adb0b225db25ad3473c52d97e396f249a01f55d08730c7cec775d1906019c31c

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
Size 243KB
Sample260731-vebdcsdf25
SHA256 adb0b225db25ad3473c52d97e396f249a01f55d08730c7cec775d1906019c31c
MD5 be311864b2d5233f144a39be6bab0039
SHA1 ddb49ad6684807999427e2b3ed731c36cf420cb1
SHA512 73543d323725d2762e1cabf0b2da1c897b187c35f549b264ec93809284a7ad0721fab06a2f756c77ee1325473993b572caa37d26b997847ee68e870ae93fbfe0
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:JvMsLaOa3lLNngoqRttA7Q
TLSH
T1C3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4676	CP.exe
2380	bztrljdbwt.exe
3576	CP.exe
3240	CP.exe
4352	i_bztrljdbwt.exe
5852	jgeywqojgb.sys
4300	CP.exe
3040	tqojdywqoi.exe
2256	CP.exe
3352	CP.exe
2904	i_tqojdywqoi.exe
4400	qnlfdbvtql.sys
2632	CP.exe
5800	nlidbvtnlg.exe
4564	CP.exe
2884	CP.exe
1252	i_nlidbvtnlg.exe
3644	ifaysqnifa.sys
824	CP.exe
1440	faysqkicav.exe
3396	CP.exe
2496	CP.exe
2752	i_faysqkicav.exe
1552	faxspkifax.sys
5084	CP.exe
5404	vsqkicausm.exe
1908	CP.exe
5124	CP.exe
5176	i_vsqkicausm.exe
3444	icausnkfcx.sys
5556	CP.exe
3636	zxspkhcxrp.exe
5008	CP.exe
5488	CP.exe
3148	i_zxspkhcxrp.exe
1476	fzwuspkhca.sys
5780	CP.exe
5712	ezxrpjhczu.exe
5744	CP.exe
200	CP.exe
2788	i_ezxrpjhczu.exe
1552	ezxrpjhbzt.sys
2972	CP.exe
4464	ecwuomgezw.exe
4540	CP.exe
4796	CP.exe
4976	i_ecwuomgezw.exe
5724	bwtomgeywu.sys
2600	CP.exe
3592	bwtomgeywr.exe
5668	CP.exe
5852	CP.exe
3624	i_bwtomgeywr.exe
2656	bywrojgbyw.sys
264	CP.exe
2920	rojgbytqlj.exe
5956	CP.exe
3228	CP.exe
5116	i_rojgbytqlj.exe
4124	wqoigaytql.sys
3056	CP.exe
2152	qoigbytqlj.exe
5724	CP.exe
1824	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1104676581\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_627436498\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1104676581\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1104676581\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1748_1298514839\_locales\iw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxrpnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzljdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdywqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqojdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqojdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdywqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzljdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxrpnkfca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1632	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4240	ipconfig.exe
2044	ipconfig.exe
4124	ipconfig.exe
1224	ipconfig.exe
2232	ipconfig.exe
5096	ipconfig.exe
3752	ipconfig.exe
1484	ipconfig.exe
2108	ipconfig.exe
5164	ipconfig.exe
5792	ipconfig.exe
5752	ipconfig.exe
5772	ipconfig.exe
1080	ipconfig.exe
1496	ipconfig.exe
252	ipconfig.exe
5268	ipconfig.exe
4636	ipconfig.exe
2916	ipconfig.exe
5680	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299904340272790"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{08F05FF5-D07C-41F7-9877-B5AC3DE51BD1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	i_bztrljdbwt.exe
Token: SeDebugPrivilege	2904	i_tqojdywqoi.exe
Token: SeDebugPrivilege	1252	i_nlidbvtnlg.exe
Token: SeDebugPrivilege	2752	i_faysqkicav.exe
Token: SeDebugPrivilege	5176	i_vsqkicausm.exe
Token: SeDebugPrivilege	3148	i_zxspkhcxrp.exe
Token: SeDebugPrivilege	2788	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	4976	i_ecwuomgezw.exe
Token: SeDebugPrivilege	3624	i_bwtomgeywr.exe
Token: SeDebugPrivilege	5116	i_rojgbytqlj.exe
Token: SeDebugPrivilege	3732	i_qoigbytqlj.exe
Token: SeDebugPrivilege	256	i_qoigaysqli.exe
Token: SeDebugPrivilege	2560	i_caxrpnkfca.exe
Token: SeDebugPrivilege	4180	i_usmkecaxsp.exe
Token: SeDebugPrivilege	3804	i_cwupmhezwr.exe
Token: SeDebugPrivilege	3864	i_uomgebztrm.exe
Token: SeDebugPrivilege	2928	i_bzljdbztrl.exe
Token: SeDebugPrivilege	2404	i_trljdbytqo.exe
Token: SeDebugPrivilege	3980	i_qoigdywqni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 5028	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	89
PID 5028 wrote to memory of 1748	5028	iexplore.exe	90
PID 1748 wrote to memory of 5000	1748	msedge.exe	91
PID 1748 wrote to memory of 4348	1748	msedge.exe	92
PID 1748 wrote to memory of 1632	1748	msedge.exe	93
PID 1748 wrote to memory of 4348	1748	msedge.exe	92
PID 1748 wrote to memory of 4348	1748	msedge.exe	92
PID 1748 wrote to memory of 712	1748	msedge.exe	94
PID 1748 wrote to memory of 712	1748	msedge.exe	94
PID 1748 wrote to memory of 5196	1748	msedge.exe	96
PID 1748 wrote to memory of 5196	1748	msedge.exe	96
PID 1748 wrote to memory of 5196	1748	msedge.exe	96
PID 1748 wrote to memory of 464	1748	msedge.exe	97
PID 1748 wrote to memory of 464	1748	msedge.exe	97
PID 1748 wrote to memory of 464	1748	msedge.exe	97
PID 1748 wrote to memory of 4964	1748	msedge.exe	98
PID 1748 wrote to memory of 4964	1748	msedge.exe	98
PID 1748 wrote to memory of 4964	1748	msedge.exe	98
PID 1748 wrote to memory of 5732	1748	msedge.exe	99
PID 1748 wrote to memory of 5732	1748	msedge.exe	99
PID 1748 wrote to memory of 5732	1748	msedge.exe	99
PID 1748 wrote to memory of 4880	1748	msedge.exe	100
PID 1748 wrote to memory of 4880	1748	msedge.exe	100
PID 4708 wrote to memory of 4676	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	102
PID 2380 wrote to memory of 3576	2380	bztrljdbwt.exe	105
PID 1748 wrote to memory of 5844	1748	msedge.exe	108
PID 1748 wrote to memory of 4796	1748	msedge.exe	109
PID 1748 wrote to memory of 5844	1748	msedge.exe	108
PID 1748 wrote to memory of 4796	1748	msedge.exe	109
PID 1748 wrote to memory of 2696	1748	msedge.exe	111
PID 1748 wrote to memory of 4484	1748	msedge.exe	112
PID 1748 wrote to memory of 4484	1748	msedge.exe	112
PID 1748 wrote to memory of 5272	1748	msedge.exe	113
PID 1748 wrote to memory of 5272	1748	msedge.exe	113
PID 1748 wrote to memory of 484	1748	msedge.exe	116
PID 1748 wrote to memory of 484	1748	msedge.exe	116
PID 1748 wrote to memory of 5648	1748	msedge.exe	117
PID 1748 wrote to memory of 5648	1748	msedge.exe	117
PID 4708 wrote to memory of 3240	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	118
PID 4708 wrote to memory of 4300	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	122
PID 3040 wrote to memory of 2256	3040	tqojdywqoi.exe	124
PID 4708 wrote to memory of 3352	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	127
PID 4708 wrote to memory of 2632	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	131
PID 5800 wrote to memory of 4564	5800	nlidbvtnlg.exe	133
PID 4708 wrote to memory of 2884	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	136
PID 4708 wrote to memory of 824	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	140
PID 1440 wrote to memory of 3396	1440	faysqkicav.exe	142
PID 4708 wrote to memory of 2496	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	145
PID 1748 wrote to memory of 4972	1748	msedge.exe	148
PID 1748 wrote to memory of 1372	1748	msedge.exe	149
PID 1748 wrote to memory of 1184	1748	msedge.exe	150
PID 4708 wrote to memory of 5084	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	153
PID 5404 wrote to memory of 1908	5404	vsqkicausm.exe	155
PID 4708 wrote to memory of 5124	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	158
PID 4708 wrote to memory of 5556	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	162
PID 3636 wrote to memory of 5008	3636	zxspkhcxrp.exe	164
PID 4708 wrote to memory of 5488	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	167
PID 4708 wrote to memory of 5780	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	171
PID 5712 wrote to memory of 5744	5712	ezxrpjhczu.exe	173
PID 4708 wrote to memory of 200	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	176
PID 4708 wrote to memory of 2972	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	180
PID 4464 wrote to memory of 4540	4464	ecwuomgezw.exe	182
PID 4708 wrote to memory of 4796	4708	2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe	185
PID 1748 wrote to memory of 3004	1748	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_be311864b2d5233f144a39be6bab0039_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x334,0x7ffd9374c188,0x7ffd9374c194,0x7ffd9374c1a0
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15353802510871611969,5968737416447437840,262144 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,14270578613127646333,5665343842763713292,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
      4⤵
      System Time Discovery
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,13615523208582363505,9981522643163733658,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,13835921286437557558,874714269616855695,2097152 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,14545188553567899650,5014248972268522664,2097152 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,1671887831277583576,14503612790339155472,2097152 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:9
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,7633445395112923951,4091182031030224628,2097152 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,15285279968861330311,983647330100429376,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,14342155772135187524,5348494282367928728,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3412795685749358529,2976524554866565800,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,3013710849766807448,13015861880856346564,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:3132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,3013710849766807448,13015861880856346564,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,13484938966136163170,14620013558846996001,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,17839482732570166104,1525804193149729695,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:5272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,17120665780998488882,17328585528004765193,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,8554278843461733642,3129668606954944752,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,15240140851376743544,16643284266055833099,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:14
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,3666496772049985895,2006391489956024713,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,14948413259465589052,12435035599195826690,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,15729239112796662615,13188434485334967325,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:14
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5567317000776375648,1500032288343160646,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17069096790957716483,4205637109898316500,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,16183680200831881486,1647528330796662710,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6120,i,15506571696630572466,236927795857661714,262144 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,8443904817964724835,16224505889776425161,524288 --field-trial-handle=2420,i,1526348412246764949,13239515356086104325,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:14
      4⤵
      PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4676
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3240
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqojdywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Temp\tqojdywqoi.exe
    C:\Temp\tqojdywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqojdywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\i_tqojdywqoi.exe
    C:\Temp\i_tqojdywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2632
- - C:\Temp\nlidbvtnlg.exe
    C:\Temp\nlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Temp\i_nlidbvtnlg.exe
    C:\Temp\i_nlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkicav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:824
- - C:\Temp\faysqkicav.exe
    C:\Temp\faysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkicav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Temp\i_faysqkicav.exe
    C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5084
- - C:\Temp\vsqkicausm.exe
    C:\Temp\vsqkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\i_vsqkicausm.exe
    C:\Temp\i_vsqkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkhcxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5556
- - C:\Temp\zxspkhcxrp.exe
    C:\Temp\zxspkhcxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkhcxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5488
- - C:\Temp\i_zxspkhcxrp.exe
    C:\Temp\i_zxspkhcxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5780
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\bwtomgeywr.exe
    C:\Temp\bwtomgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\i_bwtomgeywr.exe
    C:\Temp\i_bwtomgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:264
- - C:\Temp\rojgbytqlj.exe
    C:\Temp\rojgbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3228
- - C:\Temp\i_rojgbytqlj.exe
    C:\Temp\i_rojgbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\qoigbytqlj.exe
    C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_qoigbytqlj.exe
    C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:4732
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:52
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:5180
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkica.exe ups_run
  2⤵
  PID:1096
- - C:\Temp\ifaysqkica.exe
    C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkica.exe ups_ins
  2⤵
  PID:4848
- - C:\Temp\i_ifaysqkica.exe
    C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxrpnkfca.exe ups_run
  2⤵
  PID:6024
- - C:\Temp\caxrpnkfca.exe
    C:\Temp\caxrpnkfca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxrpnkfca.exe ups_ins
  2⤵
  PID:4236
- - C:\Temp\i_caxrpnkfca.exe
    C:\Temp\i_caxrpnkfca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecaxsp.exe ups_run
  2⤵
  PID:3640
- - C:\Temp\usmkecaxsp.exe
    C:\Temp\usmkecaxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecaxsp.exe ups_ins
  2⤵
  PID:4384
- - C:\Temp\i_usmkecaxsp.exe
    C:\Temp\i_usmkecaxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezwr.exe ups_run
  2⤵
  PID:2440
- - C:\Temp\cwupmhezwr.exe
    C:\Temp\cwupmhezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezwr.exe ups_ins
  2⤵
  PID:4820
- - C:\Temp\i_cwupmhezwr.exe
    C:\Temp\i_cwupmhezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgebztrm.exe ups_run
  2⤵
  PID:2940
- - C:\Temp\uomgebztrm.exe
    C:\Temp\uomgebztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgebztrm.exe ups_ins
  2⤵
  PID:5760
- - C:\Temp\i_uomgebztrm.exe
    C:\Temp\i_uomgebztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzljdbztrl.exe ups_run
  2⤵
  PID:1496
- - C:\Temp\bzljdbztrl.exe
    C:\Temp\bzljdbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzljdbztrl.exe ups_ins
  2⤵
  PID:4352
- - C:\Temp\i_bzljdbztrl.exe
    C:\Temp\i_bzljdbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbytqo.exe ups_run
  2⤵
  PID:5164
- - C:\Temp\trljdbytqo.exe
    C:\Temp\trljdbytqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbytqo.exe ups_ins
  2⤵
  PID:6084
- - C:\Temp\i_trljdbytqo.exe
    C:\Temp\i_trljdbytqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdywqni.exe ups_run
  2⤵
  PID:368
- - C:\Temp\qoigdywqni.exe
    C:\Temp\qoigdywqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigdywqni.exe ups_ins
  2⤵
  PID:3556
- - C:\Temp\i_qoigdywqni.exe
    C:\Temp\i_qoigdywqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2680

C:\Temp\jgeywqojgb.sys
C:\Temp\jgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:5852

C:\Temp\qnlfdbvtql.sys
C:\Temp\qnlfdbvtql.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\ifaysqnifa.sys
C:\Temp\ifaysqnifa.sys
1⤵
- Executes dropped EXE
PID:3644

C:\Temp\faxspkifax.sys
C:\Temp\faxspkifax.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\icausnkfcx.sys
C:\Temp\icausnkfcx.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\fzwuspkhca.sys
C:\Temp\fzwuspkhca.sys
1⤵
- Executes dropped EXE
PID:1476

C:\Temp\ezxrpjhbzt.sys
C:\Temp\ezxrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\bwtomgeywu.sys
C:\Temp\bwtomgeywu.sys
1⤵
- Executes dropped EXE
PID:5724

C:\Temp\bywrojgbyw.sys
C:\Temp\bywrojgbyw.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Temp\wqoigaytql.sys
C:\Temp\wqoigaytql.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Temp\nifdbysqni.sys
C:\Temp\nifdbysqni.sys
1⤵
PID:4352

C:\Temp\kicavsnlfd.sys
C:\Temp\kicavsnlfd.sys
1⤵
PID:2232

C:\Temp\vpmhecaxsp.sys
C:\Temp\vpmhecaxsp.sys
1⤵
PID:2564

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
PID:5916

C:\Temp\uomgeywuom.sys
C:\Temp\uomgeywuom.sys
1⤵
PID:484

C:\Temp\dbztrljebw.sys
C:\Temp\dbztrljebw.sys
1⤵
PID:3716

C:\Temp\ytrljdbytq.sys
C:\Temp\ytrljdbytq.sys
1⤵
PID:2732

C:\Temp\qligdyvqoi.sys
C:\Temp\qligdyvqoi.sys
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwt.exe

Path C:\Temp\bztrljdbwt.exe
Size 243KB
SHA256 f68464e97ac3ee7f3e042b3135dd44810a52dda82ad1b29f151669cf863a2674
MD5 62c99db0141c8b5f2669456b948348ad
SHA1 48cfaddd7dbb82d1dcaedaed6ea852ee4bc852cd
SHA512 d279fe289b6cec4de74867a543136ae1ed79af4846eb0c9863af4d4208f4c5774e176b49b535b5ae85b4c24360587552a37dd6d3ab30416eb30cca6db0d12ede
SSDEEP 3072:BCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:cvMsLaOa3lLNngoqRttA7T
TLSH
T1F1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxspkifax.sys

Path C:\Temp\faxspkifax.sys
Size 141KB
SHA256 e6bf36176fcca2e17837bf3862076376d4e9459a30a91d069521a6bbc5de2cc1
MD5 c7d467018887bd587a2ee6f043bb5fcb
SHA1 dd9fa7ca49ca851961036e69814975338c4a06cb
SHA512 24a50b6402deb8257db916871ca3313faf3e68895e55f56c2c27e47f3fe386d287051b951f05799ff774944ddfe0ced75501d4d8e0e969db7fc1320a6b36f5d5
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicav.exe

Path C:\Temp\faysqkicav.exe
Size 243KB
SHA256 ccc0ce7f490c1e2298a66422e7ad66e59b3bc7fe52a6ad83a0a57786c08124cd
MD5 267e3820eeba9131156d3af5c2a13fdd
SHA1 103e6a53761bb47d4c3c4bd391f56e62ecae387a
SHA512 e8d0fed14f931cc28b6e1688323b2f6903352951fd4b30ca595fb0f17c5a5a95f2fb8ddd5e4f5f79be6f0ba3e1578b9814eb54db9cb3313229c85f736641fbdf
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:/vMsLaOa3lLNngoqRttA7y
TLSH
T15D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljdbwt.exe

Path C:\Temp\i_bztrljdbwt.exe
Size 243KB
SHA256 1687ef8d3cb338197c9dfbac3f77bb896a593621f8a98ab4d915865c1d17fa3d
MD5 7d92f39bece5867490e92c928d9075eb
SHA1 c606a7515538d9ce40746bb9e44ed130f8f51bbf
SHA512 2582119c70c2999a185a5208965bb4ea4a98cf61f66cfebe65ca6d36c13e724947c0f1f47c0cdecbd688513463ca4e3e27daaeaac7d0a2924974c967bb53b64e
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:lvMsLaOa3lLNngoqRttA7Y
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqkicav.exe

Path C:\Temp\i_faysqkicav.exe
Size 243KB
SHA256 e18e678503a6aff59cb0866374fc0d529e61208410028cde0d8a51cc6e6b9269
MD5 bd9ab6d854627ac0557ee1824e25c604
SHA1 bf722f161eb54c786319d1a17cb703d8fe8ec0e9
SHA512 56dda23c0c3d2d0b391b3a7ffb959ead24908d917ef714b026536f635af60f026f66832a842b77968713c28d7f961f16760cda5af5a173c9c1dcb542f9779cd8
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:mvMsLaOa3lLNngoqRttA71
TLSH
T101345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlidbvtnlg.exe

Path C:\Temp\i_nlidbvtnlg.exe
Size 243KB
SHA256 4c79bdf61223a53c725bc7267f20d1995177af7a089888b8541d3f1b1cef0642
MD5 7f226c87b042705cbe49ef7cf524354a
SHA1 454e3977e6a896f32c7b172b9acefbcfc8ede18a
SHA512 4dc3ef7bbfde27b24b4ed33cec6aeda3fd879fe621f1275488febcba4a736e3e92e23880c683df14949be9f4905c4477e264b0bb38f04f41c4519bc041c7399c
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:LvMsLaOa3lLNngoqRttA7q
TLSH
T1AA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqojdywqoi.exe

Path C:\Temp\i_tqojdywqoi.exe
Size 243KB
SHA256 75696936f3270e512d19c784de32188ee8e7523763d6011e3ad5ebd403eac09d
MD5 1b3646b505a2c55fb0c057bfdb582aad
SHA1 61a579287db9073d47b6941fe11a554146761a2d
SHA512 2c3b150701efd725efb7cee5143ad22a3772f474f5073b4be65d2f4d600212fc5c8991f8fb349abdbb58b30cf5fa5c7fe27fd166ac2567c7a72881d38fa8f9e0
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:MvMsLaOa3lLNngoqRttA7D
TLSH
T18E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkicausm.exe

Path C:\Temp\i_vsqkicausm.exe
Size 243KB
SHA256 86d6f84d7179d14a5237bbba870a8a8eebfd7b0faaaefed70154c3b112b0a1a2
MD5 3b8f3a2adb8f6aecf6a92d074257b65c
SHA1 0d9b786c9cc2af8232490115d38b9afa884cd567
SHA512 7ba7c65eda1c9e98e53e362741e390e924e6ae07c366bab1afc8486de0fcd36d25bc21c80a22f11d0b4786b29caf96046dc32253bd5c90112ac2b9c3cfe127aa
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:avMsLaOa3lLNngoqRttA7l
TLSH
T1E5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxspkhcxrp.exe

Path C:\Temp\i_zxspkhcxrp.exe
Size 243KB
SHA256 fa9c4411c09665999171b7955c936fed08a58a746082341d457497028c5f6d5d
MD5 d2d8764f13da4181db0b1dac7dcd3103
SHA1 2bb8b5d0d5d781c4afc946a6e48958de1aedee0b
SHA512 4d9cd56092ff1ce3bc961d2f8e52f3932ae5f1118edc57aa2f1e617c56288c07a939ca27cbf90dc9d0ec2a93a09642af8833a9ab4929e327bae76008269db5bd
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:mvMsLaOa3lLNngoqRttA7d
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausnkfcx.sys

Path C:\Temp\icausnkfcx.sys
Size 141KB
SHA256 4624b47d66bc141e8f38b14c51564af3752e5cc97d4851c9930a4c80aaa985f0
MD5 99d2976bbef10390c173bb443e833547
SHA1 ea5a023ccf7849e2903512c1a43a7d8327b0c76d
SHA512 3d78611a4788284cf2641dddfbca282dccd7d2bce6b4dba295b1d3648e4fe62aac842fa6eadac82372130b0da52ce28dbbefc716ce63f2dcaa182fc1f8b52b94
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqnifa.sys

Path C:\Temp\ifaysqnifa.sys
Size 141KB
SHA256 bedb711e3d2eccf740bd4eeb6395a86aac696597c406c3d05b64b0048cc1184b
MD5 5205fafebf2a9967f49b3d1ca0f10b32
SHA1 11f53fe09c07c0c8437609a2e72ca934c29c8893
SHA512 c7947b49ada9a6093684a06b0161f4d921a8b76acfc41a4ed3d0c215e55d3359b978c27267f9a79b938322db20ad51961ef9581c53b5eba3ac1e0f5f781751fa
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywqojgb.sys

Path C:\Temp\jgeywqojgb.sys
Size 141KB
SHA256 7e7b250f278850cf1c980de5a41ecb9870c8b693501f5d4c2fdc64b67c54e9b6
MD5 46fcdbd2ef12a8f9f7c2610811401266
SHA1 d5f33316367d916401d9cbc2c10517b748b2bcfe
SHA512 6ab26c64e69ff68989244ae148139580a0924c8721b323f41439a309317adab10baf686c21aa999eccaaa543dcbb15c27596b35be9aff8d1915081c8c62958f8
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T167E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidbvtnlg.exe

Path C:\Temp\nlidbvtnlg.exe
Size 243KB
SHA256 7044b60f09a94e31bfa96d5538c2f0ea1981cd7849ce29fc9c99c693a1980930
MD5 b4853ee214d2b39cb05e506055401870
SHA1 c5ac172deb552d3b0c54bb309210bea785b395cc
SHA512 78065f0206e94e8bc2af4f6b734f3d51ce0b6fbee34b7b9ac0efdbeb7d108547b21d8ec5e6b77a896003f773979064091ecca9a76dbd08c8d63e5a010e8bdc9f
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:ZvMsLaOa3lLNngoqRttA7o
TLSH
T155345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdbvtql.sys

Path C:\Temp\qnlfdbvtql.sys
Size 141KB
SHA256 4cadcd9444ee2816ddf6c686be2091a2d5d3a98f2ec6356f64282ae337979149
MD5 b933aa9581abd3012aa744404fc600e4
SHA1 75a297752677c47a85ab2c4b1f3eef0fe6152a11
SHA512 f14f77f7e630a0532044a35df2d1e9781a69d32c9b7d731357641eeb18b1c2140a6b4afb4a24f6698067fe00c60039bbb316e541a137e800535788cf3abc96b0
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqojdywqoi.exe

Path C:\Temp\tqojdywqoi.exe
Size 243KB
SHA256 12cff3822cb952dcfaa664eea437aea6499d5d422b9531fc99033b6ee1264616
MD5 cbf25ca04bf31892da3d53a311a1e953
SHA1 8956da4c7d0e235fdee82c02067da3d5831632ac
SHA512 5c8ff19b3367d23f7817065d52988a36a7fa55d72d6c14a39f241c77993758feee9069cf3f5f67be1485c70f1af8ceddbfefa8dd1fd23039a7aa88f6fe83e3a9
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:2vMsLaOa3lLNngoqRttA7R
TLSH
T174345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkicausm.exe

Path C:\Temp\vsqkicausm.exe
Size 243KB
SHA256 b09fd98dac19a8b6b8949e1500b79ae56bbe6887241751fad46e1a521ebbf619
MD5 4f2f94fa6f0f9473d3e90f030bfe0d2a
SHA1 e813aabe94841caee2513c4c752339eef447b9b9
SHA512 74c5443129e4b62ef6f06be35f99d4e60e2614bab940b0563b760385223250edc8ed235312d00fb8deb1c21d237aef72998cd9b0cff88eab186bf1fad03b0908
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:EvMsLaOa3lLNngoqRttA73
TLSH
T1E4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxspkhcxrp.exe

Path C:\Temp\zxspkhcxrp.exe
Size 243KB
SHA256 b81e1411c3f0514a44bbe54ccd2d736b81949d46a92abee2ae2cdc9267668a6a
MD5 eaf1e67ecf6fbfc50e101bf754155473
SHA1 366f5b4d7b343ad1505c5fdc39fd3b25e7facdbc
SHA512 0d59d0fa211320e410977cc21f4dc8de49777a13bf3f81372e9630a2f05e776243c300f44539e57e0526d0c77d9fddd164055fc5248bc0479c9923aa4e9ea2b3
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:FvMsLaOa3lLNngoqRttA7A
TLSH
T1E7345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4ba33d9e4d823a2d0600e355b9bcccc2ffb6ad77013cec96afb3daf0e0c383b7
MD5 5f3adc8657dbbca81d6fb7a2972ba921
SHA1 1e8c12225c3c54d4d4f33adad22c20bebeb64fed
SHA512 3da1cbe6a742e3801c4cd6d0c4ecb1bbb47e8558addfc3f1102efe8082e05d69973b9d9eb26ac300228d56cb6acaab0b6c915571986d6817562e6bd843f52d41
TLSH
T11A5140470BBAC9E2E739A476B7E1AE9D3BF08099664FAB1140497E34C806F1753D0663
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b1b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b1b2.TMP
Size 2KB
SHA256 ad907284facb800a31d2660e51912fb3f6df20471d208495360ad06e976c1db0
MD5 98c78d7d11ed8f41e5697205c6941fc8
SHA1 b30377b3d6455ab44230df89e4c60e6f3775f954
SHA512 9a1beec6f740b0703fcd34735f541659a51fe60e51ef282b98b4d11353c2767697a7f4c67fc5e953d6d77ae969a8653ac5b3fc133526c8cdec7b4d2501b33f3f
TLSH
T1A35140470BBAC9E2E739A476B7E1AE9D3BF08099660FAB1140497E34C806F1757D0663
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2c022ccbb78a4fd9be14e4be5d7c8c9a403b9d23b83f68f7447991b93ad402f8
MD5 486f6685df75d4ac7fd786cf67408c77
SHA1 affa3b3e78a4995e99424b05dd84743ff335753d
SHA512 2d6759f2f0393d99a8004599c340f5b9e63473a59395583acbbac577118baeab6fd9aeb2eaa939164063d466df15c473acd450a4ce523174b6cb7ada96c1839f
TLSH
T18751BFF3C7E8866DC94156F0AB18BE2BCE2D0954432C3D5AC8E4AF5B93E2471E18195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b72e7be796f3440401c69904d7a02a3c39cb6cbeb48a5615d64d43571a60f7a1
MD5 831925b4e1753034622e17f470eaab97
SHA1 2ae6edd912a40590d325891e07f5d19980c30333
SHA512 08a7147672cec612f70ba428c0d485df6733f3c43020f0d0c5ea1079b871c4954cd98b0869dda58a25c43b49d4a7c2559e5cf1741bd5b838263630f9d1661e91
SSDEEP 192:sxRcRxCT/fOsedeeZpRgNzoA8p93/g6+WNCWV/YEHiKiGLIgVNtNJ:sxRcKT/fOsekYTZp/5l/WeZ
TLSH
T14D42B71AAD28993B9CC7D21DBB257F53E2F95032A1951F48E6FC861C04EA6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17c9e958b1f9d64ef0ae3f5468e9b7c208ec10f420dbdeadf02402f7d78dd762
MD5 c7da5eb4987315d3e76fb0897130b37c
SHA1 90ebb7acf96d91999e2e3b954576852a3a07d1d1
SHA512 e708249209a517469b4c5d9bd16fb9ea8bc7f9187d3695418a07010b1ecc0cf3ea67d2de237275a0308fcbee9b07bc126ce5f27960184c57e8e78da697a006e8
SSDEEP 192:sxRfRxCT/fOsidueZpRgNzoA8p93/g6+WNCWV/YE2iKiGLIgDQNtNJ:sxRfKT/fOsi8YTZp/5l/jeI
TLSH
T15C42C71AA928593B9CC7E20DBB657F53E2F95072A1951F48E7FC861C04EB6CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 70fb789d2192f570e3be42191fbcbe23c47fd154ee9d43ae7b5f897c6d12292d
MD5 30a719bd2c14ea9bed3f02c684392651
SHA1 55ed292020d64b7d1e1fc7acf813b73a91acb4da
SHA512 10276eb857480c838d3d4b77ea1b9371766b2d4260dd78696c660117a79784cbded0cbaad1a4dc2e39baf7de06dc490333c20d1952e1ebedabcec383d1b18501
SSDEEP 192:sxRfRxCT/fOsideeZpRgNzoA8p93/g6+WNCWV/YEHiKiGLIgDqNtNJ:sxRfKT/fOsikYTZp/5l/WeK
TLSH
T18242C81AAD28593B9CC7D21DBB657F53E2F95032A1911F48E6FC861C04EA6DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1ea733a2fcd3c8fbe973a29096c4364e2283af912f68fb087a7121e755723f8e
MD5 2c39e290dcddd3c0a567b086ee0dbd67
SHA1 16ab5f3c07e10d724f32cbf778e9cb91a8316653
SHA512 570411545d072d7bd76c141097dfbbb42855fadb6cc38f4867b19cc921a3caf2cbd4a8fceca1c90d2ceb12beec518314f2e362c8a10b6ec96d6b8ce784abc8fd
SSDEEP 768:0UQi1P7pLuLfJaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVme2OVqJroHo6Z:0UQi1JEfJaWgH7feQu1jale2IqiHX
TLSH
T14BD2EC7B640DCB7F4F804ADDEC297E9A6DA802CB9698CD4047FA941C03C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 680f8d21a18a4caa070abe4b5eb66497c391b7f26206547b4f9018e041eca3d6
MD5 cb95ff03d0502520c7cf997eb7b07bfb
SHA1 d313f430364aa5e9590c0e0c5e5b1717466ad5b5
SHA512 34f1df7e5d43f1d28f001fe5f0042db7d41739d27917916dc77da31952faf22ac9a5ff8e71bf2584d82169b15016e5b6d3f64bd9265b6ee487c4e188c95f9761
SSDEEP 768:1730JqGCdD0UaK48dHeByERRFzjK3Yylb9M4e:173JG8/48dHSyw/wlb+4e
TLSH
T1EDF2BEB0AC659D734CABD20A765377A7EEF04163C6D85B64E1D9EB0E448359C0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bf1608e8efc7911f9c7e5a99e19824ae578d7dddda7f6a7f3c53e52f926cdf9d
MD5 fbc2c6e1cc2041cd72ff7d6378843aeb
SHA1 3bd35967671fe0012b647d921caa672c998f9f31
SHA512 f5d5d753d8d3ab5bc04865947fb0a4d06947ddad4baf999e594e204c7334596786d86e4aefccac3254a63c80736b0b7822b4dbb939deffd03aa226896595358e
SSDEEP 768:urv+4UNbd83mJqGjdD0UyK48dHeByERRFzjK3Yylb9M4H:ubsbW3PG1f48dHSyw/wlb+4H
TLSH
T19413CF70A8689EB34CABD24AB2537797BFF0016385D44B64E1D9AB4E44874DC1B0BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ecc229d710644dd11e65c2e39ef4db39cb51a9adc2077924f8640004219fae9
MD5 ce97a1f8f327c749b8b48776196d7656
SHA1 d04dd02d52c1ec34eaa596c93bc177881d403d9c
SHA512 e91939a818d61f7d3caf2985eaebd50610c3725d650ebfba3a072fe2f421ad78dfff64eddbab80babee89ee13fff02fc9aee975b666cab9c9e533bd001e90090
SSDEEP 768:Qrv+4UNbdf3VqGAVD06K48dHeByERRFzjK3YsQeVH1SCj:QbsbJ3QGe+48dHSyw/6QEH1Z
TLSH
T1B203BE71A8A85E774CE7D2897643B617BEF4411382C41BA4C0CD6F4E868B4DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3efe3e3cda72a977539536914a019c0314adeb02b12f2efe52d18748d0b028a3
MD5 1f86de8b25d111510dd1acfa76c4d703
SHA1 60e28dd7ebc79ee75855637433a5036608c36a5d
SHA512 79d58313eb0f2a6bf13c66b11e5792c280c43418997d7caa6919affc339933044bfbee98bb5302e2a651be943b94c57704e6687f35903ce49e31f27631ce33cf
SSDEEP 768:+73jJqGCdD0UaK48dHeByERRFzjK3Yylb9M4e:+73IG8/48dHSyw/wlb+4e
TLSH
T142F2BEB0AC659DB34CABD20A76537797EEF04163C6D85B64E1D9EB0E448359C0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3c0d61a13be586e2195cb9320bc9919285d4777243c1dc886ba817b013fc68c3
MD5 6000783bf202df025814dd2446b0ba7a
SHA1 a40a5e27100c2667d89f0922213d18512fb57874
SHA512 06d91a269d06a349cdcf7c905c8eae4326ceaa3b0c9909576cae0970e60a120cef8df23c7b06c49d8860c670481beabd44b2dfd593df609653177b14153417ae
SSDEEP 768:8t30JqGhRGUuK48dHeByERRFzjK3Yylb9M4e:8t3JGx48dHSyw/wlb+4e
TLSH
T1AB1329F498D39972C89E8347637E6E469DFCC123B1984994B3D99E0DCC820BFC70681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f645af03-af33-4b99-b1cf-5ffa04493cb9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f645af03-af33-4b99-b1cf-5ffa04493cb9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5987e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5987e3.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

fff0f524-9781-4021-a407-1ff6607fc308.tmp

Path C:\Users\Admin\AppData\Local\Temp\fff0f524-9781-4021-a407-1ff6607fc308.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1748_1685743241\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1476-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-545-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1552-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2232-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2564-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2656-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2732-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3444-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3644-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3716-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-582-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5096-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5724-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5852-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download