d3f788290065570250262b252f116d2a0cbd40b5142df242de642aab5428a0dc

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe
Size 243KB
Sample260803-adj9nahk91
SHA256 d3f788290065570250262b252f116d2a0cbd40b5142df242de642aab5428a0dc
MD5 87c91f02786e16204deecd622f10e028
SHA1 4afec4aa1a49eabb302817c089fd8591a5bcd16f
SHA512 379df3f4d7a0861a52631ccfb896632bacec949756e8d3c4014410a6622451630122ff18028221306d32366b4f17ba254a6d8247d4a34b787e5c3d64bd8b376a
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:2vMsLaOa3lLNngoqRttA7Z
TLSH
T17B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4608	CP.exe
3256	ztrmgeulje.exe
3216	CP.exe
5624	CP.exe
1016	i_ztrmgeulje.exe
4532	eywqojgbyw.sys
4568	CP.exe
2904	tolgeytrlj.exe
3976	CP.exe
5640	CP.exe
1972	i_tolgeytrlj.exe
1716	bwtoljdbvt.sys
1084	CP.exe
4124	qlidbytqlj.exe
4728	CP.exe
4960	CP.exe
4084	i_qlidbytqlj.exe
244	CP.exe
1276	idavtnlavt.exe
1672	CP.exe
2032	CP.exe
1016	i_idavtnlavt.exe
4840	avsqkigays.sys
3392	CP.exe
5824	qnlfdxvqni.exe
4136	CP.exe
2828	CP.exe
3248	i_qnlfdxvqni.exe
4484	pnkfdxvpnh.sys
6000	CP.exe
5304	pkicausnkf.exe
2872	CP.exe
3320	CP.exe
3632	i_pkicausnkf.exe
3660	kicausmcxu.sys
4820	CP.exe
5860	cwuspkhfzx.exe
5288	CP.exe
3816	CP.exe
4520	i_cwuspkhfzx.exe
3396	eczxupmhec.sys
4828	CP.exe
3972	czusmkeuom.exe
2296	CP.exe
4984	CP.exe
704	i_czusmkeuom.exe
3872	ezxrpjhbzx.sys
5844	CP.exe
4120	trmjecwurm.exe
4596	CP.exe
5324	CP.exe
4932	i_trmjecwurm.exe
2956	mgebwtrojg.sys
3612	CP.exe
6140	jdbztrljeb.exe
5976	CP.exe
5064	CP.exe
4368	i_jdbztrljeb.exe
2704	tomgeywroj.sys
6048	CP.exe
4744	igeytrligb.exe
3608	CP.exe
4180	CP.exe
3508	i_igeytrligb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_134112782\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2424_742465875\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_134112782\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_436144759\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1250872540\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_436144759\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1250872540\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_1250872540\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2424_890259583\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgaywqojdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omheywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeytrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeytrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnhfaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmgeulje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmgeulje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnhfaxsqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgaywqojdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omheywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5316	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5740	ipconfig.exe
4768	ipconfig.exe
5424	ipconfig.exe
5864	ipconfig.exe
2956	ipconfig.exe
4772	ipconfig.exe
4988	ipconfig.exe
6096	ipconfig.exe
3236	ipconfig.exe
5428	ipconfig.exe
5744	ipconfig.exe
2496	ipconfig.exe
4860	ipconfig.exe
5424	ipconfig.exe
4792	ipconfig.exe
5060	ipconfig.exe
3508	ipconfig.exe
3388	ipconfig.exe
2956	ipconfig.exe
2956	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301891565414740"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{0D4E8D3E-819B-4597-8C8B-CFF51A6CE45A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5828	msedge.exe
5828	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	i_ztrmgeulje.exe
Token: SeDebugPrivilege	1972	i_tolgeytrlj.exe
Token: SeDebugPrivilege	1016	i_idavtnlavt.exe
Token: SeDebugPrivilege	3248	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	3632	i_pkicausnkf.exe
Token: SeDebugPrivilege	4520	i_cwuspkhfzx.exe
Token: SeDebugPrivilege	704	i_czusmkeuom.exe
Token: SeDebugPrivilege	4932	i_trmjecwurm.exe
Token: SeDebugPrivilege	4368	i_jdbztrljeb.exe
Token: SeDebugPrivilege	3508	i_igeytrligb.exe
Token: SeDebugPrivilege	2700	i_jgaywqojdy.exe
Token: SeDebugPrivilege	2744	i_vsqlidavtn.exe
Token: SeDebugPrivilege	3508	i_qnhfaxsqkf.exe
Token: SeDebugPrivilege	5560	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	5528	i_rpnhfzxrpm.exe
Token: SeDebugPrivilege	2268	i_mkhbzurmke.exe
Token: SeDebugPrivilege	1788	i_omheywrojg.exe
Token: SeDebugPrivilege	1060	i_ebztrljgby.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 1616	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	89
PID 1616 wrote to memory of 2424	1616	iexplore.exe	90
PID 2424 wrote to memory of 2628	2424	msedge.exe	91
PID 2424 wrote to memory of 6016	2424	msedge.exe	93
PID 2424 wrote to memory of 5316	2424	msedge.exe	94
PID 2424 wrote to memory of 6016	2424	msedge.exe	93
PID 2424 wrote to memory of 6016	2424	msedge.exe	93
PID 2424 wrote to memory of 1828	2424	msedge.exe	95
PID 2424 wrote to memory of 1828	2424	msedge.exe	95
PID 2424 wrote to memory of 3192	2424	msedge.exe	96
PID 2424 wrote to memory of 3192	2424	msedge.exe	96
PID 2424 wrote to memory of 3192	2424	msedge.exe	96
PID 2424 wrote to memory of 5748	2424	msedge.exe	97
PID 2424 wrote to memory of 5748	2424	msedge.exe	97
PID 2424 wrote to memory of 5748	2424	msedge.exe	97
PID 2424 wrote to memory of 4576	2424	msedge.exe	98
PID 2424 wrote to memory of 4576	2424	msedge.exe	98
PID 2424 wrote to memory of 4576	2424	msedge.exe	98
PID 2424 wrote to memory of 4208	2424	msedge.exe	99
PID 2424 wrote to memory of 4208	2424	msedge.exe	99
PID 2424 wrote to memory of 4208	2424	msedge.exe	99
PID 2424 wrote to memory of 2480	2424	msedge.exe	100
PID 2424 wrote to memory of 2480	2424	msedge.exe	100
PID 5572 wrote to memory of 4608	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	102
PID 2424 wrote to memory of 1492	2424	msedge.exe	104
PID 2424 wrote to memory of 4228	2424	msedge.exe	105
PID 2424 wrote to memory of 1492	2424	msedge.exe	104
PID 2424 wrote to memory of 4228	2424	msedge.exe	105
PID 3256 wrote to memory of 3216	3256	ztrmgeulje.exe	107
PID 2424 wrote to memory of 1536	2424	msedge.exe	111
PID 2424 wrote to memory of 4760	2424	msedge.exe	114
PID 2424 wrote to memory of 4760	2424	msedge.exe	114
PID 2424 wrote to memory of 480	2424	msedge.exe	115
PID 2424 wrote to memory of 480	2424	msedge.exe	115
PID 2424 wrote to memory of 1128	2424	msedge.exe	116
PID 2424 wrote to memory of 1128	2424	msedge.exe	116
PID 2424 wrote to memory of 6008	2424	msedge.exe	117
PID 2424 wrote to memory of 6008	2424	msedge.exe	117
PID 5572 wrote to memory of 5624	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	118
PID 5572 wrote to memory of 4568	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	122
PID 2904 wrote to memory of 3976	2904	tolgeytrlj.exe	124
PID 5572 wrote to memory of 5640	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	127
PID 5572 wrote to memory of 1084	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	131
PID 4124 wrote to memory of 4728	4124	qlidbytqlj.exe	133
PID 5572 wrote to memory of 4960	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	136
PID 5572 wrote to memory of 244	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	138
PID 1276 wrote to memory of 1672	1276	idavtnlavt.exe	140
PID 5572 wrote to memory of 2032	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	144
PID 2424 wrote to memory of 2704	2424	msedge.exe	146
PID 2424 wrote to memory of 3972	2424	msedge.exe	147
PID 2424 wrote to memory of 2052	2424	msedge.exe	148
PID 5572 wrote to memory of 3392	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	151
PID 5824 wrote to memory of 4136	5824	qnlfdxvqni.exe	153
PID 5572 wrote to memory of 2828	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	156
PID 5572 wrote to memory of 6000	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	160
PID 5304 wrote to memory of 2872	5304	pkicausnkf.exe	162
PID 5572 wrote to memory of 3320	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	165
PID 5572 wrote to memory of 4820	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	169
PID 5860 wrote to memory of 5288	5860	cwuspkhfzx.exe	171
PID 5572 wrote to memory of 3816	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	174
PID 5572 wrote to memory of 4828	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	178
PID 3972 wrote to memory of 2296	3972	czusmkeuom.exe	180
PID 5572 wrote to memory of 4984	5572	2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe	183
PID 2424 wrote to memory of 5020	2424	msedge.exe	185

C:\Users\Admin\AppData\Local\Temp\2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_87c91f02786e16204deecd622f10e028_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffba4dfc188,0x7ffba4dfc194,0x7ffba4dfc1a0
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1936,i,3864138919899479282,4697783006044665598,262144 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:2
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,6469608864877963351,16374243424938085681,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:11
      4⤵
      System Time Discovery
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,15705174776565183125,719634869341951445,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:13
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,6492523934764303424,17617321872871873433,2097152 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,5172428179978711521,14628775437513408527,2097152 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1541517909533780090,18407467807052576070,2097152 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,572092577523637493,4148669259729384585,2097152 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2864,i,5441816379930543882,14440274694126351110,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12904324898673733052,16031886512166889631,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,12020315825956081806,9629393877362853280,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,14149891598119169962,3705846106085687657,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,14149891598119169962,3705846106085687657,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16334039733256763931,10983953684649266128,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,4719436652455916637,921198435199075892,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,15624414312408490442,16081998812688801455,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,14069059634719453194,11738114766470706687,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10784382096127765347,10849165747577754563,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7216829921381641402,16248691511823617663,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,12733732248939569824,2216503976698568362,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9559049680570804941,14014617746920311489,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,858985528778046722,14528780233863900764,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:14
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,15738603345851187722,13880963198823310700,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,16410034548431927089,6173003548593737900,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1236,i,6873824562685931750,17018043638574212836,262144 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,650444139670201698,14983344875223840813,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17646113467490338191,14909820838025869399,524288 --field-trial-handle=2800,i,13937870400189284421,17178219754209446397,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmgeulje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4608
- - C:\Temp\ztrmgeulje.exe
    C:\Temp\ztrmgeulje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmgeulje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\i_ztrmgeulje.exe
    C:\Temp\i_ztrmgeulje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeytrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\tolgeytrlj.exe
    C:\Temp\tolgeytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeytrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5640
- - C:\Temp\i_tolgeytrlj.exe
    C:\Temp\i_tolgeytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1084
- - C:\Temp\qlidbytqlj.exe
    C:\Temp\qlidbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_qlidbytqlj.exe
    C:\Temp\i_qlidbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:244
- - C:\Temp\idavtnlavt.exe
    C:\Temp\idavtnlavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2032
- - C:\Temp\i_idavtnlavt.exe
    C:\Temp\i_idavtnlavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\qnlfdxvqni.exe
    C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Temp\i_qnlfdxvqni.exe
    C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6000
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3320
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuspkhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\cwuspkhfzx.exe
    C:\Temp\cwuspkhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuspkhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Temp\i_cwuspkhfzx.exe
    C:\Temp\i_cwuspkhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkeuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\czusmkeuom.exe
    C:\Temp\czusmkeuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkeuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\i_czusmkeuom.exe
    C:\Temp\i_czusmkeuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5844
- - C:\Temp\trmjecwurm.exe
    C:\Temp\trmjecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5324
- - C:\Temp\i_trmjecwurm.exe
    C:\Temp\i_trmjecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbztrljeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\jdbztrljeb.exe
    C:\Temp\jdbztrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbztrljeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\i_jdbztrljeb.exe
    C:\Temp\i_jdbztrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igeytrligb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6048
- - C:\Temp\igeytrligb.exe
    C:\Temp\igeytrligb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igeytrligb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4180
- - C:\Temp\i_igeytrligb.exe
    C:\Temp\i_igeytrligb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgaywqojdy.exe ups_run
  2⤵
  PID:3928
- - C:\Temp\jgaywqojdy.exe
    C:\Temp\jgaywqojdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgaywqojdy.exe ups_ins
  2⤵
  PID:2412
- - C:\Temp\i_jgaywqojdy.exe
    C:\Temp\i_jgaywqojdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqlidavtn.exe ups_run
  2⤵
  PID:4368
- - C:\Temp\vsqlidavtn.exe
    C:\Temp\vsqlidavtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqlidavtn.exe ups_ins
  2⤵
  PID:3364
- - C:\Temp\i_vsqlidavtn.exe
    C:\Temp\i_vsqlidavtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnhfaxsqkf.exe ups_run
  2⤵
  PID:1976
- - C:\Temp\qnhfaxsqkf.exe
    C:\Temp\qnhfaxsqkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnhfaxsqkf.exe ups_ins
  2⤵
  PID:440
- - C:\Temp\i_qnhfaxsqkf.exe
    C:\Temp\i_qnhfaxsqkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  PID:4936
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  PID:4632
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpnhfzxrpm.exe ups_run
  2⤵
  PID:3956
- - C:\Temp\rpnhfzxrpm.exe
    C:\Temp\rpnhfzxrpm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpnhfzxrpm.exe ups_ins
  2⤵
  PID:2880
- - C:\Temp\i_rpnhfzxrpm.exe
    C:\Temp\i_rpnhfzxrpm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhbzurmke.exe ups_run
  2⤵
  PID:956
- - C:\Temp\mkhbzurmke.exe
    C:\Temp\mkhbzurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhbzurmke.exe ups_ins
  2⤵
  PID:1880
- - C:\Temp\i_mkhbzurmke.exe
    C:\Temp\i_mkhbzurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omheywrojg.exe ups_run
  2⤵
  PID:5864
- - C:\Temp\omheywrojg.exe
    C:\Temp\omheywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omheywrojg.exe ups_ins
  2⤵
  PID:1636
- - C:\Temp\i_omheywrojg.exe
    C:\Temp\i_omheywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrljgby.exe ups_run
  2⤵
  PID:2096
- - C:\Temp\ebztrljgby.exe
    C:\Temp\ebztrljgby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrljgby.exe ups_ins
  2⤵
  PID:4352
- - C:\Temp\i_ebztrljgby.exe
    C:\Temp\i_ebztrljgby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run
  2⤵
  PID:4236
- - C:\Temp\ywqoigbytr.exe
    C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2972

C:\Temp\eywqojgbyw.sys
C:\Temp\eywqojgbyw.sys
1⤵
- Executes dropped EXE
PID:4532

C:\Temp\bwtoljdbvt.sys
C:\Temp\bwtoljdbvt.sys
1⤵
- Executes dropped EXE
PID:1716

C:\Temp\avsqkigays.sys
C:\Temp\avsqkigays.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\pnkfdxvpnh.sys
C:\Temp\pnkfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:4484

C:\Temp\kicausmcxu.sys
C:\Temp\kicausmcxu.sys
1⤵
- Executes dropped EXE
PID:3660

C:\Temp\eczxupmhec.sys
C:\Temp\eczxupmhec.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\ezxrpjhbzx.sys
C:\Temp\ezxrpjhbzx.sys
1⤵
- Executes dropped EXE
PID:3872

C:\Temp\mgebwtrojg.sys
C:\Temp\mgebwtrojg.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\tomgeywroj.sys
C:\Temp\tomgeywroj.sys
1⤵
- Executes dropped EXE
PID:2704

C:\Temp\jdbywqolgd.sys
C:\Temp\jdbywqolgd.sys
1⤵
PID:1336

C:\Temp\gayvqoidav.sys
C:\Temp\gayvqoidav.sys
1⤵
PID:2972

C:\Temp\spnifaxsqk.sys
C:\Temp\spnifaxsqk.sys
1⤵
PID:1768

C:\Temp\usnkifzxsp.sys
C:\Temp\usnkifzxsp.sys
1⤵
PID:3796

C:\Temp\xusmhfcxup.sys
C:\Temp\xusmhfcxup.sys
1⤵
PID:4228

C:\Temp\omkeczurpj.sys
C:\Temp\omkeczurpj.sys
1⤵
PID:4412

C:\Temp\omgebwurmj.sys
C:\Temp\omgebwurmj.sys
1⤵
PID:4484

C:\Temp\ojgezwqomg.sys
C:\Temp\ojgezwqomg.sys
1⤵
PID:4276

C:\Temp\dywtoljdbv.sys
C:\Temp\dywtoljdbv.sys
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avsqkigays.sys

Path C:\Temp\avsqkigays.sys
Size 141KB
SHA256 930417770926f561a4e28be29a7af872b1272679f5bff50e2f18a66cfd6a2f6a
MD5 723059f620d7f97e670e134fde6a6f77
SHA1 9b6ae465ad41395592043e1100f1aa95f9d40991
SHA512 1d195a6d808652364fe20dfb3bc2a0b1f67e68aab3ca044867dd7a00ce4e7a37227ca07e240bfcf011f33115b0808964100257782882e1214c1227b6f47990a5
SSDEEP 3072:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb9:ha3lLNngoqRtO
TLSH
T19EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtoljdbvt.sys

Path C:\Temp\bwtoljdbvt.sys
Size 141KB
SHA256 eb8f85c2a49ea923f10b28a696394eb67a764f7c1ff6acde4ddfc2341b428d4f
MD5 c02144238b4c3e69e0e9993147753fa6
SHA1 11a5e7da215d9a2b232e1a1e1c0e94491f8bb2b0
SHA512 4ece6f97b9cccdd30d50c8901dee309d876d4fd48337cd1a4ac22d98462368bdca31dd4be26ef20239283455348b3a907abb098237bfb09e1806d1b74d69dfd5
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbyw.sys

Path C:\Temp\eywqojgbyw.sys
Size 141KB
SHA256 9193dc6efb82a2a0c2a9cb20ba23a71c4891e0b17a9a382c05092bb4c1a9709f
MD5 601dd77d4222aa0f8675bbc3937dcbb6
SHA1 e7a356a7f81902e045a22bf91d4978a2609fee59
SHA512 ceb46472e9edf5722f1a1483c71d990721d74e82b34b3ad79e5ba5ae7822da3da75d01ffa0f5d97178c3507e53c693de4eb2151e4c2da817b3a7b5c07549c9e3
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idavtnlavt.exe

Path C:\Temp\i_idavtnlavt.exe
Size 243KB
SHA256 cdadadb9a794f3e6c2aeb39f18a90322eabd5c0a237f73887154cb183377ac42
MD5 1021134c6fec6c6c9a9fa23eaadeb296
SHA1 8b58d9d5c358805e2c7d4e5cd6a01fb58cfae5cc
SHA512 29757a315e75d1d7b7f09fcb20bfd26dbd7f18ab0a0e7458d01e89d350d73972d07cb898c452e530b955170c91930cfe495e040c2d2b5457f99c4464d1536a40
SSDEEP 3072:qCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:VvMsLaOa3lLNngoqRttA7k
TLSH
T1F9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausnkf.exe

Path C:\Temp\i_pkicausnkf.exe
Size 243KB
SHA256 c41d1cdff0dc3733a2ff7719c9c75c2030304d27c24342df532635cba9fd5dd9
MD5 f5f70c281c0103b7aca6629d67a9934f
SHA1 2fc780389df214f1f0d7b8419cdd8390b7a95d62
SHA512 6aa446de33b6bb35ef3d22437cd02ed90cc9dccb1644f1da8b073681c1c6f83850c2ecb2c58609cc287a4b36792ac8aa9a34be912df668bba86b8eed8f9ea12a
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:vvMsLaOa3lLNngoqRttA7q
TLSH
T1EB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbytqlj.exe

Path C:\Temp\i_qlidbytqlj.exe
Size 243KB
SHA256 6cae9a9e5c0adaf5e37faf64c80bbb7591e87a167264c84f18b59764b1c4e1d9
MD5 62f47fb5bbf259330fe5cb67c4278990
SHA1 e8eb0d33f3fb73be3125f5f20e79e61d9e68cd0b
SHA512 166007f993db0738046fd4a26cfcb8499df613731b0adb949e478e5995cf121f8dab0d861c5534a51f93a4804d4aa6860b667606b688051c810146497d1f5308
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:UvMsLaOa3lLNngoqRttA7L
TLSH
T178345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdxvqni.exe

Path C:\Temp\i_qnlfdxvqni.exe
Size 243KB
SHA256 26f608697bea6e3e49f2b04045f0aa0577759d1bf15c4ac2063b2fb4ba4aecea
MD5 158c5a3780cd1e65f43517c342552612
SHA1 577a02aeb147764384dc3148755d85491919efbd
SHA512 ef668bf2b11dad2277d7e4d7b78727f1487739a060e50a57cfe84c78e0866a2e1e8a362a4e61f47d0fa0be6cbfa19df0f8a059c4732f1a1569fbdb40d137059f
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:fvMsLaOa3lLNngoqRttA7K
TLSH
T17F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeytrlj.exe

Path C:\Temp\i_tolgeytrlj.exe
Size 243KB
SHA256 6b25b91c895f6e720705c09be5b47bf29b7afdc17e3b69f1d55612739c678c95
MD5 c69ac543144f9e7accd21fc327a05ffe
SHA1 f82faf8cb54c00e7895d6bf561db058af2a01d77
SHA512 2bd8786b9183b4020b1000ff38196b6b662270e551eac1f52cb983e3347a32f925ced72ee548e60cd5ddac0131f2b92d4e975007b0aedc3a0575e9af5d983773
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:mvMsLaOa3lLNngoqRttA79
TLSH
T1B0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmgeulje.exe

Path C:\Temp\i_ztrmgeulje.exe
Size 243KB
SHA256 c9f56402bcc71ba3997326ef0408ec07bc0967ace3917ec369038dea8c93c503
MD5 26e38fabc630dea089e5742c5fd77876
SHA1 40922ecc6a99f92685976d7713d2fa7b5977d3bc
SHA512 26535e0cdf407615f8b75d34dede173e0e2910674edbfed2d401a5b035b991ac64bd4a75a062de24ec76eb32e9a3196dbf8df83bc96ce5def41dbe06e634e5e3
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:ZvMsLaOa3lLNngoqRttA78
TLSH
T144345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlavt.exe

Path C:\Temp\idavtnlavt.exe
Size 243KB
SHA256 cdf9be7e4a89243967e9ffcde6b86592c5dbb8cfb10656a66c62a168b9878536
MD5 9b66b5e2aebaf6c8fb6466214380a993
SHA1 973309f9a63e1be14d3d81a94a23bc7553daca9e
SHA512 d420af0a7d0d47c46d4d74e6299047b1d3cb1287dada0328992b6adcb9c9f7596530a473a83a6ba070ef950d7ea181754549828a4ce0fa947017b10a001daa3f
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:avMsLaOa3lLNngoqRttA7x
TLSH
T1FA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmcxu.sys

Path C:\Temp\kicausmcxu.sys
Size 141KB
SHA256 222d07bacc9014eed3f346bb29e607030ee390633f6357c77a6ba354629b153e
MD5 9509f807db80bffd3ed8616b0c78cc12
SHA1 680734df1a800660b411508f6ecd34c7309f963a
SHA512 4db45c6e7a3fbdab60f7dd5975a3e4056192d834a47e9bc4a97fc0737591ed8b5143a882aa414f0a555807cf72e2c5ae249daaa9921b03a96e4c5d87ccff86f8
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T150E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.exe

Path C:\Temp\pkicausnkf.exe
Size 243KB
SHA256 2bccd9fbb509aba095cbbf90aab3e8f2b876d6bd0bba641e7fb5912aab4b36f3
MD5 4b9d0ebf8cd86ed8aabe2c8f9ceccf97
SHA1 585a8be2c082ee5bf34b2b2c83912c5a09ba7554
SHA512 92999faab298e8c6db416959f20c5ab892cf3d4e225b40af3408118ef7d74c3881184400d10f440cac12e094cbe1537b371c450a2242e7a17c199bb3d13b6f90
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:9vMsLaOa3lLNngoqRttA7g
TLSH
T1FA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxvpnh.sys

Path C:\Temp\pnkfdxvpnh.sys
Size 141KB
SHA256 372df6ac034652ba8dea3bfdc922a582f075d63397667c1a10eb064400835aa6
MD5 53a621f4393ff689534de3c90d6009c3
SHA1 3a590a5662926e38cde9e14d0967f420c26f25f9
SHA512 9210feac56298c359de6190bf19126c67f9f72299629d8ae18ac3ff5c32486182fcf4d9fc75cd440b132080f3b0c86468e65da4f39092ad6c57ef0f503c47515
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbytqlj.exe

Path C:\Temp\qlidbytqlj.exe
Size 243KB
SHA256 71ebf5ad15ead79ce9f6c346ca02f15a674e53695d64a6186dede032cb69cd8c
MD5 60265af3142ce4507771a954f7bb3827
SHA1 00532f2dae5a9eb835f37e5c54a4fa0b8c58c240
SHA512 03a7ae99408010a67b0839038b99d661e2299aa73c13e7676b2f3cc98e563dae92acb9580e687a38bfe5b82e26ea2f0974241817789ece31ba8c1ea5675de1de
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:ovMsLaOa3lLNngoqRttA7j
TLSH
T1CD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqni.exe

Path C:\Temp\qnlfdxvqni.exe
Size 243KB
SHA256 bd3a7fddca35e35527a1d77945218c01fe361d7249affc9bedfab54408c433a3
MD5 890e58be861f097073b0c71ea543a32b
SHA1 e7f15f80c4874864974d87f6bab661ab571a2575
SHA512 2fed320416b8ac46e74b243a7862cfc4a83428462babebea884900671517e03fef6e9901274948ae4081bb050fbf22a2771a5a51c658f1792874d62fbb31a9d4
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:mvMsLaOa3lLNngoqRttA7p
TLSH
T1C0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeytrlj.exe

Path C:\Temp\tolgeytrlj.exe
Size 243KB
SHA256 befd4b7e3f7786af0675a05681f31b262510b6d7c5be888ef2d499ff7119c0e6
MD5 105d9218dc2666c44d9549169ceb1465
SHA1 2ea966c9e8f7e7d939bd0e23524d136b6975a3dd
SHA512 bfdbbec24385a39d8f26a8f6f6fa4de78113cd403e66552be11dc60be42801aa0e6552d3e4f3486064e77bf314827f618dfe3be271c7b484cc1573ac4a0eac5a
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:GvMsLaOa3lLNngoqRttA7B
TLSH
T1ED345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmgeulje.exe

Path C:\Temp\ztrmgeulje.exe
Size 243KB
SHA256 db732b82c238b33f2ff11c7c153074c78d560a85cc1a8bb18391ed11775b04b6
MD5 8a58c4f2369a3cc005132f1a6d0baa65
SHA1 02b4843d7a852338a58118e1e33667df1a77e765
SHA512 5d8feffab3c459804126e955ddd857cd8165bd044a03ffdb746325382d16c4cf193cd936718654d3d83a1628d39974829957d960df05debe902513b5eb651276
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:wvMsLaOa3lLNngoqRttA7L
TLSH
T173345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5f037412d579ba0d56ebc88f8593512fc240cb99c191e5cf47e0e66b4a256ac3
MD5 70a79f70c5124b5240a679b5db7cb1b3
SHA1 098a1f4653a21cc8f4a442f70f92be9add5f3699
SHA512 b2b2f553c82db73ca05638e675e70467278a7d8ad22f85c65d70de199fad2271167155afe2c5e9c054f04f53371e38d9b5d445ba8a9dbbd26755a37abc46909b
TLSH
T1A1619258232219F1D33885B2D0FE639CF3F49B69C2C72E649190EE701886FD5AAD0573
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599159.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599159.TMP
Size 3KB
SHA256 b5d65ac727aaaa73b424dc50d282b594e10fff45d26ce5b9361a0a60da90eefa
MD5 5c0139f2985c4150c13dbba8fed9e3ac
SHA1 f5f6261ea17cfa111500c94aec5e8d1284d08eb3
SHA512 e59ec950103776595ed0b6a9b197ff8d742f0872e4848a782d2e34a0bfec32c9066d1f0d8e5970b527290d0d1c84c8dc61c130f3b4c82c77b5065f118e3efee7
TLSH
T1E861A358131229F1D33885B2D0FE639CF3F49B58C2C72E609090ED701886FD5AAD0573
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d531fef4dbcf9c4b7f644614d24757a75777d61aac7b6202ebd4988c6f8230d5
MD5 ede1301a0eb5e8c40d795140c380003b
SHA1 962ba57e81e21d9815ab395667558b1b01b01b96
SHA512 abe1530425878d94929d84996265daacf98c0aff4ede2416936c051a858f364953eb0785574494c255a2f6a1ee9488a9c9d7cdcb55899ef8dc9f26e2e27267e4
TLSH
T10251B0F3C6E8856E890156F4AB147E2BCE2E0919432C3D5AC8E4EF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 272f33a3889867fd5a736fa6e948954fb29d767eae49ba156c8c11d6d7caa79e
MD5 154eca48522317faad7c24a28aeb5cbb
SHA1 e958aba21cc40f96d8a29a375708726e1db914a0
SHA512 49838723e6a3d298dcc32935cdac45f0df64c9e8b07c4f6c1f0056d1e0dc03d857016b4a0c1113afbeec665f21ddae53a2d41d96562244a5554a81ac65e5dad6
SSDEEP 192:sxRqR8CL/fRsXPbRZjNTwzoA8p9n/g6+WNCmn/YZFLsTG2IgV3TIJ:sxRqtL/fRsXPb/jHN/5n/SGi
TLSH
T1AC42DA166928A93B8CC7D21DBB597F53D2F95033A1D46E14B7FC9A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6a28731e1840a80519b1f13de4b5b4ccc2eab46158260ce9688aa6b06d409cab
MD5 9b128ce7abcf3d98a7ab45334e02fadb
SHA1 72f2d49eab3ddd9ab56d6bb81833e45ac0d6d8cb
SHA512 4993ba8ea85a23e34c93fd708948880d0e790d73c7eb9e9e9afc52630364f8b93dd5d577f033d9ec615dfe13f1cedaad148a7d0689e14b6180d1ce09f390be09
SSDEEP 192:sxRRR8CL/fRs+PqRZjNTwzoA8p9n/g6+WNCmn/YZFLdTG2IgDO3TIJ:sxRRtL/fRs+Pq/jHN/5n/SV5
TLSH
T19942D9166928693B8CC7D21DBB59BF53E2F95033A0946E54B7FC9B1C04EB6DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c951f735891c628771245ade3e0747a10021f7753d61ce2fd284f1c7824af47f
MD5 6c5677e396a791619779d69504f3d104
SHA1 4f85a191d4f8a62cfa44732356d36e8201af47e9
SHA512 5d26cd2bb80fbf95c6e66bff7134efab4f59264ef11b32543030110e6e54569d2fa9e9e2afa4351f64f36040c43071608fc995fc2c87979c6703ac3056fa4ba1
SSDEEP 192:sxRRR8CL/fRs+PbRZjNTwzoA8p9n/g6+WNCmn/YZFLsTG2IgDc3TIJ:sxRRtL/fRs+Pb/jHN/5n/SGT
TLSH
T17342E9166928A93B8CC7D21DBB59BF53E2F95033A0946E04B7FC9A1C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ce85f19f4acd76cca1fb9171ab358a6b2f22bf10db918c288e28cbb385c44d87
MD5 fda513e1dbdd6c23ec6e37f1291a4e5b
SHA1 debf59748a4af6916fa3ebdaa550e3bc2c16b90a
SHA512 eef0bafb84699b95165733baf0bc4cdf323bb3bb1eada913c0981f9527f2ace9f07dd3895ac20fe47c2af7eb9ad938590666ade903323363baa4aea9742406e6
SSDEEP 768:K80EVP7pLuLfrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyKowLWeroLZFA:K80EVJEfrwWgNhfVNu1jalKogW1LZFA
TLSH
T1F4D2D97B740DCB7E4F804ADDAC1A7E9A7DA802CB96D8C95047FE841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c47355be-7719-46d5-ba82-a24a51a708a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c47355be-7719-46d5-ba82-a24a51a708a0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b3a74d0ef3e1d1287f5175757a5b0355d2cc4951122845ce6425e7a9ec004d94
MD5 454b8fc8a0786eb534572247e1876b78
SHA1 9133f5292e3dba36cb3801a3dc4bfd7945ab58f5
SHA512 697195c056d6d06e2e0ae3a007615321b21c963ddb552aa345d656afa483efee6b43d90d1235787d2d9cd7cda6b7f99f182f95ff9140c98e2426ba0f64b2f3ec
SSDEEP 768:g93BU+LeSFOUvNt1U0X4fouOToPvB2thtA9VAgjhy6DqK:g93O6snnwthttGT9
TLSH
T147F2B071A4E98D23DCEEE258720E36925FF0502368D45FC86BED5B1D0547AAE1B0FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 eb31a4298e30979f601b56cb02ebe386a68af47e3e58157441a13c3f8377c44c
MD5 2e8e2f789ebd5175c2f598035220088a
SHA1 6c4bf3d7c88ffeae0f43b3b9eaca8c1e368bcc14
SHA512 97f34b6319f82aa2b1a8b667c879f9ff90c92e6bf789dbb969801e7fef640bb0ee24f46b94772a7a0c51ad6a09aa6ea6cd10ac060970ecce3d67344c4521e405
SSDEEP 768:IFQG3Qwgk1l1OUvNt1UUX4fouOToPvB2thtA9VAgjhy6DqK:rG3+asnnwthttGT9
TLSH
T1EC1317F194D78937E8AE9387633D2D429AFCC06374849A84BBD85E1CCC865BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 924792cd5bc74d4af3f04ed43efe9941f86b3fbfc4b188727c33b36e77b16dbc
MD5 fb511a950e4f6bdb874124e536f9b896
SHA1 c6e6b85d1085f38b49a6ef1757c3a89236283a34
SHA512 fb64ddb2d7e8651b8940e62a268858a4cad2604aa2e033ae037cfebc0eb6ab5d24dac995cd42ec5ed58941481cc0fe6a6d199621e7da924055eb82d94e730ade
SSDEEP 768:nrv+4UNbdS3bU+LeSFOUvNt1UGX4fouOToPvB2thtA9VAgj/:nbsbo3QMsnnwthttG/
TLSH
T17103BF72B499DD63DCEAD298720B72837FF4106358C01F84AAD95B4D054B9EE2B0BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2c9ce62707e00e96beb9a3f6d54f0cdb68af7481ecb3e5cbe22de0feef1f5f13
MD5 0bae25d90686b5ad4d73ea95d3349d6b
SHA1 5b0db6d05370940437062eaec88492d635ba758a
SHA512 794a0281ff91150cd1a41b39c9cf18fa7c1f6b8c95a7fb00703535fa50b24e6dcaa673630229d4bd43c5b7a05e9114b60e956e257e3cd001bc047e0da3946194
SSDEEP 768:B93GU+LeSFOUvNt1U0X4fouOToPvB2thtA9VAgjhy6DqK:B93X6snnwthttGT9
TLSH
T140F2B071A4E98D23DCEEE258720E36925FF0502368D45FC8ABDD5B1D0547AAA1B0FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 301fd056188a736ca889852324b7efde06eb70c417febe99dbbbd10a28cd33a3
MD5 b589139c79a9fe9c9e3cdb8ea3abef77
SHA1 85da03cdcbc0f5baba704582ad337edc79af3553
SHA512 a26b7221ecb94a564592ff51feb8edfe426289d0a6371c30040e37407ddcd98e84e55216a05a266f5e894e768cf0b414e6207fe76f8aee0354601b8eda6b9fc0
SSDEEP 768:grv+4UNbdH31k+LeSFOUvNthX4fouOToPvB2thtA9VAwReVH1SlX:gbsbh3tsnnwthttMEH1Y
TLSH
T12503CF32A8AC8A33DCE6D398320B71533FF4915396940BC49EDD2B4D069B9DE130BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

01a0fe68-a3ba-43a7-89cf-537c986ee1d7.tmp

Path C:\Users\Admin\AppData\Local\Temp\01a0fe68-a3ba-43a7-89cf-537c986ee1d7.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2424_1566459690\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1716-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1768-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2972-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3396-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3660-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3872-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4228-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4276-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4412-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4412-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4484-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4484-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4920-725-0x0000000000010000-0x0000000000083000-memory.dmp

Download