df4961ac7a2826846d12c9c2f2283f8a9fe34c2b7e7ee9f679231270c500ff72

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe
Size 243KB
Sample260801-swsymacf94
SHA256 df4961ac7a2826846d12c9c2f2283f8a9fe34c2b7e7ee9f679231270c500ff72
MD5 f092b9fdf56ac6eba7a06a75b4ff515a
SHA1 b6483f0453f2f4e90e4c8c261e509e156489b882
SHA512 1994dec2484abd10555d5d8703ef73d64296c4e9ec43ae36d34a92e5761306688f4ca27c3f64c123b66dd0bf6b3255a2b59c2d972c0f19b9ee8134e11596d4d9
SSDEEP 3072:LVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:ZXP7LQMa3lLNngoqRttA7y
TLSH
T18C345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1784	CP.exe
6676	ywrojhezwr.exe
2780	CP.exe
4156	CP.exe
3372	i_ywrojhezwr.exe
5636	jgbztrljdb.sys
3612	CP.exe
6940	bwtomjbyto.exe
2840	CP.exe
7100	CP.exe
6992	i_bwtomjbyto.exe
2016	nljdbvtnlf.sys
1844	CP.exe
1176	olgdywqoig.exe
5988	CP.exe
3276	CP.exe
2756	i_olgdywqoig.exe
4332	vqoigayvqo.sys
1660	CP.exe
5604	icavsnkida.exe
2792	CP.exe
2628	CP.exe
5920	i_icavsnkida.exe
7028	nkidavsqni.sys
3536	CP.exe
3456	faysqnifaq.exe
928	CP.exe
6860	CP.exe
1872	i_faysqnifaq.exe
1420	spkicaxsqk.sys
1532	CP.exe
3284	pkicausmkf.exe
2452	CP.exe
4544	CP.exe
5688	i_pkicausmkf.exe
6748	hfzxrpkhcz.sys
2852	CP.exe
4672	fzxusmkecw.exe
6740	CP.exe
6960	CP.exe
6056	i_fzxusmkecw.exe
2372	pmhfzxrpjh.sys
2736	CP.exe
2332	ecwuomgezw.exe
5100	CP.exe
1304	CP.exe
1040	i_ecwuomgezw.exe
6632	mkebzwuomj.sys
6520	CP.exe
3760	omgezwrpjh.exe
4504	CP.exe
5400	CP.exe
5544	i_omgezwrpjh.exe
2672	geywrojhbz.sys
4360	CP.exe
6432	eztrljdbzw.exe
6040	CP.exe
4172	CP.exe
7108	i_eztrljdbzw.exe
7132	wtolgdyvto.sys
6680	CP.exe
6272	wqolgdywqo.exe
2036	CP.exe
5528	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4960_1529665539\_locales\km\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomjbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqnifaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqnifaq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igebvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrljdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomjbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdavsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrljdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igebvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaxsqkica.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2916	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4724	ipconfig.exe
3924	ipconfig.exe
4064	ipconfig.exe
5436	ipconfig.exe
5708	ipconfig.exe
3960	ipconfig.exe
3004	ipconfig.exe
7068	ipconfig.exe
4376	ipconfig.exe
3376	ipconfig.exe
3388	ipconfig.exe
2420	ipconfig.exe
5068	ipconfig.exe
700	ipconfig.exe
6748	ipconfig.exe
7112	ipconfig.exe
6256	ipconfig.exe
6904	ipconfig.exe
6172	ipconfig.exe
5704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300717473161893"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{EDCA860A-B07E-4344-82AD-E0287925827C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	msedge.exe
5200	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	i_ywrojhezwr.exe
Token: SeDebugPrivilege	6992	i_bwtomjbyto.exe
Token: SeDebugPrivilege	2756	i_olgdywqoig.exe
Token: SeDebugPrivilege	5920	i_icavsnkida.exe
Token: SeDebugPrivilege	1872	i_faysqnifaq.exe
Token: SeDebugPrivilege	5688	i_pkicausmkf.exe
Token: SeDebugPrivilege	6056	i_fzxusmkecw.exe
Token: SeDebugPrivilege	1040	i_ecwuomgezw.exe
Token: SeDebugPrivilege	5544	i_omgezwrpjh.exe
Token: SeDebugPrivilege	7108	i_eztrljdbzw.exe
Token: SeDebugPrivilege	3216	i_wqolgdywqo.exe
Token: SeDebugPrivilege	2016	i_ifdyvqoiga.exe
Token: SeDebugPrivilege	7144	i_nlfdavsqkf.exe
Token: SeDebugPrivilege	3384	i_fcaxsqkica.exe
Token: SeDebugPrivilege	3524	i_cxupnhfzxu.exe
Token: SeDebugPrivilege	6136	i_fzwurmkecw.exe
Token: SeDebugPrivilege	2300	i_mjhbzurmjh.exe
Token: SeDebugPrivilege	6076	i_jhbztromge.exe
Token: SeDebugPrivilege	7008	i_igebvtolgd.exe
Token: SeDebugPrivilege	6248	i_sqlidbvtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4508	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	90
PID 4508 wrote to memory of 4960	4508	iexplore.exe	91
PID 4960 wrote to memory of 4168	4960	msedge.exe	92
PID 4960 wrote to memory of 4368	4960	msedge.exe	93
PID 4960 wrote to memory of 2916	4960	msedge.exe	95
PID 4960 wrote to memory of 4368	4960	msedge.exe	93
PID 4960 wrote to memory of 4368	4960	msedge.exe	93
PID 4960 wrote to memory of 1388	4960	msedge.exe	96
PID 4960 wrote to memory of 1388	4960	msedge.exe	96
PID 4960 wrote to memory of 2312	4960	msedge.exe	97
PID 4960 wrote to memory of 2312	4960	msedge.exe	97
PID 4960 wrote to memory of 2312	4960	msedge.exe	97
PID 4960 wrote to memory of 2064	4960	msedge.exe	98
PID 4960 wrote to memory of 2064	4960	msedge.exe	98
PID 4960 wrote to memory of 2064	4960	msedge.exe	98
PID 4088 wrote to memory of 1784	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	99
PID 6676 wrote to memory of 2780	6676	ywrojhezwr.exe	102
PID 4960 wrote to memory of 6828	4960	msedge.exe	105
PID 4960 wrote to memory of 6828	4960	msedge.exe	105
PID 4960 wrote to memory of 1820	4960	msedge.exe	106
PID 4960 wrote to memory of 1820	4960	msedge.exe	106
PID 4960 wrote to memory of 5532	4960	msedge.exe	108
PID 4088 wrote to memory of 4156	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	111
PID 4088 wrote to memory of 3612	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	115
PID 6940 wrote to memory of 2840	6940	bwtomjbyto.exe	117
PID 4088 wrote to memory of 7100	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	120
PID 4088 wrote to memory of 1844	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	124
PID 1176 wrote to memory of 5988	1176	olgdywqoig.exe	126
PID 4088 wrote to memory of 3276	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	129
PID 4088 wrote to memory of 1660	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	133
PID 5604 wrote to memory of 2792	5604	icavsnkida.exe	135
PID 4088 wrote to memory of 2628	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	138
PID 4960 wrote to memory of 6824	4960	msedge.exe	141
PID 4960 wrote to memory of 2332	4960	msedge.exe	142
PID 4960 wrote to memory of 2372	4960	msedge.exe	143
PID 4960 wrote to memory of 2472	4960	msedge.exe	144
PID 4960 wrote to memory of 2472	4960	msedge.exe	144
PID 4960 wrote to memory of 2280	4960	msedge.exe	145
PID 4960 wrote to memory of 2280	4960	msedge.exe	145
PID 4088 wrote to memory of 3536	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	148
PID 3456 wrote to memory of 928	3456	faysqnifaq.exe	150
PID 4088 wrote to memory of 6860	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	153
PID 4088 wrote to memory of 1532	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	157
PID 3284 wrote to memory of 2452	3284	pkicausmkf.exe	159
PID 4088 wrote to memory of 4544	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	162
PID 4088 wrote to memory of 2852	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	166
PID 4672 wrote to memory of 6740	4672	fzxusmkecw.exe	168
PID 4088 wrote to memory of 6960	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	171
PID 4088 wrote to memory of 2736	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	175
PID 2332 wrote to memory of 5100	2332	ecwuomgezw.exe	177
PID 4088 wrote to memory of 1304	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	180
PID 4960 wrote to memory of 6600	4960	msedge.exe	182
PID 4960 wrote to memory of 6600	4960	msedge.exe	182
PID 4088 wrote to memory of 6520	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	187
PID 3760 wrote to memory of 4504	3760	omgezwrpjh.exe	189
PID 4088 wrote to memory of 5400	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	192
PID 4088 wrote to memory of 4360	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	196
PID 6432 wrote to memory of 6040	6432	eztrljdbzw.exe	198
PID 4088 wrote to memory of 4172	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	201
PID 4088 wrote to memory of 6680	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	205
PID 6272 wrote to memory of 2036	6272	wqolgdywqo.exe	207
PID 4088 wrote to memory of 5528	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	210
PID 4088 wrote to memory of 4092	4088	2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe	214
PID 3768 wrote to memory of 5872	3768	ifdyvqoiga.exe	216

C:\Users\Admin\AppData\Local\Temp\2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f092b9fdf56ac6eba7a06a75b4ff515a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffe2057c188,0x7ffe2057c194,0x7ffe2057c1a0
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,7546124513963249115,15456195772967728216,262144 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,481709706244979250,18046291860017718296,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
      4⤵
      System Time Discovery
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,5733910794554546747,231524620335326885,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,12630132481850627788,9703975665772191487,2097152 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,4826028834251315585,16252770765623064984,2097152 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,11200414031482818199,15319171166687947744,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3005914562142913989,13257016687786768400,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,6884483659999202364,198166878520768894,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,6884483659999202364,198166878520768894,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,9176321153787186886,10542757347066584989,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
      4⤵
      PID:6824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14067539036778505336,4249363752861759175,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,17395731241926023441,16489630914427126410,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,4723891225461255382,7417502853756133325,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4012,i,16532352243223654602,2729560586917620169,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13969007768693036821,14948516612958728961,524288 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:6600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4996,i,7001087077330831681,9673995855529037734,262144 --field-trial-handle=2224,i,10927534899533625762,10710452194338786033,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrojhezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1784
- - C:\Temp\ywrojhezwr.exe
    C:\Temp\ywrojhezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrojhezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4156
- - C:\Temp\i_ywrojhezwr.exe
    C:\Temp\i_ywrojhezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomjbyto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\bwtomjbyto.exe
    C:\Temp\bwtomjbyto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomjbyto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7100
- - C:\Temp\i_bwtomjbyto.exe
    C:\Temp\i_bwtomjbyto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\olgdywqoig.exe
    C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3276
- - C:\Temp\i_olgdywqoig.exe
    C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\icavsnkida.exe
    C:\Temp\icavsnkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\i_icavsnkida.exe
    C:\Temp\i_icavsnkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqnifaq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Temp\faysqnifaq.exe
    C:\Temp\faysqnifaq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqnifaq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6860
- - C:\Temp\i_faysqnifaq.exe
    C:\Temp\i_faysqnifaq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Temp\pkicausmkf.exe
    C:\Temp\pkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4544
- - C:\Temp\i_pkicausmkf.exe
    C:\Temp\i_pkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2852
- - C:\Temp\fzxusmkecw.exe
    C:\Temp\fzxusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6960
- - C:\Temp\i_fzxusmkecw.exe
    C:\Temp\i_fzxusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2736
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1304
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6520
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5400
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eztrljdbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\eztrljdbzw.exe
    C:\Temp\eztrljdbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eztrljdbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Temp\i_eztrljdbzw.exe
    C:\Temp\i_eztrljdbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6680
- - C:\Temp\wqolgdywqo.exe
    C:\Temp\wqolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5528
- - C:\Temp\i_wqolgdywqo.exe
    C:\Temp\i_wqolgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdyvqoiga.exe ups_run
  2⤵
  PID:4092
- - C:\Temp\ifdyvqoiga.exe
    C:\Temp\ifdyvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdyvqoiga.exe ups_ins
  2⤵
  PID:4292
- - C:\Temp\i_ifdyvqoiga.exe
    C:\Temp\i_ifdyvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdavsqkf.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\nlfdavsqkf.exe
    C:\Temp\nlfdavsqkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdavsqkf.exe ups_ins
  2⤵
  PID:3132
- - C:\Temp\i_nlfdavsqkf.exe
    C:\Temp\i_nlfdavsqkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcaxsqkica.exe ups_run
  2⤵
  PID:2644
- - C:\Temp\fcaxsqkica.exe
    C:\Temp\fcaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcaxsqkica.exe ups_ins
  2⤵
  PID:2344
- - C:\Temp\i_fcaxsqkica.exe
    C:\Temp\i_fcaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupnhfzxu.exe ups_run
  2⤵
  PID:5820
- - C:\Temp\cxupnhfzxu.exe
    C:\Temp\cxupnhfzxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupnhfzxu.exe ups_ins
  2⤵
  PID:2740
- - C:\Temp\i_cxupnhfzxu.exe
    C:\Temp\i_cxupnhfzxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzwurmkecw.exe ups_run
  2⤵
  PID:4152
- - C:\Temp\fzwurmkecw.exe
    C:\Temp\fzwurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzwurmkecw.exe ups_ins
  2⤵
  PID:6712
- - C:\Temp\i_fzwurmkecw.exe
    C:\Temp\i_fzwurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmjh.exe ups_run
  2⤵
  PID:2224
- - C:\Temp\mjhbzurmjh.exe
    C:\Temp\mjhbzurmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:7028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmjh.exe ups_ins
  2⤵
  PID:4644
- - C:\Temp\i_mjhbzurmjh.exe
    C:\Temp\i_mjhbzurmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztromge.exe ups_run
  2⤵
  PID:7108
- - C:\Temp\jhbztromge.exe
    C:\Temp\jhbztromge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztromge.exe ups_ins
  2⤵
  PID:3364
- - C:\Temp\i_jhbztromge.exe
    C:\Temp\i_jhbztromge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igebvtolgd.exe ups_run
  2⤵
  PID:6816
- - C:\Temp\igebvtolgd.exe
    C:\Temp\igebvtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igebvtolgd.exe ups_ins
  2⤵
  PID:6980
- - C:\Temp\i_igebvtolgd.exe
    C:\Temp\i_igebvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  PID:796
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  PID:5812
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6432

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
- Executes dropped EXE
PID:5636

C:\Temp\nljdbvtnlf.sys
C:\Temp\nljdbvtnlf.sys
1⤵
- Executes dropped EXE
PID:2016

C:\Temp\vqoigayvqo.sys
C:\Temp\vqoigayvqo.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\nkidavsqni.sys
C:\Temp\nkidavsqni.sys
1⤵
- Executes dropped EXE
PID:7028

C:\Temp\spkicaxsqk.sys
C:\Temp\spkicaxsqk.sys
1⤵
- Executes dropped EXE
PID:1420

C:\Temp\hfzxrpkhcz.sys
C:\Temp\hfzxrpkhcz.sys
1⤵
- Executes dropped EXE
PID:6748

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Temp\mkebzwuomj.sys
C:\Temp\mkebzwuomj.sys
1⤵
- Executes dropped EXE
PID:6632

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:2672

C:\Temp\wtolgdyvto.sys
C:\Temp\wtolgdyvto.sys
1⤵
- Executes dropped EXE
PID:7132

C:\Temp\vtqoigaytq.sys
C:\Temp\vtqoigaytq.sys
1⤵
PID:6816

C:\Temp\qnigaysqoi.sys
C:\Temp\qnigaysqoi.sys
1⤵
PID:1600

C:\Temp\ifaxvpnkfd.sys
C:\Temp\ifaxvpnkfd.sys
1⤵
PID:2400

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
PID:6824

C:\Temp\mkhczuspnh.sys
C:\Temp\mkhczuspnh.sys
1⤵
PID:6196

C:\Temp\mjhbzurmkh.sys
C:\Temp\mjhbzurmkh.sys
1⤵
PID:1292

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
PID:5032

C:\Temp\jgeywtoljd.sys
C:\Temp\jgeywtoljd.sys
1⤵
PID:2280

C:\Temp\dywqoigbyt.sys
C:\Temp\dywqoigbyt.sys
1⤵
PID:7104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomjbyto.exe

Path C:\Temp\bwtomjbyto.exe
Size 243KB
SHA256 c1d3246e4b0c225956cf0e54e2823d31cc829bd20143b86b4e96576e65226fc4
MD5 5d3485386e182e1b163ab9ce7758567c
SHA1 24ebd4a7709682c5eaa7fc851689e606e180ee79
SHA512 25440f056a6d0291c459332c49380fe677ed266967dc22e062ac0f1fe75d59b2e4c47cc5178d456fa58e81c4e59491773bf7a6ea5dd1872b107aeb1585b454c8
SSDEEP 3072:/VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:NXP7LQMa3lLNngoqRttA7W
TLSH
T1A3345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqnifaq.exe

Path C:\Temp\faysqnifaq.exe
Size 243KB
SHA256 8c4a2562bc1a0488cef8c7338d95e04f376e64a27a12123281f94f142bf50951
MD5 d8c923bf349dcfebb318ec361c5c6b45
SHA1 0cbb681facb0b66c8b30ce845a27b32e7501cafe
SHA512 e0435ad19f0c1c39de6202a9a2ee1e7117ef5e4aa3f30cf59e249cef428ec6911d92c0f54bdc2240d644572c076193a28fe073905d4974fb3da6ad714843fa13
SSDEEP 3072:bVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:pXP7LQMa3lLNngoqRttA7C
TLSH
T184345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxusmkecw.exe

Path C:\Temp\fzxusmkecw.exe
Size 243KB
SHA256 ae6b3812f1c3e5fd3e90426e76a7234f38f6c15f9d173f6422df1e48fe1d23a9
MD5 8785ae98f50af89550e70534b3936093
SHA1 f62cefe0dd3349e917556712a369798d3554f557
SHA512 c614125e61488dfeeac12d932d235d2e252ab9b16fb06bc0c7a080b44ba5cbe4e36ed1059fe8628fad1e573bb93cc635e8c3b124f28fe9487bcd5268469a85be
SSDEEP 3072:9VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:PXP7LQMa3lLNngoqRttA7I
TLSH
T1C7345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpkhcz.sys

Path C:\Temp\hfzxrpkhcz.sys
Size 141KB
SHA256 ea440cea62ccb88832cc6f3c3dbc568088b70b3f93eeb6e40443b150dd277531
MD5 c3d16aba2d2266414cfef927f1c31092
SHA1 bb9d3663614e0b28bd331b197439fc97615c58c5
SHA512 ed6fca2515552b20c0a22ed944b80948de7e480dd3739a1b6834f6529ab91c7b797b6ae3c8ba54216cc118b381ea0208c15e0da20271e7a50f23fb4909f5fcec
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtomjbyto.exe

Path C:\Temp\i_bwtomjbyto.exe
Size 243KB
SHA256 8a9a5b5ee1ccc552236fbba87dce215d887c7d894fc8f7025427f8effe59aab6
MD5 7b09047e38d3c37765a6fa90275616f6
SHA1 6b3d395dfaa529ce9cfb14f87f77889ec0edba8d
SHA512 92951cab1f52a44f1623e60885a23a325b8952f5928fc4c23780290af5719997a06f7adc40bbe09039261e1a277c6699965005281c3766dc1261b59d47db46a2
SSDEEP 3072:rVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:5XP7LQMa3lLNngoqRttA7u
TLSH
T134345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqnifaq.exe

Path C:\Temp\i_faysqnifaq.exe
Size 243KB
SHA256 ed67ce1b83591963c2bfa2737d1ac99e26e6d540810690664a8c6e551267e0d8
MD5 1b5cc8ade54ce7038b9db61892151aaf
SHA1 12a3801b64d4476e982b072e570df3eeb12a8a84
SHA512 a8f4fdfe6a25ebefa5a38e80c8558f0555550d8675c8d7e13704f330a5667679bc5a9781b203ea1fbebb848d01a18208dca0d00a943e120aad53a496c64342b1
SSDEEP 3072:MVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:oXP7LQMa3lLNngoqRttA7N
TLSH
T1F3345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsnkida.exe

Path C:\Temp\i_icavsnkida.exe
Size 243KB
SHA256 ed8c34fe4897f3b6be962ec485f7b6bee19f3273185b72daa17874dc8ac8cc48
MD5 b2d29f71d1e9f4f7f0eb92229749a1a8
SHA1 c0ce13c76d6ed7bb60b144b670b812eaf3603f85
SHA512 dfb3062dbe63857569487e7df2ed6587837af5b68d6d8f80603c8f96d0f1af2b3e1a4ce28573fa7cb30f9f78cca45f8a3b5a9d5bcbda4e2a879bd01f52b54d77
SSDEEP 3072:vVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:9XP7LQMa3lLNngoqRttA7m
TLSH
T13E345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgdywqoig.exe

Path C:\Temp\i_olgdywqoig.exe
Size 243KB
SHA256 565c7434db60527ea09a6b754eac50b289d756c59575126e1267c95170e05e45
MD5 fe974f65f91ddd515d88848a17519456
SHA1 49af6de2da1cd5569019d1faad21e4a4229e61e9
SHA512 22d6082af2eff79ad7f9cf32bf888ba894b4bfb84d31c424ebec07b7eb9115fbf5b9d7bb544d44264f80f3ba7d0ff47894931eaac80bdef1f7769d7073e68f1f
SSDEEP 3072:0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:wXP7LQMa3lLNngoqRttA7V
TLSH
T15B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausmkf.exe

Path C:\Temp\i_pkicausmkf.exe
Size 243KB
SHA256 ff994e2a83d2504ce2507570a7a119942b862a15af858edb6688133787f7dacc
MD5 0aa49bbef5437a194efcb3a2daab20d6
SHA1 3d179e5fc6c50251b145ec395cce696db9a625ef
SHA512 a032faed28bca0f613c9d6b6d2404d8adb1b459e4273a1cb8b127d44b269ed2cd8d8b342049e89adff8a82182fd56f5f8784c5cce1ec672c6d9b02d7e8a0e964
SSDEEP 3072:FVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:XXP7LQMa3lLNngoqRttA7g
TLSH
T199345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywrojhezwr.exe

Path C:\Temp\i_ywrojhezwr.exe
Size 243KB
SHA256 94017eb193948cb3c215b53cd37c4e78eab45f24293c2ebdd301da51670b3498
MD5 fd7f4e2af8607d5beafdf546dc094ad4
SHA1 d46b93115b22ba789c3448a294dbfd882c3a2d10
SHA512 842db65ed00c1d3697d521196d3f53c7661562081d9a23b5d98db2c5db7290afb328dca8c3c55d6b98f1aecc6b8cd41d7d11b3d34522d4d6fb10a4d6dcb3bd94
SSDEEP 3072:5VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:LXP7LQMa3lLNngoqRttA7Y
TLSH
T1B6345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnkida.exe

Path C:\Temp\icavsnkida.exe
Size 243KB
SHA256 01eadb9af71f1c58a9cabe7a016637a95e6154f2965afe5725f76b0057c40043
MD5 0e628a9eb014aab10c3d4cf009a0b39f
SHA1 11a4da16a3cc34e459a00875abf2960dabf9970e
SHA512 9382110ab5bcddf705e25ef2f37d036c05d469d420703333a27bdca6910f190e800af42c88b9002e962c9c1acd1428433cebfda84d122e353500255024b18f9b
SSDEEP 3072:9VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:PXP7LQMa3lLNngoqRttA7w
TLSH
T11F345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.sys

Path C:\Temp\jgbztrljdb.sys
Size 141KB
SHA256 8becb1fa536b5eb5c85bb4444d2fc859c53c6b312c967ef097b2ee604f6b8e6c
MD5 d0c54808a646c2fa07f9a5166a767f15
SHA1 8ff5a42af7c1cc04f4e28b8e76258f472d547b91
SHA512 941b1d1b6ed25f9511e8a90f7e238f3bff053f4744cabd49e9105bd1ab58f5b5cfc2e8e34603fe9dbf57a54bbd0c8b23dd84bd67f997f4817c9afdcc7a0b886a
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T143E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidavsqni.sys

Path C:\Temp\nkidavsqni.sys
Size 141KB
SHA256 e1e412cf5463609064cde23c18acca8f932dcd344b211734a601388397bc44c6
MD5 1e2c00eb7b9258509ae70e650d413931
SHA1 2faa047f6ef234c17a2e839f57956c7b05497f96
SHA512 71cf1743fab9ffc9644aad0364d0f0985729fe596a3388aa643690d2d4a6188a3e28cc70f4faddaaedaebffd52d0eb64897aa259cb801b296973d77de4d5cc1e
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnlf.sys

Path C:\Temp\nljdbvtnlf.sys
Size 141KB
SHA256 e73c0e4595a1677b3a55e179293e4a411fbc7f03655e561a0b642df572fdbbc5
MD5 51862eba295a7936e4c593bbb8ffc784
SHA1 81141d98787d7f85278e6c786da2afe0dcd3d14f
SHA512 17d850ef442cdd98aa1e43c27fcba4f592b90e2140b8f875ccce4fffba2ae536eabeb212c1b350bd6da39e3797e4f3c4967d5b1273f897f72e8f02bc34a810f0
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.exe

Path C:\Temp\olgdywqoig.exe
Size 243KB
SHA256 5de628e66a6383207b77b87cb4dcccb34ae16fbc540785fe4a797163b5802bb8
MD5 3093cb3bf6981d0d89371ddbe2042dbc
SHA1 7e801763e463bd23d014891ae085bb5e67ca574a
SHA512 e5cd0f213d60596a9f68b213c1622542e256c7f5b1ac05c70ee7474f6fa0ff1d325f5c5536f181c8ad6c84ead7a4b0e01de248e9d5b7f51606e8c427c9c2aff8
SSDEEP 3072:KVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:KXP7LQMa3lLNngoqRttA7/
TLSH
T128345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkf.exe

Path C:\Temp\pkicausmkf.exe
Size 243KB
SHA256 d2c0416854a4b7eef83bf95c3b0d571a0bd294513da26b87a814e4ef2ca0471e
MD5 0b83d290e94c257a4d29a3f68af90ef0
SHA1 0f545ce831f018ee105ef1415336c77ce48bd308
SHA512 bbf0c1dd0d0aceaebd31fed4cb63aaf8649064c31785c93e641f196b05ad071b4228131ce2193482a937e6fe2db55105b4359fbab8965e9a0d490052fa73bcbb
SSDEEP 3072:7VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:JXP7LQMa3lLNngoqRttA7q
TLSH
T1F5345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicaxsqk.sys

Path C:\Temp\spkicaxsqk.sys
Size 141KB
SHA256 8751384e6096600d1d1fcf32123f3e9dae86c8c5df047a5503591b9659d28f2e
MD5 20f90a00a0067ee87580dc04b88eca7a
SHA1 661bf5240780b6ef7b948fc9313afc2ccd378c70
SHA512 9443d46efd2603c809dba5bda961aaf2a09fa570058b1895143b15a72c54a43b5d3085c2359ef019d4afc97e7529eaa8e56d6e37848ef760faea89822504cf2e
SSDEEP 1536:6a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:6a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigayvqo.sys

Path C:\Temp\vqoigayvqo.sys
Size 141KB
SHA256 d2be500d036687a3cd2e28c3d418d5ab40e85dffc697a778c6d4370d516a0c99
MD5 5e25194234804606d0931816a37025c5
SHA1 051a866d4c3b5d3c6449d6e289269477d2363152
SHA512 903d854f0e91716128c3e1114e986b989d5e6b818f7e9a4ecef550e85bc89040867007f1a2d96759ef30f21b89f1498edd38c21171100e43d106dc435c40b9b4
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhezwr.exe

Path C:\Temp\ywrojhezwr.exe
Size 243KB
SHA256 8b19278683336d6815a88cb1acad567473648382e7eb63259cdbe4f4ab0a99d7
MD5 d96fe3e420cae41ab4414286d5e567ab
SHA1 46c44b539e3d17456e680dc6d2dc246ab533661d
SHA512 3e5cdb9800768322db7b8c87261257f430b1347ee145f8965f7c34ea5d837a3462d7dc04c79f6758cda5e18300b4b0ee1e0ac9a915c3c57c56fbc72ff8f351d6
SSDEEP 3072:1VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:HXP7LQMa3lLNngoqRttA7k
TLSH
T143345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 cc474c53569dbb73b1743bfe9e770dd1450608b34d633993ed98ef34cc767bf5
MD5 2f43ccb3e1f2b894066f25f0eb75a638
SHA1 ded423f4b248eb2166f3c88529215e77fedffe50
SHA512 7d47a51d35045a4ea2eef50cb1f1d0ddf6180748e9fa306689d2682b467ccaf47cd5fe8112a80db26c507fa6dc7317eb57df8900a94dc9bd507d15e4506f359d
TLSH
T16FF02DA5C921BC3719FC1B1C70541B47E750135B3B41995B7B3C921C4FF463B4A4681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 22893b8025848493f7ea05cfa8910ec8a86b8d370e99618bb68b151709174911
MD5 0b813a1916f24869a76d263729d3608d
SHA1 9952e2436bd759734f187ad9d81c42d3f1776e0a
SHA512 ddf9bb3a7ae8f01e77eee45d480f8f243dcf6abd68f1a96df40ea88c10b318f739897048c8e54be4cd92074821f5eb1f8585af2a5ad8b960fb0cc5ef4249734d
TLSH
T15351CFF783E8856DD90156F0EA187E1BCE2D0914832C3D5AC9E4AF1B93E3471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5ebfbc7a687c5f0ce44ef4cd7ca3c2bfe6211d7ab563a6a56713a6d040214ae6
MD5 46cdb376a39efd8aea88ecd31cb5bf96
SHA1 dcc505a9203df79c972a0c9c5a6e90e198ea21b9
SHA512 6a31d485f5a15098e9890b29e89a952478fcc653601beb7acd1596ad396da41cb303c95e606adfb3fd40292544ef0acc8edbb23ff0885503c8db50b64db07431
SSDEEP 384:sxR1uc8w/fpsYPN/RI9u3/5N/WWysGQmj1:sUZw/ffFWw/5xWWysGQe
TLSH
T1CB72D815AA649D3BCCCBD20DFA957F53D7F81173A1905E44AAFC9A0C40E66ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bb06b94cac5316f08d1713202acb64b96c5de2ab299e4944ba969f1b8e10c4df
MD5 ce86b130e231744d7351ded113161eef
SHA1 9b9807435cb6189edce49f649394818cbfbf40c0
SHA512 e4559a51d39dfdb02a9ce164abfc9fc46e2ab279e7fc99229252d616fb8e8f3efd6cf8bec7e26cf64068a60a47366622ee8248bba06a69dcc7ddfc7255bac578
SSDEEP 384:sxR1ucq+w/fpsF1VIN/RI9u3/5N/WWesGQmf0:sUr+w/f0VSWw/5xWWesGQB
TLSH
T17C72E715AA649D3BCDCBD21DFA967F93D3F8117391905E44AAFC9A0C00E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5f1392bdd089d357c049f2575994e3a01d4c40c33e69c65064565d6cf28a9680
MD5 50fd56fc775f2f2ce2cbb84563880b5e
SHA1 ed2d1981d74af4e7a415e42b8c15eb70be16ada7
SHA512 ca69572500c3692dcc570f702711efd78902d63e98fe43651b3a84d4fbd78e08c43cfae69df81f45f26ae33ec5ecf1c82e2c92c5e55e4a091b099a308f9b9d52
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhobbDwzrok4O:Ob4YZnE7yTWg1NfwBu1jaKobHwArO
TLSH
T19FE2EC3B280CCB7E4F804ADDEC29BD9B6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 515e92bd7843386948d52d0e3922b842f71cf81babb0ab55963d998516fc6d3e
MD5 ad3d867d9be20f3587e3b8e4d65c55e0
SHA1 0b4ae1df353f3e3a86434972dc544a320cdf65b3
SHA512 76f5950dd386a7f89664cd8c3b73f8b872b21a8d971367f17b9501bcfcd87033b3211127cc1e428f17fe5e27ab23513a0a635d864d28c8b467b2bd7f18c5aae9
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EwtWSI+uxKbOq80B4jQozKONrU+:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDR1
TLSH
T14AB25051713F4280387EB50C9178986F86C2B4637519E53F7BA802A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9fb0421159ab67a1496bf6cfe36fff0ce0a28717dc86cccc34d090c43c8df6e1
MD5 ffab972a250aba5e99cb03f871d0e23f
SHA1 eb25e781ff86448d90ca2d699c8b6b27de6cb475
SHA512 a1aad712a618e24bd828c5c2d7a378a99b590660750aee92a9e5c889465e876a3fcb49e5289d4b15f3077d2133461c6765bd33988ef44069082657c9a5f3e3b3
SSDEEP 768:esF1j+9iQkwg7uSVGO5deCxTUnewBKZOw0C:eB9iQguEm7nevZL5
TLSH
T183D25B36D869CEB7ECEA4FD8B70A7A4BDEE451A3848859D8EAC95D0C00C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6b96d8f36eaff20e524aa3c6c83e8608fbbb43e3cae6830efecd72a47c4c47eb
MD5 dbd4cc7bf156e798b2bbd93e06767f27
SHA1 4a304fab5ad44fd879fc0ed9d00ea4e418937ffd
SHA512 4e96b7b82f62bccd8c5db9836e00a56358a40215660010523ec25a893387eb13274cbd5323297d3fcaf62e58608fb5001d120faa64ee65ad3e5b8781eaca13e9
SSDEEP 384:nkiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTuyREqfbYGO5GMeIL7OObjI9G6w7cd83:/F1j+9SXNwgUuPUGO5deW729MH
TLSH
T14FC25B36E855CEB7EDE64FD9B70A7A1AEEE05267849C59C8EAC85D0C00C71ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3a1b363b15905a09c6c5ed6d5b6917bfcec0ab52d84a7dea60af87c262c084d6
MD5 d084cba041013de62e598eedc28dfe14
SHA1 109a567e02b10031e30a9c8216f8677052dfae3e
SHA512 5e35891355fa64c143d5389894992990d9c5c42f7c437bf166fa766e3d2bb3c8308e525809a0e54e9ba724abe8cdc51750ddbeeb719d5e91b9e8ec7acd57b00b
SSDEEP 768:hF1j+9SQkwg7uJVGO5deCxzUnewBKZOw0C:g9SQgubmxnevZL5
TLSH
T13CD26C36D869CEB7ECEA4FD8B70A7A4BDEE451A3849859D8EAC95D0C00C71DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 04573015eb8afcbd75b29e3585a29f82801f45cccaf1b75ce86475860cdee7bf
MD5 b5fba101f981fc354f040b26a4ef4ab1
SHA1 e470978d0593a6ab1e23a299b4af2344d7aa7951
SHA512 c49f1899e48d5e3af7f4102ebea7b90ff2873abe22c8b35ce38378f7a819d2ddc2abba4745b5684e0a890e77235c225585bce46cbe864233c48312d34acbf25a
SSDEEP 384:neliFiZcIED8NLk8TUNTUlIRfPvuTCdyEqfbYGO5GMeCZrhCUnTKwBODNZOCR0e/:esFQcQkwg1uYVGO5deCxoUnewBKZOw00
TLSH
T1A0E2C2F198D78977D89E4B8BA73D6D468AFCD163B4884994B7C85D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 bfb8fe19f817e40e777709b88f7bd91e80a98cc533217203c96e529b237f2fbe
MD5 2de4452a53ab4d9594cf8b7ef15f5931
SHA1 729f4e2d3d541bbc83994d954591340695d1a4e7
SHA512 fdeb8066a7a6362582660b6b145faa601291ef141658ae17e64fe48de18f25a8150eaed7e61804d3aaf810c86dcbdfc8ea75730a813b2f36dde8b8988d5be59c
SSDEEP 384:neliFiZcIxD8NLk8TUNTUlIRfPvuTCDyEqfbYGO5GMeCZrqiUnTKwBODNZOCR0e/:esFQ1Qkwg1uSVGO5deCxTUnewBKZOw00
TLSH
T176D25B32D868CDB7ECEA8FC9B60A7A47DEE45163C4989AD8E6D95E0C00871DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1292-582-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1420-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1420-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2016-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2280-593-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2372-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2400-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2672-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5032-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5032-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5636-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6196-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6632-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6748-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6816-545-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6824-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7028-351-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7104-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7132-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download