e5260c9bf657300
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:qvMsLaOa3lLNngoqRttA71
TLSH
T1AA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvtqlig.exe

Path C:\Temp\igdyvtqlig.exe
Size 243KB
SHA256 a41dece757d3e9a9ee3f69632896437fdc6cc03d4c524b35cec02a3ab4e529cd
MD5 d1aa0561898d625407464842730cee7e
SHA1 7e197666b43a2e9aa5fee9233b9a62ac349cd13b
SHA512 0cff91531bbb9b5befef93d194f3add6f5fdb50ee17b024e5a819740d2d95550fe1a77fb7354435c7063390c8f46ef26d8dcc04f599662c52f8a453e1f16692a
SSDEEP 3072:yCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:tvMsLaOa3lLNngoqRttA7o
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtqoig.sys

Path C:\Temp\lidbvtqoig.sys
Size 141KB
SHA256 62a6497ea6212cc71cb125df062458163cabc55c9bb2e93022d3292af7df7248
MD5 cc4e683220e85d6a1a6e3773c0924058
SHA1 2975b76d5143b5578efa2dd96eb7ae78a9d357f2
SHA512 a9b6b1ffc312cca6e4b8d494bb9f43ce8ae073306e004d2f7831af2d410ac9879b43de416283f7c412c607e9fedca9ceaebaffd9fba1dd1dbbdceaaddefbb992
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxvpnk.sys

Path C:\Temp\pnhfzxvpnk.sys
Size 141KB
SHA256 31c173deaa1a9b249f4f897db2693faef66aa4797ef0dce3e1a173c31be5e9a4
MD5 13e4c80ce4b9c610c4022fae573968b6
SHA1 b9e5208834f1649a1b1cb780c99d16c24cf80188
SHA512 ee2f91de977eff46e5121712dab09553b6a774d8016ed87593b50c47ee7becb1f93d4a23a876d072d1c03a6aedc35dc282c0d75b706755246407058026559212
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T146E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbywqo.sys

Path C:\Temp\toljdbywqo.sys
Size 141KB
SHA256 3a1feee24fb2810790db69138d8b164cbbb33da3a4959ea0c7c32ed5f4131adf
MD5 cdc267887626bfd2e1fbf54d1d955299
SHA1 a291535c57f713b2b7ab75160b49c9d81bb8dc60
SHA512 2a097adbd636c9f7cd52a7107b0d184fdf70b365fa10ff1b3d117f9d0d36e78d2b312d5e60ff4879b32cdcbb0c8c2da1d94dd5f1fa10cbc9e7577c80054b5f8e
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnkicausq.sys

Path C:\Temp\vpnkicausq.sys
Size 141KB
SHA256 cdbe0724c8fef0bb80d5e35a7d7ea5403be411a2ad5c0276291d9a5e796fb065
MD5 c08fd2f3f3c851978d4a2f26b46b293b
SHA1 61e5254671adc63df5860b15e920b09d52f234a7
SHA512 d4c0e5a79b30fd5869ea50acae01bc27b2527b9ee2ffd90cb166e6d9a3467862b657cb8c8643ea14d290880bae49bf07c797e74c2c9eb7b3158f40a641227b20
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T170E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtojgbztoj.exe

Path C:\Temp\wtojgbztoj.exe
Size 243KB
SHA256 27a3b195e6ad63dd047806873ace21b9b05ceb9c5b52eeb082e310e4692c805f
MD5 b7bbcd6fcbf0b60cdde95101acd2c44b
SHA1 f823f4c56d641785e426898f7f495b716ca86188
SHA512 3b061cf9e5a17f7688b56fbe7656e1bc57ced9a5e28eae2312e3e9c092e8357c53741561f244f68669d93dc37735206319e4ea032290bc82a2bc3df51603ffd5
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:svMsLaOa3lLNngoqRttA77
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnlfdxvs.exe

Path C:\Temp\yvqnlfdxvs.exe
Size 243KB
SHA256 28d1e1ba6794a81e8e9a501b2e95e089a9f12ec2def5cb4ea60d685fe88e0efa
MD5 bc54cd8da638a85d622b1aa7307e2014
SHA1 0648e20f9fd0e00cc507140a365c835b094c6119
SHA512 807b74812778344cc009b28a0000df0faa34a90b6b231d917f3ebdde37d4c85ef2f98b40314bb668647374eb8e5d962a3ea1b683e31eb4ca8faf2e961a608c81
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:mvMsLaOa3lLNngoqRttA7V
TLSH
T116345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 74b857531ccfb1f3821acb1cc292427b5018dee7e526105d7a3c29501c9c3366
MD5 e9f573ad45619381f4e3f4431d0bbcac
SHA1 7c3738a7c590db4f002adb4dcf3357710a92ea06
SHA512 7dd0278935d08044fdbccf7cd9beea60ca5285d2c3017bae024720e4750f1d6371b016cea2c3c28fb1b56c71dbe2043799c62ba19151982f2e23d7784dc0b8c9
TLSH
T1495140612B2D29E3D7B641B370E5195936FFC40942AF1E20A0D45C745D22F0F9CE386B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ad2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ad2e.TMP
Size 2KB
SHA256 ee9c84610ff75fcb2856b5737cbb3261b69ea5443f3ab4d840efed7d6f0eb377
MD5 b18ca1555eedce57b2fa92559dba4446
SHA1 bcd2ff45e061a58085aa231b040d8813986ad004
SHA512 5a0664908985385a77a8d309052a55c5b8fe7963b60021216754f4680c090b83c64e226b733afcff710e96ff626c03a9b392a285ebfb1243a1eaad96210a64bf
TLSH
T1DD5162612B2D29E3D7B640B3B0E5195A36FFC44942AF1E20A0D45C745E22F0FACE3867
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 85512e91a55ccbd599745b011d2f30bf740201d888f753f575c2f25f0a670084
MD5 a6ce46a05dfd5541e164c781d7961a8e
SHA1 335feb3b37d728ff1788b8aff7f24652f08066b1
SHA512 8fa22dd4fdcd83091e3a0d2af535596ae9e21499dab8dc9d7c665478aceb768292bdb84d043b4cc4793aabe2eb70ad7202f39048b4e8be6e5e2be7394b2a6002
TLSH
T12851AFF3C3E8856EC90196F0AB186E1BCE2D0914532C3D5AC8E4EE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d6e3c585186b94353ad25d3ff2cf488af453437b2fd74ac7b8702f3a0121a56
MD5 81699073ac57e9eebb9bbfd70a07d461
SHA1 54e37bc4a4075ab927455ea8d9819bcd97780e48
SHA512 5dd9c82a5d0aa31100b1b89c13bf7d6d7e1d3e3fad53ab83a44ca8b10849a26235037b496a465afc6624d997b134fdb4a010bab717020450ef34b4bd81c4f698
SSDEEP 192:sxRrRwC7/fKsIXcZ0QzoA8p9K/g6+WNCBd/YoFCY4GZIgD7NtWJ:sxRrV7/fKsIXi0Jc/5i/QeO
TLSH
T12D42C85A6E28593B5CCBD219BA657F53E2F95022A1D41E48E7FD8A0C04E77CD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8e045582bf5072db0f788a987ab3c141ce1a28ec78047786546b0bdf2d636864
MD5 289105325b9437915f3608e5e6d62e8c
SHA1 08a0101ed9a1916f01cf1d8e0c618eaeb22682d8
SHA512 0b9af77d098b57f45c346b43cf50dc0f03707b833fc3cd72699f173a11d3c6ec91f61ab93131e4e94220a80886d350f1722860b3882f4399a491b556339542e2
SSDEEP 192:sxRQRwC7/fKshlcZ0QzoA8p9K/g6+WNCBd/YoSCY4GZIgVNtWJ:sxRQV7/fKshli0Jc/5i/BeU
TLSH
T1B242B8566E28993B5CC7D31DBA65BF53E2F95022A1D42E48E6FD8A0C04E76CD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9d0c3ed28c415186b5c32b42cc04d903af452518a2b33f772e0e0af0ed1f5f89
MD5 e1532572d17587c9dc2a5f00e58ebe52
SHA1 e23eed15556efbd073b6c3171fbe72f3d4f14611
SHA512 4410f572d1d931102ffaccdc31108f052fd867ac867f9cefea37b78a0bc6b59f6ad3e2924b09fe770099b1e5caa687b258d47cfd3ea4126bbddcc6b40a70dbc5
SSDEEP 192:sxRrRwC7/fKsIlcZ0QzoA8p9K/g6+WNCBd/YoSCY4GZIgDRNtWJ:sxRrV7/fKsIli0Jc/5i/Be0
TLSH
T16F42C8566E28993B5CC7D21DBA65BF53E2F95022A1D02E48E6FD8A0C04E77CD231781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e00d7fe9cf1fb082579d6d0ec9647d40d9da887f6faf12e277e04c9b12b73ddd
MD5 41b632e67eec5d8e1ee9042b63c81acf
SHA1 ac3602ef04b63b8db798553acdcfbd3b6fffa03e
SHA512 08a11d345b7b8dd76e48e1e6ac58d6bccaa17bfdb1f36a492ddc6cfbfd9a144a7fbccf071325836789b7a4f56311bc014ed1c421a793a3113420a0e7d2932d3b
SSDEEP 768:j26Hda7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVuOBVuwAro9zyiA:j26HdyEf6RWgs2f02u1jaJOB4wL9Ml
TLSH
T1A2D2DA7B640DCABF4F804ADDEC197E9E6D6802CB9698CD8047FE851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df95384b689dde6c42f3b567a7f156c7d6d9cb0702cc6a28e86d6c210768d6dc
MD5 d8e4709ca138592f2e78db94997e1b94
SHA1 053e4e333b24139bc9f7cf397cf0df5be58e5a04
SHA512 c9d261e342bcb5aef8a3094ac8febdb8159c06d4e17febb3d406c7acc6f365bbf5270d602409627fed328821568d04ab3811e8e46a88eb020e032ec4485bda13
SSDEEP 768:7f33c/TBOWT1a52ONXyer1IRCzni9Kb9M68:7f3sj62SIqnpb+68
TLSH
T127F2BF34E855DE338CE6E396B54B27936EF82077D6C40A84E9DB6F0E059365D130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f8eecc40e55aa919026ed2738a42b505799bb3da8274806803d2e02f83f44ea0
MD5 0ea9fa5136adb978c4a3cdb177540aa0
SHA1 a6e10565b038d198726e72e341915bbb55980827
SHA512 0782fa7aeb9b7fe113e06049f52f58bee7233d373b5a6057268e1df842063ea7af98cd46399e5c30d2f09aea6990be5327d8835fb05b5ab5368a17cc795bc3f1
SSDEEP 768:crv+4UNbdA3/c/TBOWT1a5hONXyer1IRCzni9Kb9M66:cbsbW30j6hSIqnpb+66
TLSH
T10913BE31E868DF338CA2A396B04B66937FB82067C9C50694E9DA2F8E059759D130F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 83b5dbd96575541f0beb1edac0e3d270526749589ff5ae6b0c32f29a87062131
MD5 d702d8f37a3f709296dfbf23f24b44b1
SHA1 6daca409a146199d23bc78abb0c652d55563abc2
SHA512 9f4836e97b05ab5d088d6d1bd3dda3daef2406ff3ddeda39c3cc5c48ed319ac6b19293197bac36f39cc9624d527cb824455b3fe3b0e59a56a81b2482fbbe9ce6
SSDEEP 768:hrv+4UNbdz3Bt/TBOWT1jONXyer1IRCzniBdeVH1SK7:hbsbV37jjSIqnGEH1l
TLSH
T16D03CF36E4A8DE338CE2A3C6B04776437FB86057D6840790D9DE2F4E06AB59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6fe7d23055302029ba8e7b870bd55add8e08e8780cbaa4881755434069d0618c
MD5 d48b837a77b26a86f36ec9bd25b5e760
SHA1 caad3a4b2dba6e1547b1ce2619126286b2280ab2
SHA512 6ce10be8c0f054ce42986acf498178308c096d4fdf919b848474a32b55acc27f7c31ce39c5820669234592adb7576a973491975b9d28a62ff3b439b1c28ba34e
SSDEEP 768:zk3xPVsOWT1a5JONXyer1IRCzni9Kb9M68:zk3Z+6JSIqnpb+68
TLSH
T1081328F498D38E32D89E9383637D6E465DBCD023B5884980BBD65E4DCC8257FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

5486f5a8-f3e3-4ab9-bf5f-ee41380b81f0.tmp

Path C:\Users\Admin\AppData\Local\Temp\5486f5a8-f3e3-4ab9-bf5f-ee41380b81f0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3336_649660347\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1084-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1208-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1360-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2456-577-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-540-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2820-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3448-589-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3784-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-634-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3812-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3900-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-523-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4732-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5228-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5268-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download