2f6dac29b8fb17ff1b669ec3110d7825fcf1009258676d3d68339c9ac6be5d6d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe
Size 243KB
Sample260805-tbjd5acc39
SHA256 2f6dac29b8fb17ff1b669ec3110d7825fcf1009258676d3d68339c9ac6be5d6d
MD5 6be938ba33f8e59fd6e5b8496bf745f2
SHA1 af275b8ba33004725d5fa6837f470338629e7c2d
SHA512 407101103c312781e6af911ff8c4a28a30b732ef04209e359a4698a7ed6c6fb89acc56b9c1f76c45019310060c5652a9015b5d6c847dc4694b97b9267a8c031d
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:bvMsLaOa3lLNngoqRttA7u
TLSH
T107345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3232	CP.exe
800	vqoigavsql.exe
1544	CP.exe
6064	CP.exe
2096	i_vqoigavsql.exe
2536	spnifaxsqk.sys
5364	CP.exe
1072	licausqkic.exe
5104	CP.exe
4956	CP.exe
3348	i_licausqkic.exe
3040	fzxspkicax.sys
1700	CP.exe
4720	cxvsnhfcxv.exe
1636	CP.exe
5752	CP.exe
4272	i_cxvsnhfcxv.exe
2700	fzxmkecxup.sys
5288	CP.exe
4972	usmkhczxup.exe
5656	CP.exe
5612	CP.exe
2252	i_usmkhczxup.exe
5000	hbzxrpjhfz.sys
2984	CP.exe
5012	zxrpezwuoj.exe
3352	CP.exe
2204	CP.exe
3848	i_zxrpezwuoj.exe
1576	ljebztrpjg.sys
3624	CP.exe
1768	ljebztromg.exe
5272	CP.exe
2148	CP.exe
1364	i_ljebztromg.exe
1868	ljgeywqojg.sys
4108	CP.exe
3400	mgeywqojgb.exe
2612	CP.exe
5112	CP.exe
4092	i_mgeywqojgb.exe
4888	gdbvtjdbyt.sys
3396	CP.exe
3724	bytqljdbvt.exe
1980	CP.exe
744	CP.exe
3288	i_bytqljdbvt.exe
5224	dbvtnlgdyw.sys
684	CP.exe
788	tnlxvqnifd.exe
5780	CP.exe
1844	CP.exe
5588	i_tnlxvqnifd.exe
3088	nigaysqnif.sys
4612	CP.exe
4432	ysqkidavsn.exe
2964	CP.exe
5076	CP.exe
5308	i_ysqkidavsn.exe
4608	xusnkicaus.sys
1992	CP.exe
1224	vpnhfzxspk.exe
5040	CP.exe
5804	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_211696658\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_211696658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4456_1382721599\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupmkeur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbytqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlxvqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_licausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvsnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvqnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigavsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigavsql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	licausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbytqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvqnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpezwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpezwuoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupmkeur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvsnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1856	ipconfig.exe
2112	ipconfig.exe
3348	ipconfig.exe
3336	ipconfig.exe
6140	ipconfig.exe
4884	ipconfig.exe
4752	ipconfig.exe
4252	ipconfig.exe
6064	ipconfig.exe
3044	ipconfig.exe
3308	ipconfig.exe
4132	ipconfig.exe
4608	ipconfig.exe
2220	ipconfig.exe
4760	ipconfig.exe
1048	ipconfig.exe
5968	ipconfig.exe
2960	ipconfig.exe
4880	ipconfig.exe
5888	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304188294600956"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{5592B11E-F23C-4DC9-A0B5-153C3B062BCE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2096	i_vqoigavsql.exe
Token: SeDebugPrivilege	3348	i_licausqkic.exe
Token: SeDebugPrivilege	4272	i_cxvsnhfcxv.exe
Token: SeDebugPrivilege	2252	i_usmkhczxup.exe
Token: SeDebugPrivilege	3848	i_zxrpezwuoj.exe
Token: SeDebugPrivilege	1364	i_ljebztromg.exe
Token: SeDebugPrivilege	4092	i_mgeywqojgb.exe
Token: SeDebugPrivilege	3288	i_bytqljdbvt.exe
Token: SeDebugPrivilege	5588	i_tnlxvqnifd.exe
Token: SeDebugPrivilege	5308	i_ysqkidavsn.exe
Token: SeDebugPrivilege	5644	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	4276	i_usmkecxupm.exe
Token: SeDebugPrivilege	4948	i_fcxupmkeur.exe
Token: SeDebugPrivilege	4568	i_hbztrmjecw.exe
Token: SeDebugPrivilege	1864	i_bzwrojhbzt.exe
Token: SeDebugPrivilege	3344	i_ljgbytqljg.exe
Token: SeDebugPrivilege	1064	i_qlidbvtqlj.exe
Token: SeDebugPrivilege	3500	i_idbvqnlfdy.exe
Token: SeDebugPrivilege	2756	i_kicaxsqkic.exe
Token: SeDebugPrivilege	4360	i_xrpnhfcaus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 4816	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	89
PID 4816 wrote to memory of 4456	4816	iexplore.exe	90
PID 4456 wrote to memory of 4084	4456	msedge.exe	91
PID 4456 wrote to memory of 1752	4456	msedge.exe	93
PID 4456 wrote to memory of 2792	4456	msedge.exe	94
PID 4456 wrote to memory of 1752	4456	msedge.exe	93
PID 4456 wrote to memory of 1752	4456	msedge.exe	93
PID 4456 wrote to memory of 5756	4456	msedge.exe	95
PID 4456 wrote to memory of 5756	4456	msedge.exe	95
PID 4456 wrote to memory of 5928	4456	msedge.exe	96
PID 4456 wrote to memory of 5928	4456	msedge.exe	96
PID 4456 wrote to memory of 5928	4456	msedge.exe	96
PID 4456 wrote to memory of 2004	4456	msedge.exe	97
PID 4456 wrote to memory of 2004	4456	msedge.exe	97
PID 4456 wrote to memory of 2004	4456	msedge.exe	97
PID 4456 wrote to memory of 5972	4456	msedge.exe	99
PID 4456 wrote to memory of 2436	4456	msedge.exe	98
PID 4456 wrote to memory of 5972	4456	msedge.exe	99
PID 4456 wrote to memory of 5972	4456	msedge.exe	99
PID 4456 wrote to memory of 2436	4456	msedge.exe	98
PID 4456 wrote to memory of 2436	4456	msedge.exe	98
PID 4456 wrote to memory of 3300	4456	msedge.exe	101
PID 4456 wrote to memory of 3300	4456	msedge.exe	101
PID 472 wrote to memory of 3232	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	102
PID 800 wrote to memory of 1544	800	vqoigavsql.exe	105
PID 4456 wrote to memory of 4336	4456	msedge.exe	109
PID 4456 wrote to memory of 4516	4456	msedge.exe	108
PID 4456 wrote to memory of 4336	4456	msedge.exe	109
PID 4456 wrote to memory of 4516	4456	msedge.exe	108
PID 4456 wrote to memory of 1308	4456	msedge.exe	111
PID 4456 wrote to memory of 1576	4456	msedge.exe	112
PID 4456 wrote to memory of 1576	4456	msedge.exe	112
PID 4456 wrote to memory of 4120	4456	msedge.exe	113
PID 4456 wrote to memory of 4120	4456	msedge.exe	113
PID 4456 wrote to memory of 5468	4456	msedge.exe	116
PID 4456 wrote to memory of 5468	4456	msedge.exe	116
PID 4456 wrote to memory of 3724	4456	msedge.exe	117
PID 4456 wrote to memory of 3724	4456	msedge.exe	117
PID 472 wrote to memory of 6064	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	118
PID 472 wrote to memory of 5364	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	122
PID 1072 wrote to memory of 5104	1072	licausqkic.exe	124
PID 472 wrote to memory of 4956	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	127
PID 472 wrote to memory of 1700	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	131
PID 4720 wrote to memory of 1636	4720	cxvsnhfcxv.exe	133
PID 472 wrote to memory of 5752	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	136
PID 472 wrote to memory of 5288	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	140
PID 4972 wrote to memory of 5656	4972	usmkhczxup.exe	142
PID 472 wrote to memory of 5612	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	145
PID 4456 wrote to memory of 2096	4456	msedge.exe	148
PID 4456 wrote to memory of 4668	4456	msedge.exe	149
PID 4456 wrote to memory of 5796	4456	msedge.exe	150
PID 472 wrote to memory of 2984	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	153
PID 5012 wrote to memory of 3352	5012	zxrpezwuoj.exe	155
PID 472 wrote to memory of 2204	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	158
PID 472 wrote to memory of 3624	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	162
PID 1768 wrote to memory of 5272	1768	ljebztromg.exe	164
PID 472 wrote to memory of 2148	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	167
PID 472 wrote to memory of 4108	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	171
PID 3400 wrote to memory of 2612	3400	mgeywqojgb.exe	173
PID 472 wrote to memory of 5112	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	176
PID 472 wrote to memory of 3396	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	180
PID 3724 wrote to memory of 1980	3724	bytqljdbvt.exe	182
PID 472 wrote to memory of 744	472	2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe	185
PID 4456 wrote to memory of 3576	4456	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_6be938ba33f8e59fd6e5b8496bf745f2_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:472
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd169fc188,0x7ffd169fc194,0x7ffd169fc1a0
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,17523060446267223107,2432713825139670996,262144 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,16999212757152218802,16834380416879793755,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3280 /prefetch:11
      4⤵
      System Time Discovery
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2420,i,16219529099033789610,724304017675716610,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:13
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3364,i,4806539456598991622,15634275590782505992,2097152 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3372,i,1475559045358616117,15615138709022746736,2097152 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,202750155997835644,304861779149957455,2097152 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:9
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,1251601189067295124,2686396097547710903,2097152 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,11499470139200064080,10684525780063686667,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3268,i,12449425348664872285,590014398943829839,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,13153777770233860964,5618012860888969729,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3801522236704854285,2989596764806630253,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,3801522236704854285,2989596764806630253,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,10825301755964833186,1952261064686924342,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,9317084518627254256,3530509951753635240,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,17913928125887146798,1164620705794698596,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,6548821861935658657,10375029442083387953,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,4454129666630484558,6064428935981521627,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,15185064523580394962,4632633198600043006,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1444,i,14782320349328576896,9105456614697851352,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,9508285128809347440,3267068626278339683,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,9319416700562892818,15304855235995386186,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6724,i,16476090708177806249,62706219877708575,262144 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,9106493538085706364,12603308027046123987,524288 --field-trial-handle=2544,i,991019417339061798,10712108426449260766,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigavsql.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3232
- - C:\Temp\vqoigavsql.exe
    C:\Temp\vqoigavsql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigavsql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\i_vqoigavsql.exe
    C:\Temp\i_vqoigavsql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\licausqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Temp\licausqkic.exe
    C:\Temp\licausqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_licausqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_licausqkic.exe
    C:\Temp\i_licausqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvsnhfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1700
- - C:\Temp\cxvsnhfcxv.exe
    C:\Temp\cxvsnhfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvsnhfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5752
- - C:\Temp\i_cxvsnhfcxv.exe
    C:\Temp\i_cxvsnhfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkhczxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5288
- - C:\Temp\usmkhczxup.exe
    C:\Temp\usmkhczxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkhczxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5612
- - C:\Temp\i_usmkhczxup.exe
    C:\Temp\i_usmkhczxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpezwuoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2984
- - C:\Temp\zxrpezwuoj.exe
    C:\Temp\zxrpezwuoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpezwuoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2204
- - C:\Temp\i_zxrpezwuoj.exe
    C:\Temp\i_zxrpezwuoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebztromg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3624
- - C:\Temp\ljebztromg.exe
    C:\Temp\ljebztromg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebztromg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\i_ljebztromg.exe
    C:\Temp\i_ljebztromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:744
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlxvqnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:684
- - C:\Temp\tnlxvqnifd.exe
    C:\Temp\tnlxvqnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlxvqnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\i_tnlxvqnifd.exe
    C:\Temp\i_tnlxvqnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkidavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\ysqkidavsn.exe
    C:\Temp\ysqkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkidavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\i_ysqkidavsn.exe
    C:\Temp\i_ysqkidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\vpnhfzxspk.exe
    C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5804
- - C:\Temp\i_vpnhfzxspk.exe
    C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupm.exe ups_run
  2⤵
  PID:6024
- - C:\Temp\usmkecxupm.exe
    C:\Temp\usmkecxupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupm.exe ups_ins
  2⤵
  PID:4356
- - C:\Temp\i_usmkecxupm.exe
    C:\Temp\i_usmkecxupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupmkeur.exe ups_run
  2⤵
  PID:4404
- - C:\Temp\fcxupmkeur.exe
    C:\Temp\fcxupmkeur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupmkeur.exe ups_ins
  2⤵
  PID:5600
- - C:\Temp\i_fcxupmkeur.exe
    C:\Temp\i_fcxupmkeur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run
  2⤵
  PID:5148
- - C:\Temp\hbztrmjecw.exe
    C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins
  2⤵
  PID:2784
- - C:\Temp\i_hbztrmjecw.exe
    C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwrojhbzt.exe ups_run
  2⤵
  PID:3604
- - C:\Temp\bzwrojhbzt.exe
    C:\Temp\bzwrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwrojhbzt.exe ups_ins
  2⤵
  PID:3580
- - C:\Temp\i_bzwrojhbzt.exe
    C:\Temp\i_bzwrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgbytqljg.exe ups_run
  2⤵
  PID:5096
- - C:\Temp\ljgbytqljg.exe
    C:\Temp\ljgbytqljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgbytqljg.exe ups_ins
  2⤵
  PID:4348
- - C:\Temp\i_ljgbytqljg.exe
    C:\Temp\i_ljgbytqljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtqlj.exe ups_run
  2⤵
  PID:4240
- - C:\Temp\qlidbvtqlj.exe
    C:\Temp\qlidbvtqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtqlj.exe ups_ins
  2⤵
  PID:4568
- - C:\Temp\i_qlidbvtqlj.exe
    C:\Temp\i_qlidbvtqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvqnlfdy.exe ups_run
  2⤵
  PID:2680
- - C:\Temp\idbvqnlfdy.exe
    C:\Temp\idbvqnlfdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvqnlfdy.exe ups_ins
  2⤵
  PID:6020
- - C:\Temp\i_idbvqnlfdy.exe
    C:\Temp\i_idbvqnlfdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxsqkic.exe ups_run
  2⤵
  PID:2472
- - C:\Temp\kicaxsqkic.exe
    C:\Temp\kicaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxsqkic.exe ups_ins
  2⤵
  PID:5132
- - C:\Temp\i_kicaxsqkic.exe
    C:\Temp\i_kicaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpnhfcaus.exe ups_run
  2⤵
  PID:2780
- - C:\Temp\xrpnhfcaus.exe
    C:\Temp\xrpnhfcaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpnhfcaus.exe ups_ins
  2⤵
  PID:1964
- - C:\Temp\i_xrpnhfcaus.exe
    C:\Temp\i_xrpnhfcaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1712

C:\Temp\spnifaxsqk.sys
C:\Temp\spnifaxsqk.sys
1⤵
- Executes dropped EXE
PID:2536

C:\Temp\fzxspkicax.sys
C:\Temp\fzxspkicax.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\fzxmkecxup.sys
C:\Temp\fzxmkecxup.sys
1⤵
- Executes dropped EXE
PID:2700

C:\Temp\hbzxrpjhfz.sys
C:\Temp\hbzxrpjhfz.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\ljebztrpjg.sys
C:\Temp\ljebztrpjg.sys
1⤵
- Executes dropped EXE
PID:1576

C:\Temp\ljgeywqojg.sys
C:\Temp\ljgeywqojg.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\gdbvtjdbyt.sys
C:\Temp\gdbvtjdbyt.sys
1⤵
- Executes dropped EXE
PID:4888

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\nigaysqnif.sys
C:\Temp\nigaysqnif.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\xusnkicaus.sys
C:\Temp\xusnkicaus.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\causmcausm.sys
C:\Temp\causmcausm.sys
1⤵
PID:4568

C:\Temp\czxrpnhfzx.sys
C:\Temp\czxrpnhfzx.sys
1⤵
PID:1800

C:\Temp\kecwuomgez.sys
C:\Temp\kecwuomgez.sys
1⤵
PID:2756

C:\Temp\dbwtoljhbz.sys
C:\Temp\dbwtoljhbz.sys
1⤵
PID:5548

C:\Temp\rljgebwtom.sys
C:\Temp\rljgebwtom.sys
1⤵
PID:5868

C:\Temp\bytqlidbvt.sys
C:\Temp\bytqlidbvt.sys
1⤵
PID:5644

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:2960

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
PID:200

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvsnhfcxv.exe

Path C:\Temp\cxvsnhfcxv.exe
Size 243KB
SHA256 01b17721e492cdbc24d6972320a2e1a103571d1370a305a0d4b36dcb90cab57e
MD5 2cde879c16ec3c1739d7adf21e93d53d
SHA1 5ae19f4a6e51715bc85d18b43610495103a78933
SHA512 989ae0efa94885391a2fb27cea114a0c13d4ec9bdeae0f9c720ead2cf1046166d967da0f5d69a7e1528244729c9a87aaf35db1149382a1adfcb8cd6d1b574002
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:svMsLaOa3lLNngoqRttA7H
TLSH
T1A5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxmkecxup.sys

Path C:\Temp\fzxmkecxup.sys
Size 141KB
SHA256 acb080c6089b52d32e967dce7c1e90d39983ccee4b321eee2778106bba360b7c
MD5 18fbcd099c6129f7e5ae78ca8f0c6edc
SHA1 cda9942d8ae7c9a805ef06867f3e51653d6b0eb8
SHA512 0036620dd99ab86f9b1ef5d22c4648f1ab2aaecf7a7388bedff5dec4ee8fe84a76c7bbf65b0d6327a8e63518e6852158f72259b4117370f2f3e2dd4596c15e64
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicax.sys

Path C:\Temp\fzxspkicax.sys
Size 141KB
SHA256 c99b72d47224f6320e289aafd2528023ca5e1276c19e7304b076e264c7522e4c
MD5 7d7e4f2dd3b1a20e4219a4a24176b475
SHA1 0a1e21c923d163c150a20359a160ca5c4b233e4d
SHA512 0e0727fb93363f276dcbeb57b2ef1c0dd57682aeb9672863b862a6406f8719e15d92fe54e99f63d08ee0d53a655512709cd8815b075cdea1c1ee49d599d4cbd5
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxrpjhfz.sys

Path C:\Temp\hbzxrpjhfz.sys
Size 141KB
SHA256 2f77386469d2fabb8f468979e9d04e4cbfd50c9dfc97e1dfd67a54a830ec2d7d
MD5 3dfa5ea9d22da748dee6ded701802fa9
SHA1 9df472ed890c903bbbea8c545deed71503046962
SHA512 2a8fd5e7610ab785019ce9c67e9c58a0e25b99e64a60ace7feb592c69a4faa93e6bc33b516024c69bf3ced566c878d8dc978dd93c9c678324e348568cfdb13ca
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvsnhfcxv.exe

Path C:\Temp\i_cxvsnhfcxv.exe
Size 243KB
SHA256 6af22a9c37824229a7c716d09ca7d6a34ecd3a466eb652d9ff9631bb471330e7
MD5 db40d90a11dff1df9df82f8fe8810cb7
SHA1 65b9c27daaeae1f080b7089473e35f15f775d920
SHA512 b9d028e3eff47cd3b22789846b3a31ff02bf3187135539d43b69da9c6a7015802bf4edff856815335cd361538f57d6dc55bec2ad9697858fcf59c1131b1400d1
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:gvMsLaOa3lLNngoqRttA7T
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_licausqkic.exe

Path C:\Temp\i_licausqkic.exe
Size 243KB
SHA256 cc05505e6b657e55c0bc35f2665d01f2f69329eb4d7f077de864f597940c4674
MD5 75059b5c022eeec7f2c529a17f969974
SHA1 e169b4b5d630ece79be91134d94c0aa255828e70
SHA512 ef3692c20a5a502eb3cbadaae08846964233ebbb682d66b5076bab32a726e7a1d6ebcc0f17884b67ae4931dfe3b0e403a9bd36faeaad5b619961d632f0efd22b
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:vvMsLaOa3lLNngoqRttA7a
TLSH
T15B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebztromg.exe

Path C:\Temp\i_ljebztromg.exe
Size 243KB
SHA256 ab3ac7a113ffbf1862b16e527aa2d916b408d4560771801134f5489c0491b79d
MD5 ef878eddc721573fc2e11ea9610323d9
SHA1 a09a4958c2e5c012fb33dff0010f05427f7b4b96
SHA512 bf6b8d18147f625ed0fd072f046fc2a5c5a21c2bab364541f2dd5e74dd4d314df7349af467ee47b13d261c6f9dbd09e9f39e0de6007119d344a917cdb2f51823
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:ZvMsLaOa3lLNngoqRttA7I
TLSH
T16A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhczxup.exe

Path C:\Temp\i_usmkhczxup.exe
Size 243KB
SHA256 a3afa30723f839029277ee61d1481567dc2276ba1fe544dd28164ec0edcef99e
MD5 5bcec28689ce3401baafdee0090cbadf
SHA1 5384d0921c92fa0231c646cd994da4692e7ed3d9
SHA512 2fcd02619a680f5322a34d990584319e3abf3c6e5de24f5f7e5a018692ed127ae36db52803daa3e870929a168b4fa359aa86f0a67d728c1b5837f7afae15e8e0
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:ovMsLaOa3lLNngoqRttA7z
TLSH
T124345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigavsql.exe

Path C:\Temp\i_vqoigavsql.exe
Size 243KB
SHA256 473229a4937d8332490542a3e654ca43c8d40f083c526b4892de249cdecf45b6
MD5 3f98264f137575d9d2780f93ea2edc93
SHA1 3ce7db06d32cf5d3a9e4f644d62e7d60a6334683
SHA512 4ea209bba1f41d7bbc9f0b6a94c92c52767bcdc638fe9148f719406068f0b7d9f4116fbef54f8af398bb327469ccde4689d73d7c50aec33abf94a810070c5f5d
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7X:gvMsLaOa3lLNngoqRttA7X
TLSH
T19F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpezwuoj.exe

Path C:\Temp\i_zxrpezwuoj.exe
Size 243KB
SHA256 2ab9559e15f0a5bac14e2917a1d9fc62292bd8272f77e2b0531a9d55b6cb291b
MD5 45dab6e429e6a230c3833ff2c77ba9b9
SHA1 fede5b4494c72e97e6355dde4fdc6a9f0ec2190f
SHA512 b6534fe5b61547364dc156e85f2d9d9a17f4cda4eab215cf2cb7e21b15cff7252c58b4959eeb7e8743f62eb682d23a85034b2bfcdade6fb0262dda72a79cf9e0
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:JvMsLaOa3lLNngoqRttA7E
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

licausqkic.exe

Path C:\Temp\licausqkic.exe
Size 243KB
SHA256 28a0c98405f62d1e76a49813d9446dd6edac38d21cfe919ee48f4dfef937fb88
MD5 adb1486c7aba54d69dc73ef798e9b0cb
SHA1 385c8387f9136b5b72b7ee1031c8a69ffedda5e2
SHA512 32a3218c2c946f386c6838600e1b0d2f7a6ce1c050fe8eaf12b332e8521f40efacb12e512c8af2c10242c2535b21c3e49f981673caeae749675bafadb7c61010
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:1vMsLaOa3lLNngoqRttA78
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztromg.exe

Path C:\Temp\ljebztromg.exe
Size 243KB
SHA256 a6407dead5884d7bc8af5296272582b00ca3a74f90c5a70d4eb25ab5b141584e
MD5 a018aef229addf025fd9a01f4cdfc223
SHA1 9bff616ed6b72df645106aef433193c3c9aa9f34
SHA512 e1bec11b87233bb4362179475fdc77e51c4b88a4e8210a6a87e2bc0e5e8482a994f9c2316bfb75cb773d538ba3868be814d29e55a975bc226999a3f4f9b5e24d
SSDEEP 3072:YCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:DvMsLaOa3lLNngoqRttA7u
TLSH
T15B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztrpjg.sys

Path C:\Temp\ljebztrpjg.sys
Size 141KB
SHA256 a2d89cfbab169053893982377d32437d5ee7de767150b054d5a31802ba257c61
MD5 7433bf4347fc59edccb6b34d093e8b42
SHA1 9ec095372cdab6efcfc4e162e9af5cebcbb5c038
SHA512 1f754bd98f8d5401e15fab15c8eb120a12520a0135d10187411929589f72669ed76300fdea3794f7efeb545a2798352a00a3560d71c80c9f682b89f6bcedf180
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnifaxsqk.sys

Path C:\Temp\spnifaxsqk.sys
Size 141KB
SHA256 958dd7b0c2f1a8b4148e1622367f4a1427fe7fd16374354bb804ca737180d820
MD5 cb8ec98ef7a1d4bcef03fbe288716641
SHA1 fe3d51f6fad725185c1a30ca190e04cbd16e2e89
SHA512 8603992c1fd25f0a053e05995fedf4d1148e675503df28a9f62ae997d90d0d7c791a7c9417d559b77a65c675a8a859c0c7a5a7ea9dfe0e18b3fa8a23edf77f22
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhczxup.exe

Path C:\Temp\usmkhczxup.exe
Size 243KB
SHA256 74f13bda809b526cb054f35bbf32bfead759445a32b425c0ecd35c4a5c6f9ee8
MD5 c41b0d2fc62e47b9ee10fed7edb13293
SHA1 4a4ed3a1c8f5c473f5e69aa27d174b5dd6e987a8
SHA512 534727a483f8ab2150743fa5d959fb0f758baabae8c56fb30d662d68011831289a3b078086967e9ef155881b1c80de4c21ee1c7fad3bd71f19418dda188a951c
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:1vMsLaOa3lLNngoqRttA7c
TLSH
T1BD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigavsql.exe

Path C:\Temp\vqoigavsql.exe
Size 243KB
SHA256 5c99c674dfacbcccddf404291b22747e8943515441ff8fdfebd89b50ce51ca4f
MD5 0f0d3c2282e5964960ada177be3c1f9c
SHA1 0cdeef58bc72fd8891496a73dcfcd8859f1cbbcd
SHA512 fe7ce981729c844afb608bd607d2ac01bb760dbb623f5d0a63c1e6556c7244d36cf2a76b33280776210ad6fc0c70335f8a29f88bc6362c4f139e5d2d24a89ce9
SSDEEP 3072:UCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:nvMsLaOa3lLNngoqRttA7m
TLSH
T1B1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpezwuoj.exe

Path C:\Temp\zxrpezwuoj.exe
Size 243KB
SHA256 50c99a6210faffa2025473f7142e0dca7cff4eaa064049f79678c6e09c69f9fc
MD5 9eead3a48f8b0db20f22b89986e3e44a
SHA1 0d1a560a8f383988279d9f027f7e090041855f38
SHA512 a59c14b15145593e311144c1e4357373d4f370849a370a2c8733f2881461329855040769b4830bfd7f7b6e9dd07158a81909959ab0fbaf2bb6c5116a1eecc1fd
SSDEEP 3072:+CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7M:xvMsLaOa3lLNngoqRttA7M
TLSH
T15F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 350f9108ced8679df41dbb057a2efe24d834c730df76fa536d212934f43d69be
MD5 d9a82df9d1d0fb781e8b8b44eadc3ce2
SHA1 f03f914e0b70d03604d0ae6594420522e2b49e95
SHA512 69334184db939df3d3b36377e5bd6d5377c7559b79676ae36506a6e8e2dc5172e6d4842165836b23713b7415565826720fd458a52777ae815f9c1b074bad6cdc
TLSH
T10A611970733E08E2C3606CB2A0DA5456BEF8BB71C147AE55A8C4EFB40951FC4A1E95E7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5902f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5902f4.TMP
Size 3KB
SHA256 615707417ac4567e9a56ee866d4a6867c974b16af4256936b01cb6ae28be8496
MD5 84130a2a068c6eedd81ba5c10d027858
SHA1 1fa4fcadd0709c37748ff346f7b3f655a7654fc8
SHA512 7139239001bc1937ec24c6f7638a47ab39699bbda783c6c08a7a8110658d8e32b202b2f1fb81aa5bc11a981748f55852824f4ce655278f65c3a9dfb82e65f8b2
TLSH
T14E611974733E08E2C3606CB1A0DA5456BEF8BB71C147AE5298C4EFB40911FC4A1E91E7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3608200e1398dc8851611b99d70924846a569e5f213e2d4a73d69774476c36f1
MD5 add024dfe8951cb5290be67ad3134611
SHA1 5702aabae0c46fc35313c14f77d7bd08542c56ed
SHA512 6b86aa0d12f04bc12a724345da6332e706e58152d600ae84f61925a712a33535e78f944a915184027e1fb9072369d82c57b62a74c34274886d2d0351d4757b03
TLSH
T14651BEF7C6E8866E890156F0AB187E2BCE1D0914532C3D5AC8E4EF6B93E3471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1484a28c21dc292efd64af7ea80a662aac1c0c4d47d713f043f0a9006a4a653a
MD5 ac8b0df761e9c8ceeaf40ced00048116
SHA1 8fc3dbf185a4ccf669f76a2376e5c58949f087ef
SHA512 4481e1dc91ca947735c6f025c8b259c94f7f30cea4de183ac320251c1f91da69fd1650e5a2e31b720811a36198e13615b0e09327ee1d02d0e2be379e9e9533ef
SSDEEP 192:sxR+R5Cs/fnsaRSZivIzoD8p98/g6+WNCTQ/Y3yLQGdIgV8E7XJ:sxR+ms/fnsaR0Fy/5t/pxx5
TLSH
T1E842D9156E28A93B8CCBE219BA557F53D6F96132A1D41E48F7FC960C00E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a06902608ff576e2e4e148efbc60f37de8ad113369774e1faf53aa16ba8ee102
MD5 f888427da67a64b8407d0679c728364a
SHA1 49a2037d1c0a4fc919584d9462f53a6c1edeb0a6
SHA512 c7848105b02d8e88fccd31c969aaa8138928f144b90e22e6104c8375a1c209d60da4e958128852bf0e91f41e5897b90a441b028de068f1c92284701d1fc12ecb
SSDEEP 192:sxRtR5Cs/fns5HSZivIzoD8p98/g6+WNCTQ/Y3/QGdIgDl8E7XJ:sxRtms/fns5H0Fy/5t/a95
TLSH
T15D42DA15AD28693B4CCBE219BB557F53E2F9613261D41E48F7FC9A1C00E66CD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f78e21dbec2401effbed691ce8e01a50ab0a0d3eb1831ed5494492b9fc3f4cc
MD5 3fe02317afa7df160823d3ba2c1da443
SHA1 6b053d6867ce91481f1271f8ccf4438b5a95b082
SHA512 3f9bc261b1746af3aad2c92aaac72514309822a83cdb31d06a1056178884c25716c73a743be3cfe446903259b96659c80903da31f780f69ae0e9b1a06ca36cce
SSDEEP 192:sxRtR5Cs/fns5RSZivIzoD8p98/g6+WNCTQ/Y3yLQGdIgDn8E7XJ:sxRtms/fns5R0Fy/5t/pxv5
TLSH
T1A942D915AE28A93B4CCBE219BB557F53D6F96132A1D41E48F7FC9A0C00E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7f49f551c5ab1f5c9687530828cb152e917eaf7ea590463d6e0fc75f557cd2da
MD5 35ba54adc7be0b705971d8ba8e1b9a06
SHA1 4dfe78e2675ea59b7ef47420d9bf0bf5e6bc5576
SHA512 13725cbe00c6afb97612b32fd6b2955153acf52fff58451b39d672517f5dcdd937e1d9dd597745997905a1d15cf3030175aa57057930557ee4f202c03faa0e6b
SSDEEP 768:GTEb7b7pLuLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPIgMWcuroxAiOY:GTEb7tEf3kWg0CfKsu1jasIgFclxPOY
TLSH
T1D7D2DA7B640DCB7F4F804ADDAC19BA9B6D6802CB9A98CD4047FE941C02C6BFE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f5415e23278c08909f4b90cbff5b9cec6cb0d6d51b2f5537f91eeca6c4c488e5
MD5 461907b9e6f2a9c0bd47ea55e5ee07be
SHA1 7f5090b574355ea93396b7882c64e2288ef22266
SHA512 a13aa78a1e877cc2eaba18f71882dd1c131245f48ee70400388642dcf389865681bdc5b94fc10103d3bae0d1545763ff145d698e60c17124cac7198e541467d1
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH8dIsGK+MW6XXg0MK4Zg+MccsXW8RuzyKW:C1i7PF/DWrwfX9mgpct1o7zsH8dIsGKw
TLSH
T127915462317E0250387E6D0C85A5D86E8A8274633558F42B77E806A51FBBE139EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3651d283-3f16-4d94-a4ab-740044243b40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3651d283-3f16-4d94-a4ab-740044243b40.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 617c130a44f6971521721ed0a5b744f7c59c005e5aab06e4d6af17ff089ebc8c
MD5 fa11c5cac13787857dab871ca2605360
SHA1 0c1f63c07d2e1c10619282a9041505b6fe33c81e
SHA512 a4aa78d45b2131b55b5e936ce17c33158d20bb770f6a4b3b56728f96ee31a6b87d9d91a0c9c10f1d7a4763d2c15755c81cb0166a0754eb7ac563b0d3382dcd6c
SSDEEP 768:yg337lc+wfZOOfvIfv9vShCQRHojKgqmUhT:yg3LwfdfQfVvSjfgRU1
TLSH
T1BFF2CF7098B56A739DE6A68977067B12BFE46123D5C81B84DEDC1F0D01436AE131FC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9e26bc75737ce12003b2654729ad6648dc78c9371a9f9d13085f54356562dd97
MD5 b89ae95210506fd4855d0f4da0ac7c04
SHA1 e25168375e2ad6511228e6de1047fc4b9768a412
SHA512 8b64e474b438d5f62f5f1f605ad8bbada6ee88cbaef74143d7b033bd56758dd1807abaa15a23bf6abcd7208828c1f91ff936be5b3a3fcd422ee2e64faf2070e8
SSDEEP 768:rg3APlc+wfZOOfvIfvUvShCQRHojKgqmUhT:rg3QwfdfQfMvSjfgRU1
TLSH
T1DEF2BF7098756A73DDE6A68977067B12BFE46123D5C80A84DEDC5F0D01436AE231F83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 829bef04c34aba9795885c763f8503b3e9c102827143503460d07fe92def99aa
MD5 1f356e5475fef2d5045287cc6c7011a9
SHA1 9cdef0b026d2e4cc5043a7636fe819f735ac7d96
SHA512 8ca01f2dddca0c92dc2f44bdf965299dbd8bc5b67c493fd6fabbc1a7e7276206ee8b78118cbb57cb1d97bd19bfe196ff8b0b5b5a18c6cad38416c0f840dcddab
SSDEEP 768:EFQa3Nwgq9FgtfZOOfvIfvHvShCQRHojKgqmUhT:na3PfdfQf/vSjfgRU1
TLSH
T19C1329F588E79677D9AE5787673D6E02AEBCD123B5885584BBC80D0CCC421BFD30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b95a651433f5207a092a8bfe84e2ead8bbebfda7ef23119be432c088824901a5
MD5 3a89587b44857c76f98d36d2ab49a3f9
SHA1 158c7dd68098706b464fc6fd588246ca123dcab1
SHA512 4177aefb4e54f7116b02e530997f41374eb3d36eddf90a96b5d5bf59991c65ab59c82a011e5372a5de907ab08597df79854c102907b4f1666782e9f1cdd552dd
SSDEEP 768:Rrv+4UNbd43BSkc+wfZOOfvnvShCQto2bwWV:RbsbO3BXwfdfvvSM0wO
TLSH
T14503CF32E868A9339DE792487646BBA37EB86163C8C54744DACD0B0D018369F371FC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b0655ef-934c-4589-87f0-e6012df1e6ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8b0655ef-934c-4589-87f0-e6012df1e6ec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe58d9f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe58d9f0.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

36d70f2d-bb46-4716-9c63-9c09180499d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\36d70f2d-bb46-4716-9c63-9c09180499d9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_951069356\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-671-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1576-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1800-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1800-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1868-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-691-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2536-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2700-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-624-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2960-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4568-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-591-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4888-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5224-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5548-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5644-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download