cff42269c10c72b62ae27240a984c1617a94051680cd30f78daa285fefaa03d8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe
Size 243KB
Sample260805-m94dmaem2v
SHA256 cff42269c10c72b62ae27240a984c1617a94051680cd30f78daa285fefaa03d8
MD5 502496373d753318585d105abff1d15e
SHA1 2eaa8fecabeca7a7259471192d121260d51c6a0e
SHA512 d576d264ad42f1e25eebd24b482a5489a6e9d953f41f8fc48a4e6f199be5810e27469b39f6805b132bba57186615cd4882c16910ed714fcb985d86c035d97474
SSDEEP 3072:5F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:73frLQsa3lLNngoqRttA7l
TLSH
T17C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3140	CP.exe
4244	eytrljdbwr.exe
1696	CP.exe
3752	CP.exe
4380	i_eytrljdbwr.exe
4996	ebwtolgeyt.sys
2460	CP.exe
2372	nlgdywqoig.exe
4368	CP.exe
564	CP.exe
3504	i_nlgdywqoig.exe
4924	oigaysqlid.sys
2928	CP.exe
1952	jdbvtolyvq.exe
1784	CP.exe
5128	CP.exe
3212	i_jdbvtolyvq.exe
1648	caysqkigax.sys
1788	CP.exe
4936	ayvtnlifdx.exe
4132	CP.exe
5780	CP.exe
3856	i_ayvtnlifdx.exe
4784	ausmkfcxvp.sys
2712	CP.exe
3248	smkfcxvpnh.exe
4204	CP.exe
2684	CP.exe
2144	i_smkfcxvpnh.exe
4832	usnkfcxupf.sys
4376	CP.exe
3396	hfcxupmkhf.exe
5620	CP.exe
2076	CP.exe
5596	i_hfcxupmkhf.exe
3332	usmkeczxrp.sys
5884	CP.exe
4996	urmkecwupm.exe
5232	CP.exe
2168	CP.exe
5360	i_urmkecwupm.exe
712	uomkecwuom.sys
2600	CP.exe
3200	wuomhbztrm.exe
3856	CP.exe
4652	CP.exe
2764	i_wuomhbztrm.exe
3508	ztrljgebwu.sys
4832	CP.exe
3444	romgeywroj.exe
3264	CP.exe
6116	CP.exe
1648	i_romgeywroj.exe
2988	toljebwtom.sys
5712	CP.exe
6040	dbytqljdbv.exe
240	CP.exe
5440	CP.exe
600	i_dbytqljdbv.exe
484	yvtolgdbyw.sys
3580	CP.exe
4168	ywtnljdayw.exe
4324	CP.exe
1908	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1684536746\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1708778361\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1708778361\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_369668393\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1692_898892424\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1684536746\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_363794658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1708778361\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1465176927\_locales\en_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljheztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvtnlifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwrpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwrpmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljheztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgayvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtnljdayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvtnlifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgayvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvsnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eytrljdbwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxupmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtnljdayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvsnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eytrljdbwr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5300	ipconfig.exe
5288	ipconfig.exe
4740	ipconfig.exe
1544	ipconfig.exe
1328	ipconfig.exe
5164	ipconfig.exe
4708	ipconfig.exe
2500	ipconfig.exe
4808	ipconfig.exe
1196	ipconfig.exe
4452	ipconfig.exe
5252	ipconfig.exe
1748	ipconfig.exe
2436	ipconfig.exe
4364	ipconfig.exe
5320	ipconfig.exe
600	ipconfig.exe
4288	ipconfig.exe
6032	ipconfig.exe
1288	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304018567239446"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{60F0438F-2681-494D-A7C5-1ABA7419B86B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	i_eytrljdbwr.exe
Token: SeDebugPrivilege	3504	i_nlgdywqoig.exe
Token: SeDebugPrivilege	3212	i_jdbvtolyvq.exe
Token: SeDebugPrivilege	3856	i_ayvtnlifdx.exe
Token: SeDebugPrivilege	2144	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	5596	i_hfcxupmkhf.exe
Token: SeDebugPrivilege	5360	i_urmkecwupm.exe
Token: SeDebugPrivilege	2764	i_wuomhbztrm.exe
Token: SeDebugPrivilege	1648	i_romgeywroj.exe
Token: SeDebugPrivilege	600	i_dbytqljdbv.exe
Token: SeDebugPrivilege	4928	i_ywtnljdayw.exe
Token: SeDebugPrivilege	4340	i_bvsnlfdxvt.exe
Token: SeDebugPrivilege	3584	i_lfdxvpnifa.exe
Token: SeDebugPrivilege	716	i_xspkicausm.exe
Token: SeDebugPrivilege	4872	i_zxrpnhfzxs.exe
Token: SeDebugPrivilege	3384	i_ecwrpmhfzx.exe
Token: SeDebugPrivilege	5824	i_trljheztrp.exe
Token: SeDebugPrivilege	3548	i_ljdbztrljd.exe
Token: SeDebugPrivilege	5188	i_qoigbytrlj.exe
Token: SeDebugPrivilege	1708	i_olgayvqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 2840	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	88
PID 2840 wrote to memory of 1692	2840	iexplore.exe	90
PID 1692 wrote to memory of 5172	1692	msedge.exe	91
PID 1692 wrote to memory of 1396	1692	msedge.exe	92
PID 1692 wrote to memory of 1108	1692	msedge.exe	93
PID 1692 wrote to memory of 1396	1692	msedge.exe	92
PID 1692 wrote to memory of 1396	1692	msedge.exe	92
PID 1692 wrote to memory of 5848	1692	msedge.exe	94
PID 1692 wrote to memory of 5848	1692	msedge.exe	94
PID 1692 wrote to memory of 940	1692	msedge.exe	96
PID 1692 wrote to memory of 940	1692	msedge.exe	96
PID 1692 wrote to memory of 940	1692	msedge.exe	96
PID 1692 wrote to memory of 5124	1692	msedge.exe	97
PID 1692 wrote to memory of 5124	1692	msedge.exe	97
PID 1692 wrote to memory of 5124	1692	msedge.exe	97
PID 1692 wrote to memory of 3668	1692	msedge.exe	98
PID 1692 wrote to memory of 2996	1692	msedge.exe	99
PID 1692 wrote to memory of 3668	1692	msedge.exe	98
PID 1692 wrote to memory of 3668	1692	msedge.exe	98
PID 1692 wrote to memory of 2996	1692	msedge.exe	99
PID 1692 wrote to memory of 2996	1692	msedge.exe	99
PID 1692 wrote to memory of 3384	1692	msedge.exe	100
PID 1692 wrote to memory of 3384	1692	msedge.exe	100
PID 3156 wrote to memory of 3140	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	102
PID 4244 wrote to memory of 1696	4244	eytrljdbwr.exe	105
PID 1692 wrote to memory of 5052	1692	msedge.exe	108
PID 1692 wrote to memory of 1512	1692	msedge.exe	109
PID 1692 wrote to memory of 5052	1692	msedge.exe	108
PID 1692 wrote to memory of 1512	1692	msedge.exe	109
PID 1692 wrote to memory of 4188	1692	msedge.exe	111
PID 1692 wrote to memory of 2488	1692	msedge.exe	112
PID 1692 wrote to memory of 2488	1692	msedge.exe	112
PID 3156 wrote to memory of 3752	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	115
PID 1692 wrote to memory of 5976	1692	msedge.exe	116
PID 1692 wrote to memory of 5976	1692	msedge.exe	116
PID 3156 wrote to memory of 2460	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	120
PID 2372 wrote to memory of 4368	2372	nlgdywqoig.exe	122
PID 3156 wrote to memory of 564	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	125
PID 3156 wrote to memory of 2928	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	129
PID 1952 wrote to memory of 1784	1952	jdbvtolyvq.exe	131
PID 3156 wrote to memory of 5128	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	134
PID 1692 wrote to memory of 1720	1692	msedge.exe	138
PID 1692 wrote to memory of 1720	1692	msedge.exe	138
PID 1692 wrote to memory of 5612	1692	msedge.exe	139
PID 1692 wrote to memory of 5612	1692	msedge.exe	139
PID 3156 wrote to memory of 1788	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	140
PID 4936 wrote to memory of 4132	4936	ayvtnlifdx.exe	142
PID 3156 wrote to memory of 5780	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	145
PID 1692 wrote to memory of 2420	1692	msedge.exe	148
PID 1692 wrote to memory of 3384	1692	msedge.exe	149
PID 1692 wrote to memory of 4428	1692	msedge.exe	150
PID 3156 wrote to memory of 2712	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	153
PID 3248 wrote to memory of 4204	3248	smkfcxvpnh.exe	155
PID 3156 wrote to memory of 2684	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	158
PID 3156 wrote to memory of 4376	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	162
PID 3396 wrote to memory of 5620	3396	hfcxupmkhf.exe	164
PID 3156 wrote to memory of 2076	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	167
PID 3156 wrote to memory of 5884	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	171
PID 4996 wrote to memory of 5232	4996	urmkecwupm.exe	173
PID 3156 wrote to memory of 2168	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	176
PID 3156 wrote to memory of 2600	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	180
PID 3200 wrote to memory of 3856	3200	wuomhbztrm.exe	182
PID 3156 wrote to memory of 4652	3156	2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe	185
PID 1692 wrote to memory of 5296	1692	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_502496373d753318585d105abff1d15e_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd082bc188,0x7ffd082bc194,0x7ffd082bc1a0
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,14691615965736701979,375672811908058229,262144 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,5776362520158530560,12917677337242794888,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
      4⤵
      System Time Discovery
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,14741326695749697461,3703794336514518775,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,5572891706977250373,9889081420471921395,2097152 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,3340807639017010116,16116352732872629098,2097152 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,15863931658927086127,3199328868929503602,2097152 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,528614284693609666,12173954177490108937,2097152 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:9
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,8730092082622920536,17670331136022510706,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,14615296342302174666,17179696437075074480,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,2437549869065664572,17402821705137340746,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10532926609358276781,13790427936813302212,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10532926609358276781,13790427936813302212,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,14541066038857466670,15705364799071907566,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,9703367574977641621,8072978684550048052,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,981026184132610491,7146799066371007233,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,16555341590588197465,11315938879457308441,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,4294643703466376953,14013460478852114248,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,1745761264577964235,12382338812836542934,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,14093238935517173719,12489624161833211835,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,11218778126735748965,6227123420322404363,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12085174395100103336,18234977623628779527,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,8652438434831144571,11455543005972843004,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16483455727627488413,1958834671692943474,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,6655294659874516585,14499442047717022412,262144 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,9712057294233117732,6134430811863243295,524288 --field-trial-handle=2368,i,10829139805469943108,12265939380990802190,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:14
      4⤵
      PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eytrljdbwr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140
- - C:\Temp\eytrljdbwr.exe
    C:\Temp\eytrljdbwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eytrljdbwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\i_eytrljdbwr.exe
    C:\Temp\i_eytrljdbwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:564
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\jdbvtolyvq.exe
    C:\Temp\jdbvtolyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5128
- - C:\Temp\i_jdbvtolyvq.exe
    C:\Temp\i_jdbvtolyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvtnlifdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1788
- - C:\Temp\ayvtnlifdx.exe
    C:\Temp\ayvtnlifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvtnlifdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5780
- - C:\Temp\i_ayvtnlifdx.exe
    C:\Temp\i_ayvtnlifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2712
- - C:\Temp\smkfcxvpnh.exe
    C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2684
- - C:\Temp\i_smkfcxvpnh.exe
    C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcxupmkhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4376
- - C:\Temp\hfcxupmkhf.exe
    C:\Temp\hfcxupmkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcxupmkhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_hfcxupmkhf.exe
    C:\Temp\i_hfcxupmkhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\urmkecwupm.exe
    C:\Temp\urmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2168
- - C:\Temp\i_urmkecwupm.exe
    C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\wuomhbztrm.exe
    C:\Temp\wuomhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4652
- - C:\Temp\i_wuomhbztrm.exe
    C:\Temp\i_wuomhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4832
- - C:\Temp\romgeywroj.exe
    C:\Temp\romgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6116
- - C:\Temp\i_romgeywroj.exe
    C:\Temp\i_romgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5712
- - C:\Temp\dbytqljdbv.exe
    C:\Temp\dbytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5440
- - C:\Temp\i_dbytqljdbv.exe
    C:\Temp\i_dbytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtnljdayw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3580
- - C:\Temp\ywtnljdayw.exe
    C:\Temp\ywtnljdayw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtnljdayw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1908
- - C:\Temp\i_ywtnljdayw.exe
    C:\Temp\i_ywtnljdayw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvsnlfdxvt.exe ups_run
  2⤵
  PID:5596
- - C:\Temp\bvsnlfdxvt.exe
    C:\Temp\bvsnlfdxvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvsnlfdxvt.exe ups_ins
  2⤵
  PID:1704
- - C:\Temp\i_bvsnlfdxvt.exe
    C:\Temp\i_bvsnlfdxvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnifa.exe ups_run
  2⤵
  PID:788
- - C:\Temp\lfdxvpnifa.exe
    C:\Temp\lfdxvpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnifa.exe ups_ins
  2⤵
  PID:548
- - C:\Temp\i_lfdxvpnifa.exe
    C:\Temp\i_lfdxvpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  PID:4928
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  PID:3664
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpnhfzxs.exe ups_run
  2⤵
  PID:2924
- - C:\Temp\zxrpnhfzxs.exe
    C:\Temp\zxrpnhfzxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpnhfzxs.exe ups_ins
  2⤵
  PID:5744
- - C:\Temp\i_zxrpnhfzxs.exe
    C:\Temp\i_zxrpnhfzxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwrpmhfzx.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\ecwrpmhfzx.exe
    C:\Temp\ecwrpmhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwrpmhfzx.exe ups_ins
  2⤵
  PID:2476
- - C:\Temp\i_ecwrpmhfzx.exe
    C:\Temp\i_ecwrpmhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljheztrp.exe ups_run
  2⤵
  PID:2672
- - C:\Temp\trljheztrp.exe
    C:\Temp\trljheztrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljheztrp.exe ups_ins
  2⤵
  PID:1628
- - C:\Temp\i_trljheztrp.exe
    C:\Temp\i_trljheztrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbztrljd.exe ups_run
  2⤵
  PID:716
- - C:\Temp\ljdbztrljd.exe
    C:\Temp\ljdbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbztrljd.exe ups_ins
  2⤵
  PID:5372
- - C:\Temp\i_ljdbztrljd.exe
    C:\Temp\i_ljdbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytrlj.exe ups_run
  2⤵
  PID:1804
- - C:\Temp\qoigbytrlj.exe
    C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytrlj.exe ups_ins
  2⤵
  PID:2256
- - C:\Temp\i_qoigbytrlj.exe
    C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgayvqoig.exe ups_run
  2⤵
  PID:3884
- - C:\Temp\olgayvqoig.exe
    C:\Temp\olgayvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4856
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgayvqoig.exe ups_ins
  2⤵
  PID:5396
- - C:\Temp\i_olgayvqoig.exe
    C:\Temp\i_olgayvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5620

C:\Temp\ebwtolgeyt.sys
C:\Temp\ebwtolgeyt.sys
1⤵
- Executes dropped EXE
PID:4996

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\caysqkigax.sys
C:\Temp\caysqkigax.sys
1⤵
- Executes dropped EXE
PID:1648

C:\Temp\ausmkfcxvp.sys
C:\Temp\ausmkfcxvp.sys
1⤵
- Executes dropped EXE
PID:4784

C:\Temp\usnkfcxupf.sys
C:\Temp\usnkfcxupf.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Temp\usmkeczxrp.sys
C:\Temp\usmkeczxrp.sys
1⤵
- Executes dropped EXE
PID:3332

C:\Temp\uomkecwuom.sys
C:\Temp\uomkecwuom.sys
1⤵
- Executes dropped EXE
PID:712

C:\Temp\ztrljgebwu.sys
C:\Temp\ztrljgebwu.sys
1⤵
- Executes dropped EXE
PID:3508

C:\Temp\toljebwtom.sys
C:\Temp\toljebwtom.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\yvtolgdbyw.sys
C:\Temp\yvtolgdbyw.sys
1⤵
- Executes dropped EXE
PID:484

C:\Temp\bvtnlfdxvs.sys
C:\Temp\bvtnlfdxvs.sys
1⤵
PID:5400

C:\Temp\kicaysqnif.sys
C:\Temp\kicaysqnif.sys
1⤵
PID:3044

C:\Temp\kfcxvpnhfc.sys
C:\Temp\kfcxvpnhfc.sys
1⤵
PID:3716

C:\Temp\zxvpnhecax.sys
C:\Temp\zxvpnhecax.sys
1⤵
PID:5512

C:\Temp\ecwurpjhcz.sys
C:\Temp\ecwurpjhcz.sys
1⤵
PID:5664

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:600

C:\Temp\uomjebwtro.sys
C:\Temp\uomjebwtro.sys
1⤵
PID:1912

C:\Temp\tqoigbytrl.sys
C:\Temp\tqoigbytrl.sys
1⤵
PID:2844

C:\Temp\igayvtnlig.sys
C:\Temp\igayvtnlig.sys
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkfcxvp.sys

Path C:\Temp\ausmkfcxvp.sys
Size 141KB
SHA256 4bf5baa2b51dd6ea72fa3cbaaaa6124e3cc087e90259835f1a211fb20296ca54
MD5 74b9a6bdae93c373a0813e9b85e51b80
SHA1 d1c894a1ef90ef4e1c0cb60b544b97305d28abe3
SHA512 61bb53ccf7e89e2cd9094fed670ea0267099cbf100ce46654b13d6dc4a0922daeae778b47372a7529b61303e6cda4f7fd1079469d2ff46c1f12e0a5ebeeb4b92
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T132E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvtnlifdx.exe

Path C:\Temp\ayvtnlifdx.exe
Size 243KB
SHA256 3e724d1a0949c8cf13845d8dd9f98bde786934e1222fdf087910f6d287271539
MD5 073bd49b40549f010ee172facf790da5
SHA1 252e9b0dc54af156912118efc5c4dda707dc34a0
SHA512 f84138af9bb10286e9b24dd02a49918d83c78c20a494aa0ad868470bc829d113f92626cb9d3ad24f9c1fb2bd88f5500a6bb6229cd128185f6c61aad3204aafe9
SSDEEP 3072:EF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:Q3frLQsa3lLNngoqRttA78
TLSH
T173345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysqkigax.sys

Path C:\Temp\caysqkigax.sys
Size 141KB
SHA256 569bd4c2873d2dc6f9c00ec1079d32042e24f5448a5df51e0f5f1036aa36809f
MD5 79965448b8db1e59bee3cba95e0829a7
SHA1 c6c8a00c4bd2f4e62292541cce3e6dc6c22e72fb
SHA512 e5489fc24d6bd0418df4230cfa891d4c0d8c4e7b8707dbcd569dc793cece467b39b956e1b75f716fb2ae90ce4c5d2999b143300c230a5be3bfbbb00f35c7e2bd
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtolgeyt.sys

Path C:\Temp\ebwtolgeyt.sys
Size 141KB
SHA256 d0a72181a2319bd40237ac8bf52a5fba36021a58a8189fc020872b81fd74b442
MD5 9ec329f2a26ed526e709f2b3f135515b
SHA1 ceceabc4a10a4bed2ebf2b5fc4b68b76301a8726
SHA512 c6ee32052b54be15fcf2db71486ca3594f1362927970fe0395d666d30e0149cff71e4fee83da8adf1d8781aa71884a84ea51a3f8b8472e9554316f159ae34fb7
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eytrljdbwr.exe

Path C:\Temp\eytrljdbwr.exe
Size 243KB
SHA256 7fdf3112aa28e8a47f8318b3ee557befd83292258a10d61ff991c16f3108a605
MD5 8274a0da4828b7762190742679cf42ef
SHA1 916c7e4e88feff44fa1b722da47cf3b5f605cfdf
SHA512 be3d059b3b7d2fc0f2d39e8a56205af46ea27da4b59e9d9a21a8a285a71b7cb8e7834a8a1f3f15b2a0a342438bc0dba0bbe2b2e1c5c407e23d7cfd172ce5bc04
SSDEEP 3072:AF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:c3frLQsa3lLNngoqRttA78
TLSH
T1C0345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxupmkhf.exe

Path C:\Temp\hfcxupmkhf.exe
Size 243KB
SHA256 ec0c9f1210bbcbf6bb65732caa750a1c57d6e9be9011148bbd988e9272f6a1ab
MD5 12bdff3d04d3e2cf3bb35395b25c9cf5
SHA1 23ff2003d4a8292fb63da178480cae73970e5042
SHA512 0bc65235efa49094f1055b0a56beb6679617481ec3bc9f95c9e6fc39bbbae3da2143c199b2e68f9da4f74f47cb6b29b1934c9338dfa1254c8c576d6dc5ccb28f
SSDEEP 3072:3F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:13frLQsa3lLNngoqRttA7H
TLSH
T1BA345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvtnlifdx.exe

Path C:\Temp\i_ayvtnlifdx.exe
Size 243KB
SHA256 966d18bc6aa27246c238702c06bad87ef21e174ef5415919ec5e049b6fb6e444
MD5 b560da72528f02b160bb0d1ad165d622
SHA1 e19ed2e5a3db0c9c4848d6663dcf9cb2b97b0e1f
SHA512 7a910f54dc9c518abd0223915a93bb4d94ab9236c1158c169c16cde8ea95d908df65c0b031c9ed7aafc8443e0bd4165fc541c46cc2e72d7f548cd7b0f8bd29f3
SSDEEP 3072:ZF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:b3frLQsa3lLNngoqRttA7R
TLSH
T18C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eytrljdbwr.exe

Path C:\Temp\i_eytrljdbwr.exe
Size 243KB
SHA256 661cd80638f19d69ddc9d895c7e154762e59d3ee0ec52775c43a1878270ba8e4
MD5 1e267281ad3ce0e88390d80960675c9f
SHA1 864c50756697f74301af2a0251758fcb38cd4a42
SHA512 44a94dec159eda821c72c01320bd08c2cba0bb10bf860d6273719a894566cf24dbc40352588a226bfe99ab8db73bae76e2e33cf93d9ee2b85563b1aca042ff84
SSDEEP 3072:nF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:F3frLQsa3lLNngoqRttA77
TLSH
T17F345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcxupmkhf.exe

Path C:\Temp\i_hfcxupmkhf.exe
Size 243KB
SHA256 78230e2f2988f4d08a0e2eed6841aea9b1c9739000b00afc4db8ac037a5d1df7
MD5 74c8060c15b2989758dd59d6b94b0e38
SHA1 e3cf54422264389826eb1cf9d07f849a64d56ca7
SHA512 8ff0dfd30193ff3aee8a2da7cfe07bd2e490aef4cdd3c27933ea57d85ef529d8d5466c517f54c8d84ba7ae8311ccfa43f37015880f9042dd1367bbd25d2134c5
SSDEEP 3072:mF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:m3frLQsa3lLNngoqRttA7a
TLSH
T1DE345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtolyvq.exe

Path C:\Temp\i_jdbvtolyvq.exe
Size 243KB
SHA256 0b79fb6e754f3f22c369e5d60bc32bab2097f2003156c87110fa3344318c4e77
MD5 176523846220ab1f4b64eca30548aaba
SHA1 3c610d06c62b0719fe08819b0c07c46928d94efa
SHA512 bfacb04f84dd83660a2514dc02cbfb69b5220dd827d639d8a2ca59beea8317badbe001eb4dad653e88af60270a3abd2c10a7e9bf31802e2dcdaaed0bf696a95d
SSDEEP 3072:8F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:o3frLQsa3lLNngoqRttA7E
TLSH
T122345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdywqoig.exe

Path C:\Temp\i_nlgdywqoig.exe
Size 243KB
SHA256 4ee202779b5eb7c2eb5d853d21c68c44795b7dd568bf970563c28f5ca9051aa4
MD5 7b3a7bf96fd8a1a0638f227a6b1b63c3
SHA1 273c082601c14331968efa5cfbbe288966598413
SHA512 a2474857d23793d243c215f5f36ce7ccb3dadde3b900a50f5dda4f2646df26a424f11d7438af18a03b436d8266974b7326ee05ec5141ce793fe2a67770136a90
SSDEEP 3072:TF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:R3frLQsa3lLNngoqRttA7r
TLSH
T1EF345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkfcxvpnh.exe

Path C:\Temp\i_smkfcxvpnh.exe
Size 243KB
SHA256 982bfe7fd8347a71d8f4e4f740508c9ce324689841fd6cdc6e46530901e9e946
MD5 257a20067c07bc2cf222bc1273d2eb42
SHA1 b98f2c24f2f5f64d9013eb9376d99feed6e227ba
SHA512 9fb14218f00c314236763cd4734eefe63f16f43c047ae544ceb1870d821bfef93b7b6ff2d488d2a6f966db32eb397b0fb390dbeae63e87cfdc5e7e26be6b3752
SSDEEP 3072:3F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:13frLQsa3lLNngoqRttA7T
TLSH
T1F3345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolyvq.exe

Path C:\Temp\jdbvtolyvq.exe
Size 243KB
SHA256 8878f2264af45402e85288eba1869e9929199c8745a6e149b676e4f814a37a13
MD5 2c385e5dcb02e43af5def0f395873d64
SHA1 ba02463ce8409e0c400f34d0b534ab0887f457cf
SHA512 b5af7aaae5f9ca52e79c663c4727b48403e7ce51c17bb330eb979e81e765ca24f14b6dcdd4c021376f126f3a274b45bcd919a7c4a405fcdc9a1046adbaf0b947
SSDEEP 3072:1F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:33frLQsa3lLNngoqRttA71
TLSH
T12A345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqoig.exe

Path C:\Temp\nlgdywqoig.exe
Size 243KB
SHA256 94ef4cf90cff2ab8eefc90354960014b673db4826e6ee656df87e89a73ff566b
MD5 09adfc8bbffb649095447133172b0a5c
SHA1 6966d7d0e3f357e8ac80a59a1babf32c05327da1
SHA512 4f4c0a9c4da091eb7e4ee1be2c1ec46447925023605bc95025895070a7a5870da9f0c2db529dc0f16aaa14962c8dcf55c8a5c38b78842a7170deeb8d2cdd2e8c
SSDEEP 3072:iF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:y3frLQsa3lLNngoqRttA76
TLSH
T18B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.sys

Path C:\Temp\oigaysqlid.sys
Size 141KB
SHA256 067574e62eb4938bda1343f987f5c98381e690c7a7ca3ea0da34f2a95b90e730
MD5 1d5251cf6904bf277a4ed06964618cc3
SHA1 590fc10d6ff6160cd4f019d92b8d71d222186bb3
SHA512 e9e95f476d45129f0add622a60c119d8a9e09bbb19326f334e9ba268f7b08d8d6d73685a95ba7dec0bb9239f8817fe782e96c0f8e27599ac9cf4384e7a283070
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.exe

Path C:\Temp\smkfcxvpnh.exe
Size 243KB
SHA256 f70a33ec327666e5e9f677003c6f84cbd5eb8380b17daeb121c78d983b1170d0
MD5 e619d528209ac33793e17bda7d3ec812
SHA1 d5dabfc7a12ad7b1484e174406905a2051d19431
SHA512 a1dc0e81f216bacc0e97d3e4620a3084e16b6c50af6bfa6e666f2e0278f74599cc90be0dd953395b2763f5e085c4bb52c128f2caec8782faf67fc36f4deaedb7
SSDEEP 3072:/F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:d3frLQsa3lLNngoqRttA7v
TLSH
T1DB345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcxupf.sys

Path C:\Temp\usnkfcxupf.sys
Size 141KB
SHA256 799c459ac8ca7434ce7bb914c1a9773007735895b0e9fa253d3c6dff6c744003
MD5 3badbab45c7e118010f86dc329786d91
SHA1 da1aedd7acecb83b4967bf5f1da8b077ef69b04d
SHA512 d203118cf542da99d106b2ede578ed44090090c35ed96e239af8c5540ee8e09c9d1117b482abf567fd7004da3215a83b1533cfebd4fe649e859ee04ca07d12b0
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ff40c3093181533f7978cbaa5c2b275a29095024a178bdfaaa5e46af5ed73cc8
MD5 a44bf61d5473a09091481c9080341fad
SHA1 88836d614d4c96fb178d7a049bf077e77e49608a
SHA512 a8d51bce6c40ee4558ef9566ae61a482b388e2855341265d688051528cfdfb5656704b2784a333e47791a77e828a8499e501ecab099a780800bc57276e569180
TLSH
T1EF5173A143E32AD9F72D0BF262C71C5AF67777668683EE1204CA59364C0E32E8321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b1a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b1a3.TMP
Size 2KB
SHA256 bd5def99e7eb642fd8b13fdfc22e4f3b12f91e5d32fd224ff94cb783f4e12b19
MD5 095cc628a6ea4af9b43692fbb25173fd
SHA1 d7f5ec6e0e66554ad467f045fb7dce897e76f882
SHA512 8a0e577e3fd6553fb60553e2e592d3656b329b49d3a5f0c87b42598e6d0f6afb6dc9270ff89a9831667a74fc07060319dfbade52644cb5ec51464a17a3abcd5d
TLSH
T1B951739143E31AD9F76D0AF262C71C5AF677B7AA8583DE1300CA59364C0E72E8321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f68b23803e79902d25ad2ed232a5df71ff3ff3afdc4a7f39a34e692eb59e5071
MD5 94698d0ff8eb35ab7c954df2d3690c9f
SHA1 e0ca49dd100cdd4df45f133d092d5adcd32e8074
SHA512 a1277d1edc2deb70d5ea858ec1ad2d1da8061f3aece677458d3b7017b8936284c6915e596833ef6ca5065643582c6c7eeb6c78cbbb001e0909834aa8ae1fd4dc
TLSH
T17751DFF3C6E8966EC90156F0AA187E2BCE2D0955432C3D5AC8E4EF1B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 345e49aa18145001b57fd9205c4e661abc364d991144e03a76addf5a10d3d48d
MD5 744a1719ac768cda84817f1816187699
SHA1 4e6bd08e99518bc7188916d9552220d445b4a1d0
SHA512 9fa6ea645c115d4f18557b5e030f174c0d074836917104914b9ead933ae6150b32b21c7026bb4468ce28f73d9864a5eec3915996297402e1536743519c019474
SSDEEP 384:sxRz4qsdew/fLFsesftuu3fp1jR+/5ArU/xLOu2cDVF:s34qsdew/fLLsftD3fjd+/5ArmxLOu2u
TLSH
T12B42C816AE28A97B4CC7E21CBB557F53E2FD5032A0951E58A7FC9A0C11EA6DD320341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 813cae942435573550811458706ed05a0d06363a3bb3d3c7a5e3aaca76c3bfa2
MD5 b435cc082ebf394da5421ae502a782e6
SHA1 fd164a5564e9c722c1836a78645119be2d17f353
SHA512 c7fead0b8d4f84840ed8b10dca1935c3d8428035b804795b4fd0775aae67f6361e80d31a3ccd1fbf93f6f058f5deae984f0b09a864c61965b0484fce85a8d6e7
SSDEEP 192:sxRzpqROaCew/fLFsSpwZUwm3fp17zoD8p9z+/g6+WNCzq+Hqh/YGzqnkkOPGCAg:sxRzpqsdew/fLFsSpuu3fp1jR+/5ArUt
TLSH
T1A342D8166D28A97B4CC7E21DBA657F53D2FD5032A0D41E58B6FC9A0C14EA6DD320340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 db0e7570549b5c5de33f663dc0198f57151ea7f440f59ff857a38077c10c091d
MD5 e14bd23b559e72028e3e8a52a9856d1f
SHA1 19c7bab9be78408354e9a4ec2ea3813b4f153233
SHA512 76103076fb425ff8c1c25b65a79766ec20a557999414c676b907d20f8b93e1826ffaba364178c6e0e4784b778efce133e7c490e0a71cf762cd4e784fec787f0f
SSDEEP 192:sxRz4qROaCew/fLFsespwZUwm3fp17zoD8p9z+/g6+WNCzq+Hqh/YGzqnkkOPGCA:sxRz4qsdew/fLFsespuu3fp1jR+/5Arp
TLSH
T18342C816AD28A97B4CC7E21DBB65BF53D2FD5032A0D41E58A6FC9A0C15EA6DD320340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a805bbce37bf2afa3ff8efb6bb79a9af35554a3f24e746502847602c51d5f45d
MD5 9d981884fb9bc0c2d33ac20221d8a6dc
SHA1 b381c0db02ef621ae61d197fb85154d3e3cd5115
SHA512 5616425071ad52a2b25bd68262596c4fb6a1eecda5331a6eec6aea8428d995e83be80bf160e29e1fb591c49121e77b11da19908bbba8b41a06d1cc31e0f05d54
SSDEEP 768:UQYiM37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVgmMeK5pNKelroK:UQYiMxE78NWgv7fxJu1jaHB5fKfK
TLSH
T13ED2EB7B640CCB7F4F804A9D9C297A9F6DA802CB96D8CD9047FE941C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4c8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4c8b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7f7d3a5f193e4b3364eb8fcdbbab42f5fa14d30eadd6025f87a880610fa14e40
MD5 6c7bcac40aeb21fbcb4817470c64c6aa
SHA1 88d2b31defd0a715a5dbcdc7ad91e9b87bbdfe0a
SHA512 4a0083e0d2ec0dd99bcedba6fae2e822154cc9192977db2444ba92d1a3de30a0c5cf4136ee888f10f4952c2b8e2485388f1a105e832a8ee2501444b98166443b
SSDEEP 768:NmxprFQsKH3n3wgrxVpvKetnjlNSVaCkj7Hucys6BRvi82oP4/z6himo6A83ojKg:8SZ336XX3imOz6ImoifgRUdq
TLSH
T117133AF484D38A36E8AE5387A77D2E565EFCC123B4885990B7D91E0CCC825BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a51452542d832f1e8dd7fc608f85cc49c2fc8d45d1c206ad945bf4b9179b2851
MD5 3b87362e93f7f242d41ddbbf6fc12e63
SHA1 a6102f710a0758ff1781f4397d358e5564769c85
SHA512 33a52b19cf767fad2f8e9b556fd0b1c95bd131c7b6465d7a357bce4ea31b04fb2ab3bf3b03ca7106c10399ab927ad0b80934f408328bfab9d137a733b5b2384c
SSDEEP 768:lmAMH3njxVpvK9njlIlYyJaCOv7Hucys6BRvi82oP4/z6himo6A83ojKgqmUdril:kA231xXp3imOz6ImoifgRUdq
TLSH
T14CF2B030D855DE71DCEBE2C9B5463B936FE4123394C86E54E5EE6F0D1283A5E231B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 04b3b4e8b5e808e1b919c9267642fc2497b53592272d04cd518fb0027eb293be
MD5 d1e0b6bf3679816517d1e2bbcc4095c4
SHA1 be3f9de5f160af391684808443c24d8e779824c4
SHA512 7f4682d00592bc88b97dddba11f602c4fe379a7002cc9ab1cc65c4d70476470e04c678bf594eb01aaf96a08a5d5f8e1dbe044125e7b90c88e594722b5735b7d0
SSDEEP 768:xGrv+4UNbdS32eeHSlYyJab7Hucys6BRvi82oP4/z6himo+AG2bwn+h:xGbsbw32EP3imOz6Imoa0w+
TLSH
T19A03C035E4148D72ECF78288B54A7BA37FF4522345C91A80D6DE2F0E429B95E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9093ffddd4a9a23af9822d3b4c1426f97f271e90a9ab7485d12b3714b05403e7
MD5 9cc7197e9f0289aa63c1dfa167051462
SHA1 5076eac1bba92f194264a409ecd1bfd35cd50cbb
SHA512 58d380fbd45e36dfd063933629d62a1e60ca8f55cbdf5493b3bce8dc5e41160982852dc8df4c821c2439a235babacc4e5da05bc0beb125ca3ae03d8667972e3c
SSDEEP 768:3AMH3nCxYpvM9vjlIlYyJaCW7Hucys6BRvi82oP4/z6himo6A83ojKgqmUdrinl:3A23u2XD3imOz6ImoifgRUdq
TLSH
T15CF2BF34D855DE71DCEBA2C9B5463B936FF4123394C86E94E5EE6F0D0283A5E131B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

9a23ad07-89e9-45a9-9dfc-57a66435dc8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\9a23ad07-89e9-45a9-9dfc-57a66435dc8a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1692_1508334653\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/484-612-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/600-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/712-564-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1648-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-733-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-714-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2844-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-583-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3044-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-559-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3508-579-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3716-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-736-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4784-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-230-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4996-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-689-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5664-687-0x0000000000010000-0x0000000000083000-memory.dmp

Download