a17f754955e9de3ab86d9746c63acebaae8eb42a960623a8f77ba61b2d081da2

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe
Size 243KB
Sample260805-aas3dsae96
SHA256 a17f754955e9de3ab86d9746c63acebaae8eb42a960623a8f77ba61b2d081da2
MD5 fdc90fe6a853a0eae557ec45bbe3991a
SHA1 24c34ed7bb6429e3b86017e172e84560267d8a4b
SHA512 6c974c3db9efa9774bb44d1eef92a04fb1fb973f3d739b1a599ddebd06611baab4bb08bcabde23b56130e191bfb459f20f4c89229c3ab0f730049f416906f2b1
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:HvMsLaOa3lLNngoqRttA7W
TLSH
T17A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3692	CP.exe
1296	wupeztrmge.exe
1156	CP.exe
6036	CP.exe
4748	i_wupeztrmge.exe
1724	rpjhbztrpj.sys
3632	CP.exe
4148	jebzwromge.exe
2128	CP.exe
4140	CP.exe
1492	i_jebzwromge.exe
4760	eywqoigeyw.sys
4724	CP.exe
4812	eywqojdbzt.exe
2072	CP.exe
2480	CP.exe
4856	i_eywqojdbzt.exe
6088	qljdbytqoi.sys
1660	CP.exe
4748	qoigdyvqnl.exe
1828	CP.exe
4296	CP.exe
4580	i_qoigdyvqnl.exe
4532	yvtnlfdyvq.sys
1972	CP.exe
4268	lidavtnlfd.exe
1056	CP.exe
4728	CP.exe
5768	i_lidavtnlfd.exe
2580	sqkidavsqk.sys
1376	CP.exe
1328	snlfdxvpni.exe
1644	CP.exe
5544	CP.exe
936	i_snlfdxvpni.exe
696	vsqnhfcaus.sys
5736	CP.exe
5848	xvpnhfcxvp.exe
3044	CP.exe
3444	CP.exe
4464	i_xvpnhfcxvp.exe
3960	fzxrpkhcxu.sys
3268	CP.exe
6080	ecwusmkecx.exe
2020	CP.exe
1456	CP.exe
5404	i_ecwusmkecx.exe
5168	mhfzxupmhe.sys
4848	CP.exe
1592	zurmkezwrp.exe
4756	CP.exe
3368	CP.exe
4908	i_zurmkezwrp.exe
6056	ztrpjhbzur.sys
5796	CP.exe
708	wuomgezwro.exe
2588	CP.exe
5056	CP.exe
5852	i_wuomgezwro.exe
6060	wromgeywro.sys
6076	CP.exe
5768	omgeywqojg.exe
2580	CP.exe
1104	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_132972938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_132972938\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_2035962814\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_2035962814\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1276_143511318\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_1307801364\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_1307801364\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_2035962814\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_2035962814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1276_812650298\_locales\eu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaysqolfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupeztrmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavtnlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdyvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaysqolfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupeztrmge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdyvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavtnlga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3440	ipconfig.exe
5168	ipconfig.exe
4136	ipconfig.exe
1448	ipconfig.exe
5460	ipconfig.exe
2312	ipconfig.exe
4068	ipconfig.exe
6012	ipconfig.exe
4500	ipconfig.exe
5168	ipconfig.exe
5344	ipconfig.exe
4760	ipconfig.exe
6116	ipconfig.exe
5196	ipconfig.exe
700	ipconfig.exe
5168	ipconfig.exe
4716	ipconfig.exe
4140	ipconfig.exe
5652	ipconfig.exe
4776	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303616669317798"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{0EB484E3-BCAA-4793-9D2B-EC38B88FECAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4748	i_wupeztrmge.exe
Token: SeDebugPrivilege	1492	i_jebzwromge.exe
Token: SeDebugPrivilege	4856	i_eywqojdbzt.exe
Token: SeDebugPrivilege	4580	i_qoigdyvqnl.exe
Token: SeDebugPrivilege	5768	i_lidavtnlfd.exe
Token: SeDebugPrivilege	936	i_snlfdxvpni.exe
Token: SeDebugPrivilege	4464	i_xvpnhfcxvp.exe
Token: SeDebugPrivilege	5404	i_ecwusmkecx.exe
Token: SeDebugPrivilege	4908	i_zurmkezwrp.exe
Token: SeDebugPrivilege	5852	i_wuomgezwro.exe
Token: SeDebugPrivilege	936	i_omgeywqojg.exe
Token: SeDebugPrivilege	1652	i_davtqolgdb.exe
Token: SeDebugPrivilege	4216	i_idaysqolfd.exe
Token: SeDebugPrivilege	5652	i_lidavtnlga.exe
Token: SeDebugPrivilege	4136	i_kfcausqnlf.exe
Token: SeDebugPrivilege	2344	i_uspkicausm.exe
Token: SeDebugPrivilege	4276	i_mkhcwupmhf.exe
Token: SeDebugPrivilege	4464	i_zwurmkecwu.exe
Token: SeDebugPrivilege	260	i_ezwrmjebwu.exe
Token: SeDebugPrivilege	2484	i_eywqoljgbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3624	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	88
PID 3624 wrote to memory of 1276	3624	iexplore.exe	90
PID 1276 wrote to memory of 4440	1276	msedge.exe	91
PID 1276 wrote to memory of 2012	1276	msedge.exe	92
PID 1276 wrote to memory of 5996	1276	msedge.exe	93
PID 1276 wrote to memory of 2012	1276	msedge.exe	92
PID 1276 wrote to memory of 2012	1276	msedge.exe	92
PID 1276 wrote to memory of 4556	1276	msedge.exe	94
PID 1276 wrote to memory of 4556	1276	msedge.exe	94
PID 1276 wrote to memory of 1644	1276	msedge.exe	95
PID 1276 wrote to memory of 1644	1276	msedge.exe	95
PID 1276 wrote to memory of 5308	1276	msedge.exe	96
PID 1276 wrote to memory of 1644	1276	msedge.exe	95
PID 1276 wrote to memory of 5308	1276	msedge.exe	96
PID 1276 wrote to memory of 5308	1276	msedge.exe	96
PID 1276 wrote to memory of 5412	1276	msedge.exe	98
PID 1276 wrote to memory of 4960	1276	msedge.exe	99
PID 1276 wrote to memory of 5412	1276	msedge.exe	98
PID 1276 wrote to memory of 5412	1276	msedge.exe	98
PID 1276 wrote to memory of 4960	1276	msedge.exe	99
PID 1276 wrote to memory of 4960	1276	msedge.exe	99
PID 1276 wrote to memory of 2016	1276	msedge.exe	100
PID 1276 wrote to memory of 2016	1276	msedge.exe	100
PID 1276 wrote to memory of 1608	1276	msedge.exe	102
PID 1276 wrote to memory of 1496	1276	msedge.exe	103
PID 1276 wrote to memory of 1608	1276	msedge.exe	102
PID 1276 wrote to memory of 1496	1276	msedge.exe	103
PID 2688 wrote to memory of 3692	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	104
PID 1276 wrote to memory of 2588	1276	msedge.exe	107
PID 1296 wrote to memory of 1156	1296	wupeztrmge.exe	109
PID 1276 wrote to memory of 3044	1276	msedge.exe	112
PID 1276 wrote to memory of 3044	1276	msedge.exe	112
PID 1276 wrote to memory of 5016	1276	msedge.exe	113
PID 1276 wrote to memory of 5016	1276	msedge.exe	113
PID 1276 wrote to memory of 4068	1276	msedge.exe	116
PID 1276 wrote to memory of 4068	1276	msedge.exe	116
PID 1276 wrote to memory of 4800	1276	msedge.exe	117
PID 1276 wrote to memory of 4800	1276	msedge.exe	117
PID 2688 wrote to memory of 6036	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	118
PID 2688 wrote to memory of 3632	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	122
PID 4148 wrote to memory of 2128	4148	jebzwromge.exe	124
PID 2688 wrote to memory of 4140	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	127
PID 2688 wrote to memory of 4724	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	131
PID 4812 wrote to memory of 2072	4812	eywqojdbzt.exe	133
PID 2688 wrote to memory of 2480	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	136
PID 2688 wrote to memory of 1660	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	140
PID 4748 wrote to memory of 1828	4748	qoigdyvqnl.exe	142
PID 2688 wrote to memory of 4296	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	145
PID 1276 wrote to memory of 1876	1276	msedge.exe	148
PID 1276 wrote to memory of 1588	1276	msedge.exe	149
PID 1276 wrote to memory of 5284	1276	msedge.exe	150
PID 2688 wrote to memory of 1972	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	153
PID 4268 wrote to memory of 1056	4268	lidavtnlfd.exe	155
PID 2688 wrote to memory of 4728	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	158
PID 2688 wrote to memory of 1376	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	162
PID 1328 wrote to memory of 1644	1328	snlfdxvpni.exe	164
PID 2688 wrote to memory of 5544	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	167
PID 2688 wrote to memory of 5736	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	171
PID 5848 wrote to memory of 3044	5848	xvpnhfcxvp.exe	173
PID 2688 wrote to memory of 3444	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	176
PID 2688 wrote to memory of 3268	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	180
PID 6080 wrote to memory of 2020	6080	ecwusmkecx.exe	182
PID 2688 wrote to memory of 1456	2688	2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe	185
PID 1276 wrote to memory of 4760	1276	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdc90fe6a853a0eae557ec45bbe3991a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x33c,0x7ffab109c188,0x7ffab109c194,0x7ffab109c1a0
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,16918861524813782086,1069287101432844944,262144 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1736,i,6015670430056665279,3858972972800821628,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
      4⤵
      System Time Discovery
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,3151128637700806346,10683418291561881599,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:13
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,2793156008374556240,12480289736315088819,2097152 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,386642839306844572,9551944501776720352,2097152 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,15512803094359415955,147550867185928774,2097152 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,13296004172243961045,17909430772979079565,2097152 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13051011683908748607,5562218567572674205,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,2683135754852139824,1398852128172043121,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14458206616154232661,1757984414055192464,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1045823489576643623,674224989585779086,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1045823489576643623,674224989585779086,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,9600417551824539573,8096768314315078552,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,12749141702446591956,8184307943618810669,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,16829012412274174973,16991423430537314815,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,8947013348730082576,7799134106717523991,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8128174260365128999,9409257789300367183,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,1947821290896094385,6239608340230918647,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,13602658226957408121,15099445468164087732,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,5181748388767537947,17076819600110467267,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,16299178590627713951,4703208867826970526,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,12245222948487680295,1442731623306217784,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,8072799279603613479,15734648831460421501,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6948,i,4992771488414917273,10729664295670855215,262144 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,6636533732564492398,11152318902997424184,524288 --field-trial-handle=2180,i,5331630737472796998,9099080954104715588,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupeztrmge.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3692
- - C:\Temp\wupeztrmge.exe
    C:\Temp\wupeztrmge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupeztrmge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6036
- - C:\Temp\i_wupeztrmge.exe
    C:\Temp\i_wupeztrmge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebzwromge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3632
- - C:\Temp\jebzwromge.exe
    C:\Temp\jebzwromge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebzwromge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\i_jebzwromge.exe
    C:\Temp\i_jebzwromge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojdbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\eywqojdbzt.exe
    C:\Temp\eywqojdbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojdbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2480
- - C:\Temp\i_eywqojdbzt.exe
    C:\Temp\i_eywqojdbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdyvqnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\qoigdyvqnl.exe
    C:\Temp\qoigdyvqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigdyvqnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\i_qoigdyvqnl.exe
    C:\Temp\i_qoigdyvqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Temp\lidavtnlfd.exe
    C:\Temp\lidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Temp\i_lidavtnlfd.exe
    C:\Temp\i_lidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1376
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfcxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5736
- - C:\Temp\xvpnhfcxvp.exe
    C:\Temp\xvpnhfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfcxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\i_xvpnhfcxvp.exe
    C:\Temp\i_xvpnhfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwusmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3268
- - C:\Temp\ecwusmkecx.exe
    C:\Temp\ecwusmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwusmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1456
- - C:\Temp\i_ecwusmkecx.exe
    C:\Temp\i_ecwusmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkezwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\zurmkezwrp.exe
    C:\Temp\zurmkezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkezwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3368
- - C:\Temp\i_zurmkezwrp.exe
    C:\Temp\i_zurmkezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgezwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5796
- - C:\Temp\wuomgezwro.exe
    C:\Temp\wuomgezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgezwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\i_wuomgezwro.exe
    C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1104
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtqolgdb.exe ups_run
  2⤵
  PID:6056
- - C:\Temp\davtqolgdb.exe
    C:\Temp\davtqolgdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtqolgdb.exe ups_ins
  2⤵
  PID:1228
- - C:\Temp\i_davtqolgdb.exe
    C:\Temp\i_davtqolgdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaysqolfd.exe ups_run
  2⤵
  PID:3308
- - C:\Temp\idaysqolfd.exe
    C:\Temp\idaysqolfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaysqolfd.exe ups_ins
  2⤵
  PID:4832
- - C:\Temp\i_idaysqolfd.exe
    C:\Temp\i_idaysqolfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavtnlga.exe ups_run
  2⤵
  PID:5116
- - C:\Temp\lidavtnlga.exe
    C:\Temp\lidavtnlga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavtnlga.exe ups_ins
  2⤵
  PID:4132
- - C:\Temp\i_lidavtnlga.exe
    C:\Temp\i_lidavtnlga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausqnlf.exe ups_run
  2⤵
  PID:2756
- - C:\Temp\kfcausqnlf.exe
    C:\Temp\kfcausqnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausqnlf.exe ups_ins
  2⤵
  PID:3192
- - C:\Temp\i_kfcausqnlf.exe
    C:\Temp\i_kfcausqnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkicausm.exe ups_run
  2⤵
  PID:5604
- - C:\Temp\uspkicausm.exe
    C:\Temp\uspkicausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkicausm.exe ups_ins
  2⤵
  PID:5264
- - C:\Temp\i_uspkicausm.exe
    C:\Temp\i_uspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcwupmhf.exe ups_run
  2⤵
  PID:1072
- - C:\Temp\mkhcwupmhf.exe
    C:\Temp\mkhcwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcwupmhf.exe ups_ins
  2⤵
  PID:4988
- - C:\Temp\i_mkhcwupmhf.exe
    C:\Temp\i_mkhcwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwurmkecwu.exe ups_run
  2⤵
  PID:4844
- - C:\Temp\zwurmkecwu.exe
    C:\Temp\zwurmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwurmkecwu.exe ups_ins
  2⤵
  PID:1876
- - C:\Temp\i_zwurmkecwu.exe
    C:\Temp\i_zwurmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrmjebwu.exe ups_run
  2⤵
  PID:4732
- - C:\Temp\ezwrmjebwu.exe
    C:\Temp\ezwrmjebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrmjebwu.exe ups_ins
  2⤵
  PID:716
- - C:\Temp\i_ezwrmjebwu.exe
    C:\Temp\i_ezwrmjebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoljgbz.exe ups_run
  2⤵
  PID:1568
- - C:\Temp\eywqoljgbz.exe
    C:\Temp\eywqoljgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoljgbz.exe ups_ins
  2⤵
  PID:3460
- - C:\Temp\i_eywqoljgbz.exe
    C:\Temp\i_eywqoljgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2344

C:\Temp\rpjhbztrpj.sys
C:\Temp\rpjhbztrpj.sys
1⤵
- Executes dropped EXE
PID:1724

C:\Temp\eywqoigeyw.sys
C:\Temp\eywqoigeyw.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\qljdbytqoi.sys
C:\Temp\qljdbytqoi.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\yvtnlfdyvq.sys
C:\Temp\yvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:4532

C:\Temp\sqkidavsqk.sys
C:\Temp\sqkidavsqk.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\vsqnhfcaus.sys
C:\Temp\vsqnhfcaus.sys
1⤵
- Executes dropped EXE
PID:696

C:\Temp\fzxrpkhcxu.sys
C:\Temp\fzxrpkhcxu.sys
1⤵
- Executes dropped EXE
PID:3960

C:\Temp\mhfzxupmhe.sys
C:\Temp\mhfzxupmhe.sys
1⤵
- Executes dropped EXE
PID:5168

C:\Temp\ztrpjhbzur.sys
C:\Temp\ztrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\wromgeywro.sys
C:\Temp\wromgeywro.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:4844

C:\Temp\nljdbywqol.sys
C:\Temp\nljdbywqol.sys
1⤵
PID:6060

C:\Temp\qnlfaysqki.sys
C:\Temp\qnlfaysqki.sys
1⤵
PID:3416

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
PID:1680

C:\Temp\rpnhfcausp.sys
C:\Temp\rpnhfcausp.sys
1⤵
PID:3744

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
PID:2872

C:\Temp\zxrpjhecwu.sys
C:\Temp\zxrpjhecwu.sys
1⤵
PID:4100

C:\Temp\ebzwrpjhbz.sys
C:\Temp\ebzwrpjhbz.sys
1⤵
PID:5772

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoigeyw.sys

Path C:\Temp\eywqoigeyw.sys
Size 141KB
SHA256 4d50e0df2cf31d212b4ee0833ce695eb0c005fd9cde6a5a2f0d9e0249c989db0
MD5 c643531405d50630031199a409dd91ed
SHA1 f52d3064269aa2cb6e8f40d5235be384b1766e1c
SHA512 5ce35ca18afc299e6c9dc562a327da96ad0363942146d193f709c26ff2e8090e0daf89e586adc10d668db16f0a66caf468485e912518f5897ae223cc0ff360fc
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T108E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojdbzt.exe

Path C:\Temp\eywqojdbzt.exe
Size 243KB
SHA256 baeaf19aa80e1d4dca087176f5bfd6c7cdf45d31060cc253a472575424568b0a
MD5 df87f766d11c60366d12dc3bda7bb604
SHA1 bb29b44cf79b0aa2ff9b306141e8a7d4e2f8d2ea
SHA512 1e5b030a78a3893a9abccd360c614751e951a5770ce43913ad1bd1d78e09d94da4bb5e850542e7e01bf7afb86f512c6825810b725d0afc72b5a1891dea935f1d
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:evMsLaOa3lLNngoqRttA7t
TLSH
T13B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqojdbzt.exe

Path C:\Temp\i_eywqojdbzt.exe
Size 243KB
SHA256 f68f92d1f1d446ab4c82b89b80467e61ea7bd38d189ad257b9820bae4d1aa176
MD5 a5948e4bf82bbb0b3c42d127829b9914
SHA1 98f22cb622d7bb08860aa5aa78feec6f7022a8c6
SHA512 f06ef0606965d40c75c3be1b6e13ca31ccc7a15513764ff6a7b43e0e33afe06fdfc0c85e95c06bf1c327dd37dcc27356667331b1f71bce518e6ada37e2efb2f9
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:svMsLaOa3lLNngoqRttA7/
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebzwromge.exe

Path C:\Temp\i_jebzwromge.exe
Size 243KB
SHA256 708b89372052e32a5bcf1a0cadd0167d24fbd0c8610f6ecca6320a8153797686
MD5 88bdc150ed2fb98114c697dd3f6b0177
SHA1 837d80edbe65a04c36656aaa8547568546d81efb
SHA512 3f8fdb9ac89fa4237976445c2de69f4445652f9deb05e7378fa09fbe12281533be9d0401e646275a07c86478828f64ff83c145ae388b43cacc2033c8222dada5
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:4vMsLaOa3lLNngoqRttA7n
TLSH
T127345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidavtnlfd.exe

Path C:\Temp\i_lidavtnlfd.exe
Size 243KB
SHA256 cc018be4127aeddbf8b74d0ed682055199f19f31552d726a3a481a5b540c5877
MD5 31ca6913e043b96cf961d3f66d60fac7
SHA1 4e9aec45d2c8db6341967d29b515ee7ea6d99298
SHA512 df165241175cf5f1ed644595640b7e8f94d5f4c26888ca8f46e6bf48a5ce5b4f148b46d012b44253cfe0d323844a226b2f0a8a10382498921f162271944d0726
SSDEEP 3072:wCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:rvMsLaOa3lLNngoqRttA7S
TLSH
T1FB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigdyvqnl.exe

Path C:\Temp\i_qoigdyvqnl.exe
Size 243KB
SHA256 bf3d65045fb3e498b87408fce5214119686ca819df260122f9a4e80e9d0472fd
MD5 8f71b057aae042dfe60744b8e9531f00
SHA1 b3e44a37a654e69b99a2b2c01d16ce7ebaca9782
SHA512 a7dfeaad23e2da64615da423e04d129a48a3cbf0cd7f9cc80461d61081c922ee5531b5a09c158fb9e296a885103e58b461d439006095a5815a74146e41480961
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:MvMsLaOa3lLNngoqRttA73
TLSH
T116345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wupeztrmge.exe

Path C:\Temp\i_wupeztrmge.exe
Size 243KB
SHA256 f8bfc479d1e77bbbd2aa805f9ef6784f8010e9b6d0e186815b2b9ebe4f6cb00c
MD5 e0b59e25b3b0e964f9cc8d7a82022930
SHA1 50726005f8525862c1d6d7211aa625afbfa0e0b9
SHA512 6f70b378bcb117b1ecaca38fd908d5dd6de08593865fbbc88c01ec09185375d3d4e5f873e29d78463e854620b31d713321eeba31fd0a9d1d5f1433cc2c447aba
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:4vMsLaOa3lLNngoqRttA7f
TLSH
T1AE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebzwromge.exe

Path C:\Temp\jebzwromge.exe
Size 243KB
SHA256 6a37168052a4dcfc6f7a2f17a24e4f8fafb84075cb2341ff018ed9bfdc4447c4
MD5 2b86e7d67480bed20c7e575f78fa3875
SHA1 6f72344df6122288beb008040ad68e19360672a8
SHA512 b101e1ee98809de0dafe5a59806f7d7f47f856e9cf2b5bbba87b958b3c848eaf29b7f2dc90d2f5bd6d9a6fe28c78c56aae4c075d66b56571d810c5fecf3c8b30
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:xvMsLaOa3lLNngoqRttA7w
TLSH
T105345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidavtnlfd.exe

Path C:\Temp\lidavtnlfd.exe
Size 243KB
SHA256 2e44acf594c7ec7b6c2567096d3c44d2d21264342e85c4b91075e2d84f711025
MD5 37ec1d35c42331e7993d72632ea98d82
SHA1 b4d6448849834a3a9282f496ca286c1faaabe9c3
SHA512 adcd3e28b7d8b608d9331447537bdf21f95f383eca82092cf7c00bbef1e27c17fbbfc4bc4b203df364ad1509e57db8fa5c6a99239d412644042b600b546e51c7
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:LvMsLaOa3lLNngoqRttA7C
TLSH
T140345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbytqoi.sys

Path C:\Temp\qljdbytqoi.sys
Size 141KB
SHA256 88717e76b1b82bc9b9dfc9c5db102b4e977e2ce8ac93cd49ecf6ab1c6d1d3aa7
MD5 c545dc35092bdff3054e3f9a58e6917e
SHA1 fe4b6206c552d897db1e49673a7928406afa9767
SHA512 b3d352347ef819d723aba75ac95cccd9188bfa75103dc9dcf6ebaf0e38eedf435acb1ead6c27467845edb495e32fb94879d28446be3c8a42c54e67576bb6a796
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdyvqnl.exe

Path C:\Temp\qoigdyvqnl.exe
Size 243KB
SHA256 62064527ffac68506b58e7fb40f7a218bf0f8c5c8c36bade46fb2bd4312634a8
MD5 ea78431c15c270dea067fd0dce98cc66
SHA1 961c1abfada023eca7e861ae9840eed0bce904de
SHA512 1aa8baa68df44ad5619f02bc6212a997df7dfecef0219469fa6241bcda02955c284b3e14fd575768289c915c5f16aecd8b7a69f3ec8efd7220c3e65e8da69e54
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:LvMsLaOa3lLNngoqRttA7W
TLSH
T1EF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrpj.sys

Path C:\Temp\rpjhbztrpj.sys
Size 141KB
SHA256 e1971464696e6e2a59e5e2273e55cb8cf546884ac025e3e03aa490acbf2d0133
MD5 8b266a7e5fd1a190cff8559de551459a
SHA1 833dae99154b164d9977a740a0b0d850bec92bc9
SHA512 c4e898d31e0eeefd782b3031da457e511315ec75afc1c907f194fa6b978b0aed018ea3e71e4d1580e5dfea068143187fb13d7abfbd35c6d8d9473420d8f0a71d
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T148E37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 243KB
SHA256 b3df60ddb451e081e1cf5a8d024aa9c3076ad2e22ab36b147a9fe39252ce8af1
MD5 fd7f55d284f52f944a64328b40baebb5
SHA1 08dbc34246bda370499c50c346244ffb8750b206
SHA512 86e7a517f3f0ecd31482e192e88b5d2a376f2796d1e5cf40e0a7f54f96d4b27f828b3e0b86d7fed855cbd9df1f9135c7bb4a757c0db347aa18c978e6baadf47c
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:kvMsLaOa3lLNngoqRttA7D
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavsqk.sys

Path C:\Temp\sqkidavsqk.sys
Size 141KB
SHA256 1c4adb39e4c0f87cb80168049e6bfb0c44a52b9d993486b3bbf2fb396e5e0089
MD5 69805be4b99e2d49641e99b47a641aeb
SHA1 72a4931cb4f91c2c2e2df47ea2922ccb2822eb08
SHA512 3452b8a9c0688ced3dfad90152c7d4c8cd25831ac368aafa096517a167f721562024494f317782b2fb2c321fadaf35c13ceaa0a7f57684b856bc5bf7bd2fe46b
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T137E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupeztrmge.exe

Path C:\Temp\wupeztrmge.exe
Size 243KB
SHA256 792c9e5f49144ced70248dae9114e19c81e4c6a2737e6305e7a271e1db8ba94b
MD5 6e655d0898d9a6bd63d07fb7620557da
SHA1 06d13508be81d2474e8e5232a75f312061da9094
SHA512 dd6cb2890e4244eaccb26317a8cece5a52f18f4c4dede64bb6c7e36cc31814524528fb21caff1257906fecd59ff59e0209744761cac2a79577038fbc2fcb4360
SSDEEP 3072:ZCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:EvMsLaOa3lLNngoqRttA7L
TLSH
T154345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvq.sys

Path C:\Temp\yvtnlfdyvq.sys
Size 141KB
SHA256 558589fadce5df2713e4721b38d08245f12f8ec8672d60308b503c71b8187b8e
MD5 1db3038c0099ecb1975b0cadbea11fc5
SHA1 86357f5c2a2b168665e5d11758e110e0f276ca7d
SHA512 dacc02105f1de2165cf8ce77aad8f82f85f91e772ee145adc2336c850633ec39c0239e2442133a44e1bbba37c8e2d57f07d287c723e88d24c6f619a58aca8fad
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltp:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f78b4ef9898e63f7955a8f002dfc34ae4081da3781ef946a2075f0a0bbf1f020
MD5 f882a82d5a203f29d96af93b2e0816d8
SHA1 63646cfdd5be3c7c74f99476796e14e71a24dc7b
SHA512 3852010f4f4d409153ecc1075db22b74a28db797b1c94dee841e4a020cedf41cb3722c1d8e2558d2d343f492e6604b7d32cf98741bd065cf264f125357714c73
TLSH
T12641BA94C37168DBFBB0B9B123D2D59932F8A2584247EE51CC511C7AC907FB658C007B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b6b71c61ed93c76c370924431b97fadb1c587b7f8e8f4395fc124fd5999737f0
MD5 b8ed17d4737fdac4e1768c3982a6e182
SHA1 cca31ebfb356f1f7e619b995036089c5532cb075
SHA512 8c803e7dc6647de49fac418963c4cf02fc72034b3c844fac8a7a26f98c11e664e6a07a6a6222d222686fa98e0f803969e8f650db24a7785636d9efaf05b3fea3
TLSH
T1A851BEF3C3F8862D891156F0A614BE1BCE2D0954832C3D5AC8E4AF5B93E3471E181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b5e899d1-0a50-4a43-9d3d-96f91c024424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b5e899d1-0a50-4a43-9d3d-96f91c024424.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 14633d4115e60fe21ca267a8ee03a381724c119daa8283a21da057e9251c50ac
MD5 55c595c705d6a8c71599b4e3e1ed78ad
SHA1 24bba597f1d77999177ce8dfa9f0169200c7e278
SHA512 05f74aaf08aba819a6153b7e7aec887d2c8643062a84871b8202eb5ed4527d8048afe846cd3a26f2ac8e801d734ac5f9568562b08160806110523adf0f8d6ec8
SSDEEP 192:sxRoRlCh/f2s9WciZ2/zoA8p9j/g6+WNCWt/YD9qhISlGifIgVBZ3J:sxRoyh/f2skck2WN/5d/ZIS9z
TLSH
T10042D8056A28AD3B5CC7D21DFB657F53D2F92032A0D15E58E6FC961C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc8c3abf4e1ab527ce50eecf68b90de2d9426bc8ea0d2ad4791161085ecca2ba
MD5 e5b4dcef216ee1631ee2ff8dbf5078cf
SHA1 11dc119efce532ef2eb1f04ab493f204845fef13
SHA512 39e42ffa738fb9dc18e720e116ff10ec825024b1823489baf91ec7910e30b8c0c2112f9ad1611c138a5b51ede9d2d9b46f9231b9a144cba6074770cf377f0342
SSDEEP 192:sxR7RlCh/f2seWxiZ2/zoA8p9j/g6+WNCWt/YD94hISlGifIgDtBZ3J:sxR7yh/f2s/xk2WN/5d/hIS9P
TLSH
T1F942C71A6A286D3B5CC7D21DFB657F53E2F9603290D15E58E7FC9A1C00EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f674e379c9ec0f11aa9d1d7ec96f9ce7aba1497aec829f16abca779fd5398f1d
MD5 aea36250ad61003562eca952ba2cec61
SHA1 1be73cda597c09e413fe9ae5fb36fbc1fe3771b1
SHA512 29f95174b977c56ad17f185ca43428f7cae7f82a2afe8c260b95010fa7818d8c565e8276cc44831d68f1c026a7162d075e216bd3852a3bc47c56ac8d0585ea2a
SSDEEP 192:sxR7RlCh/f2seWciZ2/zoA8p9j/g6+WNCWt/YD9qhISlGifIgDfBZ3J:sxR7yh/f2s/ck2WN/5d/ZIS9p
TLSH
T12042D8066E28AD3B5CC7D21DFB65BF53D2F9203290D15E58E6FC9A1C04EA6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7504d89bb152fa28608cdfb8cb696b22b84f35eba96399018b13968d0403d308
MD5 7961a8d7de97c404090a7259f15054a3
SHA1 7267aa6fd88c5c5b2a2d7f72bcc521310d5b2901
SHA512 0ffc675a3a88ac3838d4957528706e73ca892e42c7b85da617688f49da679b966df78e04f38e41a76a1361dfea5b8dbc2024cda5a200eaf202b5bc978b5633e4
SSDEEP 768:azfWVo7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQnYc16OropefWR:azfWVUEf30Wg/XfHfu1javnYy6FpeuR
TLSH
T1AED2EA7B240CCF7F4F800ADDAD197E9B6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 66ac57238ce468462744f967ba53c1f9a69e3323d48e040dff1a3d44f44c4979
MD5 712656c8dcd2e72b02b7de72ba3f4c5b
SHA1 c866a711432400d7daa26a6d8089881a17bdeae3
SHA512 9157b97480331f339250e47e0d2c884ddbc61cf4603639ed4727e93dacce841538d728a3cf577d0518e1a95cc80690a296d59a991f8f2347cd9c6933c926d587
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3efQjPFb:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7/
TLSH
T14E914905327B4240387E795C84E89D1B43C27897310CA52B7BE842AA8F67D639DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

823fcb32-9d09-49fc-abc4-73b2d661d638.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\823fcb32-9d09-49fc-abc4-73b2d661d638.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5c25f7957bc3e57e71bcef3ea9e2735d94857611fa2a949ed3b8d2341725ea57
MD5 efa1139de5677d41e1da7fd2c89207be
SHA1 6c7f32880da35fe96d41580941c9a8f5be87cd42
SHA512 76fb9e919b7f8e99b5ece6fc9f452402fbeeff097c49fd8a84f044f259662eafc85980041e4e5f7f7211496ecb3d876090ca04498a58de65e8f375f9b083af68
SSDEEP 384:nyZcIn38N7l/6mlX9WZlf8hyEG7OMFQy2rEoajo4cdR8eHhVODjYPNDUMqHoBSKM:An3OnKi0nIrEnjN3Gac1FqHwSOa
TLSH
T1E9F2BF701DA5DCB39CEFE249B2837752AEF1167394D44FA8D6CDEA0C0583AA9170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 248305cdb505b5c3de4463c9ab5bb28d57e42fb817bd80a1cd94d06c61b68177
MD5 8c101f71a4cacd80516fe9b746508f0a
SHA1 1bdc6b6ea1eb86fe04b7a47e1baaf4619c798f94
SHA512 515c17ef8c39431e14a33a7032f119b3cd01ffa27b14257b884f7a7849f376deb4ddb6a3054594d7539a722c52fad9139079292d49265f94f5255a907d13a505
SSDEEP 768:rrv+4UNbdS3hmi0nLrEnjN3Gac1ZreVH1SCz:rbsbg3mLQnjMaUEH1V
TLSH
T1C103CF3669A89E739CEBE38571837A037FF4525385940BA4C6CD6B0D02DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a53018ad516050eae35ae8e21e26a8cd2a179d5788153e30aaa3eae84ab3c925
MD5 5060213bc48f4db5e3f719df184fc806
SHA1 ef4a36517ad472009fdef11222895ec496e61320
SHA512 7b2075ff2a105b9562fb08231e9e1c0314386ca4de056036ee00cb17d4661ecc5597e5fcb464100a4e0fad339adc6f606f0533241855357aa9e083a1c5b1e4dd
SSDEEP 768:Mrv+4UNbdo3fkKi0nxrEnjN3Gac1FqHwSOX:MbsbS3f/xQnjMalQ/X
TLSH
T15A13C0316968DD738CEBE249B1477653BEB416A388D40FA4DAC9AA0C05C79E9270BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 4acb441e42fd03eea48465f32b578662bae04cc21cdaa9f1a0e80a43808c449e
MD5 b08e2906ba6c436150c5a8c5e809a8db
SHA1 668c4f56cfacc7201da0eae03e7265641ffd81d4
SHA512 bf606334e3e7a0a0fa3da6788b839aa81b680eda5417a743376226b60ffd5db76b24b2eef28687f94d88dfad966e5b2a0888109da0b245f0f27f507e4c086687
SSDEEP 384:nGiFiZcIl38NF8TUNTUlIll/6mlf94Hf05yEG7OMFey2rEoajo4cdR8eHhVODjYq:tFQl3uwgDvNsnOrEnjN3Gac1FqHwSOa
TLSH
T16F1339F588D78977D8EE9387A37E6E4299BDC163B4844994B7C89D0CCC825BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c050324a74bf02694dc090ec6c1345752b66b7f6087f3b5cd95eee259da6846
MD5 38f3ab03f40593734913d1856ca0c8be
SHA1 7772d6b0176c63585179571a16900681afa4d80b
SHA512 037718fd8c73c73379b3934326702085517e2dffce4ba7ef344560821ea4b1ecc12672a5caf95ba64a3b68e78505de60563cce0aa12a784c26dec774c42bf0d7
SSDEEP 384:nKZcIn38N7q/6mlX9WZlf8hyEG7OMFQy2rEoajo4cdR8eHhVODjYPNDUMqHoBSKM:on3fnKi0nIrEnjN3Gac1FqHwSOa
TLSH
T17BF2BE701DA5DCB39CEFE249B1837752AEF1167394D44FA8D6CDEA0C0583AA9170B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e5d51bb6-8f11-4bff-a8a9-00dc1ae4223b.tmp

Path C:\Users\Admin\AppData\Local\Temp\e5d51bb6-8f11-4bff-a8a9-00dc1ae4223b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1276_510379608\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/696-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1724-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3416-635-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-667-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3960-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4100-692-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4100-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4752-714-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4844-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5168-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6056-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6060-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6060-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6060-591-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6088-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download