9fdf10c1794e60a96b93365e5fd10a712ec114c7c22976b2e137e71dbaab3fe6

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe
Size 243KB
Sample260805-vr2q3scp2x
SHA256 9fdf10c1794e60a96b93365e5fd10a712ec114c7c22976b2e137e71dbaab3fe6
MD5 e1d1bceda81e340712e570233660ca7e
SHA1 443cdcbf5c2f752baa1f832fe12e867aaa4b0186
SHA512 d56937873738ee7b14504baeefbf73ac62f27292397988740b3b2ea61523841e25dc2b8a5e82824eb47d332dddd2c18406b2488b1858bb4ee12cf69dba371a77
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:BvMsLaOa3lLNngoqRttA7g
TLSH
T1B8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4880	CP.exe
1156	zxsmkfxric.exe
1376	CP.exe
5784	CP.exe
4852	i_zxsmkfxric.exe
2084	zusmkhcaus.sys
3040	CP.exe
6124	rpmhecwupm.exe
524	CP.exe
2952	CP.exe
1668	i_rpmhecwupm.exe
4924	hbzxusebzw.sys
5544	CP.exe
5716	cwurmjhbzw.exe
2956	CP.exe
4872	CP.exe
2636	i_cwurmjhbzw.exe
4832	eywuomgezw.sys
1144	CP.exe
4212	bztrojhtrl.exe
5676	CP.exe
3960	CP.exe
928	i_bztrojhtrl.exe
3824	tomjebvtrl.sys
3460	CP.exe
852	oljdbywtom.exe
1184	CP.exe
2304	CP.exe
3724	i_oljdbywtom.exe
2896	lgdywqoiga.sys
5124	CP.exe
2756	dbvtnigdyw.exe
4696	CP.exe
3444	CP.exe
1368	i_dbvtnigdyw.exe
1452	idavtqlavt.sys
3388	CP.exe
2548	vtnlfdayvq.exe
4468	CP.exe
4796	CP.exe
5372	i_vtnlfdayvq.exe
1676	davsqnifay.sys
2040	CP.exe
4376	dyvpkicank.exe
4964	CP.exe
2936	CP.exe
2184	i_dyvpkicank.exe
2276	ausmkicaus.sys
1808	CP.exe
1648	spkicausmk.exe
1540	CP.exe
4080	CP.exe
4604	i_spkicausmk.exe
2868	khczurpnhf.sys
1016	CP.exe
5308	khfzxupnhf.exe
3900	CP.exe
6120	CP.exe
6108	i_khfzxupnhf.exe
4240	pmkecxupmh.sys
2880	CP.exe
4252	eczurmjezw.exe
1180	CP.exe
4664	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_1590843490\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_1984064133\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_183942798\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_1984064133\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_183942798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4864_95028036\_locales\ca\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxsmkfxric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojhtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvpkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavsqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavsqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojhtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurmjezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurmjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvpkicank.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurmjezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxsmkfxric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurmjhbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1836	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4596	ipconfig.exe
5740	ipconfig.exe
468	ipconfig.exe
4696	ipconfig.exe
468	ipconfig.exe
1472	ipconfig.exe
1776	ipconfig.exe
5808	ipconfig.exe
2892	ipconfig.exe
4688	ipconfig.exe
5616	ipconfig.exe
4940	ipconfig.exe
5644	ipconfig.exe
3672	ipconfig.exe
2916	ipconfig.exe
5868	ipconfig.exe
2220	ipconfig.exe
1368	ipconfig.exe
4960	ipconfig.exe
1576	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304236666475586"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{4BF60CE5-948E-4FED-B815-58909627C275}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2424	msedge.exe
2424	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	i_zxsmkfxric.exe
Token: SeDebugPrivilege	1668	i_rpmhecwupm.exe
Token: SeDebugPrivilege	2636	i_cwurmjhbzw.exe
Token: SeDebugPrivilege	928	i_bztrojhtrl.exe
Token: SeDebugPrivilege	3724	i_oljdbywtom.exe
Token: SeDebugPrivilege	1368	i_dbvtnigdyw.exe
Token: SeDebugPrivilege	5372	i_vtnlfdayvq.exe
Token: SeDebugPrivilege	2184	i_dyvpkicank.exe
Token: SeDebugPrivilege	4604	i_spkicausmk.exe
Token: SeDebugPrivilege	6108	i_khfzxupnhf.exe
Token: SeDebugPrivilege	3724	i_eczurmjezw.exe
Token: SeDebugPrivilege	4700	i_jhezwuomjh.exe
Token: SeDebugPrivilege	5848	i_gbztrljdbw.exe
Token: SeDebugPrivilege	4656	i_olgdbytqol.exe
Token: SeDebugPrivilege	4340	i_nlidavsqlf.exe
Token: SeDebugPrivilege	1760	i_fdxvtnkiga.exe
Token: SeDebugPrivilege	5664	i_xvpnhfaxsp.exe
Token: SeDebugPrivilege	4700	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	3588	i_ecwupmhecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2820	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	89
PID 2820 wrote to memory of 4864	2820	iexplore.exe	90
PID 4864 wrote to memory of 1132	4864	msedge.exe	91
PID 4864 wrote to memory of 1836	4864	msedge.exe	93
PID 4864 wrote to memory of 4836	4864	msedge.exe	94
PID 4864 wrote to memory of 4836	4864	msedge.exe	94
PID 4864 wrote to memory of 5732	4864	msedge.exe	95
PID 4864 wrote to memory of 4836	4864	msedge.exe	94
PID 4864 wrote to memory of 5732	4864	msedge.exe	95
PID 4864 wrote to memory of 1792	4864	msedge.exe	96
PID 4864 wrote to memory of 1792	4864	msedge.exe	96
PID 4864 wrote to memory of 1792	4864	msedge.exe	96
PID 4864 wrote to memory of 4588	4864	msedge.exe	97
PID 4864 wrote to memory of 4588	4864	msedge.exe	97
PID 4864 wrote to memory of 4588	4864	msedge.exe	97
PID 4864 wrote to memory of 3324	4864	msedge.exe	98
PID 4864 wrote to memory of 5868	4864	msedge.exe	99
PID 4864 wrote to memory of 3324	4864	msedge.exe	98
PID 4864 wrote to memory of 3324	4864	msedge.exe	98
PID 4864 wrote to memory of 5868	4864	msedge.exe	99
PID 4864 wrote to memory of 5868	4864	msedge.exe	99
PID 4864 wrote to memory of 1952	4864	msedge.exe	100
PID 4864 wrote to memory of 1952	4864	msedge.exe	100
PID 4864 wrote to memory of 4692	4864	msedge.exe	102
PID 4864 wrote to memory of 3756	4864	msedge.exe	103
PID 4864 wrote to memory of 4692	4864	msedge.exe	102
PID 4864 wrote to memory of 3756	4864	msedge.exe	103
PID 4864 wrote to memory of 2624	4864	msedge.exe	105
PID 4808 wrote to memory of 4880	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	106
PID 1156 wrote to memory of 1376	1156	zxsmkfxric.exe	109
PID 4864 wrote to memory of 4312	4864	msedge.exe	112
PID 4864 wrote to memory of 5016	4864	msedge.exe	113
PID 4864 wrote to memory of 4312	4864	msedge.exe	112
PID 4864 wrote to memory of 5016	4864	msedge.exe	113
PID 4864 wrote to memory of 1112	4864	msedge.exe	116
PID 4864 wrote to memory of 1112	4864	msedge.exe	116
PID 4864 wrote to memory of 984	4864	msedge.exe	117
PID 4864 wrote to memory of 984	4864	msedge.exe	117
PID 4808 wrote to memory of 5784	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	118
PID 4808 wrote to memory of 3040	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	122
PID 6124 wrote to memory of 524	6124	rpmhecwupm.exe	124
PID 4808 wrote to memory of 2952	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	127
PID 4808 wrote to memory of 5544	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	131
PID 5716 wrote to memory of 2956	5716	cwurmjhbzw.exe	133
PID 4808 wrote to memory of 4872	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	136
PID 4808 wrote to memory of 1144	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	140
PID 4212 wrote to memory of 5676	4212	bztrojhtrl.exe	142
PID 4808 wrote to memory of 3960	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	146
PID 4864 wrote to memory of 3712	4864	msedge.exe	148
PID 4864 wrote to memory of 5192	4864	msedge.exe	149
PID 4864 wrote to memory of 3532	4864	msedge.exe	150
PID 4808 wrote to memory of 3460	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	153
PID 852 wrote to memory of 1184	852	oljdbywtom.exe	155
PID 4808 wrote to memory of 2304	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	158
PID 4808 wrote to memory of 5124	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	162
PID 2756 wrote to memory of 4696	2756	dbvtnigdyw.exe	164
PID 4808 wrote to memory of 3444	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	167
PID 4808 wrote to memory of 3388	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	171
PID 2548 wrote to memory of 4468	2548	vtnlfdayvq.exe	173
PID 4808 wrote to memory of 4796	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	176
PID 4808 wrote to memory of 2040	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	180
PID 4376 wrote to memory of 4964	4376	dyvpkicank.exe	182
PID 4808 wrote to memory of 2936	4808	2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe	185
PID 4864 wrote to memory of 5176	4864	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e1d1bceda81e340712e570233660ca7e_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe9efec188,0x7ffe9efec194,0x7ffe9efec1a0
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,8182755700437888838,14904098571864469785,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:11
      4⤵
      System Time Discovery
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,5868260195492988528,12286009191376911621,262144 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,5771130532817976178,7805143448899004010,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,17738455227387923287,1298680212189633500,2097152 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,3550465818273783462,67906490201673625,2097152 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,6446500364839850273,10184153338348042308,2097152 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3845738106082515362,16381630479170772563,2097152 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:9
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,16165140135355448942,10846472045419350569,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,14534196854790290774,13685709027272338630,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,9822260730423453238,7593721443161522363,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16188633937279253345,7190084198506554189,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16188633937279253345,7190084198506554189,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3148505242347453242,105944667238870085,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16043156021490571556,7248655551582990225,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17735480169353517763,13228585768306391503,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,5884809406426883855,13082249601004890560,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,15943655656328071920,4129426294050455302,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,14415393512680482938,15581710118502905003,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,9215489450654429930,1679521230925351584,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3794769081170327167,7945747931491235760,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9203397549532206234,2219097576541536674,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,5441899831774168011,10791263506559870472,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,9072464784312389307,1282149821219621629,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6324,i,16730139094504989391,9768233945866360005,262144 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,6429879682981260418,10918656396436903133,524288 --field-trial-handle=2884,i,3174173875632693876,16788763035441053831,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxsmkfxric.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4880
- - C:\Temp\zxsmkfxric.exe
    C:\Temp\zxsmkfxric.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxsmkfxric.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5784
- - C:\Temp\i_zxsmkfxric.exe
    C:\Temp\i_zxsmkfxric.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3040
- - C:\Temp\rpmhecwupm.exe
    C:\Temp\rpmhecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2952
- - C:\Temp\i_rpmhecwupm.exe
    C:\Temp\i_rpmhecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwurmjhbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\cwurmjhbzw.exe
    C:\Temp\cwurmjhbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwurmjhbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4872
- - C:\Temp\i_cwurmjhbzw.exe
    C:\Temp\i_cwurmjhbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrojhtrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\bztrojhtrl.exe
    C:\Temp\bztrojhtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrojhtrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3960
- - C:\Temp\i_bztrojhtrl.exe
    C:\Temp\i_bztrojhtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljdbywtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3460
- - C:\Temp\oljdbywtom.exe
    C:\Temp\oljdbywtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljdbywtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\i_oljdbywtom.exe
    C:\Temp\i_oljdbywtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnigdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\dbvtnigdyw.exe
    C:\Temp\dbvtnigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnigdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\i_dbvtnigdyw.exe
    C:\Temp\i_dbvtnigdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdayvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3388
- - C:\Temp\vtnlfdayvq.exe
    C:\Temp\vtnlfdayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdayvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\i_vtnlfdayvq.exe
    C:\Temp\i_vtnlfdayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvpkicank.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2040
- - C:\Temp\dyvpkicank.exe
    C:\Temp\dyvpkicank.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvpkicank.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\i_dyvpkicank.exe
    C:\Temp\i_dyvpkicank.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1808
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfzxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1016
- - C:\Temp\khfzxupnhf.exe
    C:\Temp\khfzxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfzxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\i_khfzxupnhf.exe
    C:\Temp\i_khfzxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczurmjezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Temp\eczurmjezw.exe
    C:\Temp\eczurmjezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczurmjezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\i_eczurmjezw.exe
    C:\Temp\i_eczurmjezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwuomjh.exe ups_run
  2⤵
  PID:3908
- - C:\Temp\jhezwuomjh.exe
    C:\Temp\jhezwuomjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwuomjh.exe ups_ins
  2⤵
  PID:1452
- - C:\Temp\i_jhezwuomjh.exe
    C:\Temp\i_jhezwuomjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  PID:5796
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  PID:5720
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbytqol.exe ups_run
  2⤵
  PID:4316
- - C:\Temp\olgdbytqol.exe
    C:\Temp\olgdbytqol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbytqol.exe ups_ins
  2⤵
  PID:2444
- - C:\Temp\i_olgdbytqol.exe
    C:\Temp\i_olgdbytqol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidavsqlf.exe ups_run
  2⤵
  PID:2028
- - C:\Temp\nlidavsqlf.exe
    C:\Temp\nlidavsqlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidavsqlf.exe ups_ins
  2⤵
  PID:2636
- - C:\Temp\i_nlidavsqlf.exe
    C:\Temp\i_nlidavsqlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvtnkiga.exe ups_run
  2⤵
  PID:3692
- - C:\Temp\fdxvtnkiga.exe
    C:\Temp\fdxvtnkiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvtnkiga.exe ups_ins
  2⤵
  PID:2276
- - C:\Temp\i_fdxvtnkiga.exe
    C:\Temp\i_fdxvtnkiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsp.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\xvpnhfaxsp.exe
    C:\Temp\xvpnhfaxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsp.exe ups_ins
  2⤵
  PID:1932
- - C:\Temp\i_xvpnhfaxsp.exe
    C:\Temp\i_xvpnhfaxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:6052
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  PID:6012
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmhecw.exe ups_run
  2⤵
  PID:2836
- - C:\Temp\ecwupmhecw.exe
    C:\Temp\ecwupmhecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmhecw.exe ups_ins
  2⤵
  PID:5956
- - C:\Temp\i_ecwupmhecw.exe
    C:\Temp\i_ecwupmhecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5152

C:\Temp\zusmkhcaus.sys
C:\Temp\zusmkhcaus.sys
1⤵
- Executes dropped EXE
PID:2084

C:\Temp\hbzxusebzw.sys
C:\Temp\hbzxusebzw.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\eywuomgezw.sys
C:\Temp\eywuomgezw.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Temp\tomjebvtrl.sys
C:\Temp\tomjebvtrl.sys
1⤵
- Executes dropped EXE
PID:3824

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\idavtqlavt.sys
C:\Temp\idavtqlavt.sys
1⤵
- Executes dropped EXE
PID:1452

C:\Temp\davsqnifay.sys
C:\Temp\davsqnifay.sys
1⤵
- Executes dropped EXE
PID:1676

C:\Temp\ausmkicaus.sys
C:\Temp\ausmkicaus.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Temp\khczurpnhf.sys
C:\Temp\khczurpnhf.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\pmkecxupmh.sys
C:\Temp\pmkecxupmh.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\ecwuomjhez.sys
C:\Temp\ecwuomjhez.sys
1⤵
PID:1472

C:\Temp\jgeywuomge.sys
C:\Temp\jgeywuomge.sys
1⤵
PID:1576

C:\Temp\nlgdbytqoi.sys
C:\Temp\nlgdbytqoi.sys
1⤵
PID:5524

C:\Temp\vtqoigdywq.sys
C:\Temp\vtqoigdywq.sys
1⤵
PID:4604

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
PID:4800

C:\Temp\dxvpnkfdxv.sys
C:\Temp\dxvpnkfdxv.sys
1⤵
PID:2384

C:\Temp\spkicauspk.sys
C:\Temp\spkicauspk.sys
1⤵
PID:2160

C:\Temp\mkhfzxupmk.sys
C:\Temp\mkhfzxupmk.sys
1⤵
PID:1604

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrojhtrl.exe

Path C:\Temp\bztrojhtrl.exe
Size 243KB
SHA256 ba8954b03a6409bb5decfa868f56168496b9c2aae5fa2c37c29db2f7c7f0d88f
MD5 867177eb48732b4e6ca1cbe51db55ff3
SHA1 55d0687b104824f68e4ad1b4d9a3a014b43e892d
SHA512 48436ea06bbaffd6acef2d91343934c93692eed7c8ff8b33dc0b2bf6d119a9d7904349b3b038c9f818f8602d9c716d8a08ea7281651c79e9427ee40d513f5cb5
SSDEEP 3072:GCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:pvMsLaOa3lLNngoqRttA7g
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurmjhbzw.exe

Path C:\Temp\cwurmjhbzw.exe
Size 243KB
SHA256 1641faec0f76a2acc83651d1b4c13a24462598fbcb8149bddc685693abd1f195
MD5 91487b8c9fe6955aa70d4d3940335b9b
SHA1 cfc10415e542cc4af01f63b8f1e1ac57cbfae771
SHA512 a0a2771f230bcf51b62a20a06ca2a037cf9e3403c2e97b26d2fa5b5abf3513603b35838a797cc24b756471dbe12f11f57411aed5c8bffd7aa6ce8aaaaf29bd7b
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:FvMsLaOa3lLNngoqRttA7E
TLSH
T1B2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnigdyw.exe

Path C:\Temp\dbvtnigdyw.exe
Size 243KB
SHA256 b70c3dab1afc20e8df2b1602a62dea05cc4be149527570ff3c523533547cbfa6
MD5 b184a87ed90f2f0a0510eace478d95d2
SHA1 04e4f9d02dcf3c348750532c1055a182ce64a97b
SHA512 28b45b4236d50a083368f186fa6c7b59c3bb7c1894b8dedc366a1023e781486bac5bde296b7ac6899654070b1c59e06138ef9bbf1b87e8c1dba1e36dd401c06c
SSDEEP 3072:FCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:IvMsLaOa3lLNngoqRttA7b
TLSH
T170345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywuomgezw.sys

Path C:\Temp\eywuomgezw.sys
Size 141KB
SHA256 af72310e1ac2b5176e433d9791a6b3451a11e35ebadac2620091eb284d1fb165
MD5 886fb1f93735c8cb7a44b95bfae18354
SHA1 83f480503be2adabe8ff6618fe078d224e188fdd
SHA512 862dea06eadc6ce932531056ce1ae869e96b33a385a259a32fc083c4d1a8bbd8e56223f6ce1d5629f49d626e2504fd9134408eca1529c3e5635ff92cbf229355
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T110E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxusebzw.sys

Path C:\Temp\hbzxusebzw.sys
Size 141KB
SHA256 c8b964f23e1a337875b47e71276f7bf30c88550d95ab384375b052938522fcdd
MD5 38cdf60d40508e3c4941ab46c176e349
SHA1 5521880fb6a9f4a719215fa28df1afb10db2e1b1
SHA512 f6ff8875dcca6798ba36e8b2104ece7134c54b39ca3b15cf217a0a3849eb2eec8122679e1cca330d1978b036a9546385706912654326e74c14ac91258f8ecece
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrojhtrl.exe

Path C:\Temp\i_bztrojhtrl.exe
Size 243KB
SHA256 8a512d912acfe709e4c9729c68a40cbcc886834d8e964f1fb9f3f02e4c3b9f29
MD5 dbc7e045a546ecddeab3de4062c47a34
SHA1 6421321b23826f69f620bcdf5b1881f4bef81053
SHA512 fbe04fca1c71eb4fe8524c4ea0e9f76f872da9df7b6d05f70fbbcef33e3c35be20ca7c7e34536ac7a8e0093776072eddcca1de68f346309ebde4c6b700af4461
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:BvMsLaOa3lLNngoqRttA7g
TLSH
T117345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwurmjhbzw.exe

Path C:\Temp\i_cwurmjhbzw.exe
Size 243KB
SHA256 93a824ff5e7936d0935427491f149fe9c8b0d60405d09f2fd3d748c6c28942be
MD5 9a1f9db380f74b59ddf3293b2c40efb6
SHA1 da882e99bd017054b503d326f2c11d57d25e4b38
SHA512 f71641ff94d9a5fca3826b5f6efdf16adf9a316413f4d0e9f28343d2c190d7aa5b8dee5cec5a9774c31167259a55bac4c610f4c71e2706d06644d6762c59d0af
SSDEEP 3072:blCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7BV:0vMsLaOa3lLNngoqRttA7b
TLSH
T1AB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnigdyw.exe

Path C:\Temp\i_dbvtnigdyw.exe
Size 243KB
SHA256 8f4f2ff457e7a9f3bdad40ee5de407c5ca9cfb6783133036c68db532163228af
MD5 d34113fde26f1edbcf177d8b0cb7342d
SHA1 b195780d57c7a7498e06e0075998c6cd35e2fe80
SHA512 3725d195b079ea3fd21169bf3980616703c603de65318560b375b491e8853fe3c093e314e354ed0f6d2f20ce792cd74a659a90f22ad4511aacfca313ce837502
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:CvMsLaOa3lLNngoqRttA7p
TLSH
T151345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljdbywtom.exe

Path C:\Temp\i_oljdbywtom.exe
Size 243KB
SHA256 30c1415c564526a5fd92b0a79a21ed44b4da38f5bfcbee6ea2c0aba36270c788
MD5 df897db4f976c174020e94f9de3411cf
SHA1 2225d520fad85777b6391f0f868ef44de2d4900d
SHA512 9707b85baebb1e58ae4f1b8849c4c911b1a2251ebb7a01f5130baf3bf28887aa7ace48276ec8133bb0dd7fb3e4f1c7f2c08f771dd8b336da4e9f9540ecca9a9c
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:CvMsLaOa3lLNngoqRttA7p
TLSH
T1A4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhecwupm.exe

Path C:\Temp\i_rpmhecwupm.exe
Size 243KB
SHA256 130de3079e254dd063222ad480b413662627c44e8b194412dff56042786b0c99
MD5 ce143ffa3308cad7afa3f7fba3992b9d
SHA1 5bf6a54fd75cf4e043a373faff8bbe78b67ab1ec
SHA512 bdf71c798b7b2972b60f11dbf1e023be5256ee1e4e6f660658677626ec12e33f102406de3654dad64fdc737b1d09e02c8d685db8b483b0d418ba991bc9d4249c
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:GvMsLaOa3lLNngoqRttA7N
TLSH
T17B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxsmkfxric.exe

Path C:\Temp\i_zxsmkfxric.exe
Size 243KB
SHA256 8b71a0f85eefc27ef9fe4044ea629f950b0435366515d12ad0b4ff9aea5805a2
MD5 3ce2b23ca3986bee58f7d6f091337731
SHA1 aaf20ccbdb2e7c3714a284a21513804838e76d4c
SHA512 4e562d3f2ea55e33638b557a6a3c66018ed71b1ae1081a66465e4db3e478dc4fba76244767a2bc4cfe7a153ceb3eb2e075992c36eb8d202a5591998c400914e6
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7i:XvMsLaOa3lLNngoqRttA7i
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.sys

Path C:\Temp\lgdywqoiga.sys
Size 141KB
SHA256 4aa09321c9e7fe52daa4c44ad86e779a86348d6987713c3e70fb14fdf7329e57
MD5 780f5259ac43ef8e2cd76b12d5c0c514
SHA1 0b36220ef1982c56317238e000edce32a79ffa22
SHA512 6defad66a13cacfbf6616107b69de63a36b8c5298f369f3b454e892a8a2f477c8aa8ffa301825c7a20e1383eba2b2f0b273d39aa23e10304251c0992ac838d52
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T139E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbywtom.exe

Path C:\Temp\oljdbywtom.exe
Size 243KB
SHA256 738527cc5c91ae7df0d3fa4fffc3e068ca8a569216574781facc26ca685cd3ff
MD5 6cb434703b7330fe4142c5734cd6f4ae
SHA1 25fdafd984c2f50f1e7cfeb9a17450163f558748
SHA512 de5e83d5f66783ea976e5107bfe2c941b278ee5b4c11588641d3c3adf7eea9397ea88a28e4402d6ec300e275a5abe93a828b758d4d435b938165291b6516dec2
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:YvMsLaOa3lLNngoqRttA7f
TLSH
T198345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhecwupm.exe

Path C:\Temp\rpmhecwupm.exe
Size 243KB
SHA256 9bb19eca3b7ec40a1e8d89c84305fa7b04ed5aafaf5ca485a4350c7a0b24804d
MD5 52e3d11d8ddf0b6039ffc3528acd57ca
SHA1 d8c037b89da8290290779fd34c73ea226f3a8162
SHA512 8ff1e4ac9ff007947d389ec245af0d3175c8ee8bfe82953718678f4fdfff74da2b0fb5e2a412417d97f7f21b3c943a6b35ccd71773e47c812e5740a23b049bc1
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:jvMsLaOa3lLNngoqRttA72
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomjebvtrl.sys

Path C:\Temp\tomjebvtrl.sys
Size 141KB
SHA256 509ecb35a60d38dda2f02f99073a13caefdd3ff144239c93c964e11e80ee9e3f
MD5 de4e6b058c83698fac8666162bae3d69
SHA1 3f6a50aa405b2cec7edb27224f9970064b690a63
SHA512 0e8da98e4b00eee270ace069826a4e304fd177fe66e917a993f9e01be85e99398b8a762250f5484ff98916372f0aee7f0f5fe87a3110b488f1fedf618da04897
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkhcaus.sys

Path C:\Temp\zusmkhcaus.sys
Size 141KB
SHA256 02128482add6b5948abc8894d861d848f4d890d658bae134b6a5a74fa2ed7630
MD5 011a179f74f23b63e6fcfb4bef87fd58
SHA1 8ed1934a948e8d20dc64bdeeeac4fc4dbec7970a
SHA512 41c3e85792bcf672ef4474e931bc4aaa7ab66a275352804e49d641eb1b9fdfa4d8374b7f8ec50f617ba32c965beac22431a9d3f803cbc33ba1c73fba7e563812
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxsmkfxric.exe

Path C:\Temp\zxsmkfxric.exe
Size 243KB
SHA256 e84259a75bdd9fa3eae8f7136c6795f3378146d084ba76177be830fe757e746b
MD5 a55eccfda4180b0e9c5830153a83a66d
SHA1 b935c700517b8940c1a7cbfbd0113a2c1b420bfd
SHA512 5fcc1b11bbe1704f58de942403ecab8db18d9a556acd4305e15d6c623878dbc462da68541c493a0c84198768547dcd99d296c4ff14152d217660b61ae5e790aa
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:MvMsLaOa3lLNngoqRttA73
TLSH
T1AD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b26c02db8eaf971bcb357361e37e90cbda663c356334ab91ae73f151d277aa37
MD5 591942bfff0f970c5bd9add7a2852963
SHA1 e02588959a877a99c0b803f56f7c4277c18cfade
SHA512 6650668a31c7e16cf445a45efc937bdc840e6080b94f1eeee5d0595018e4c6207d8189697e7fcaed63d24035f89779b16bd2e25004ada5d3b4650bc02095b965
TLSH
T1F3516290A32E1ED3CBEBB9B2F9E104DA72F988558E434E02FC806EF46902F0470D1127
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5943a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5943a6.TMP
Size 2KB
SHA256 02bec32babb4162267dfe76a3ccb6d9e89e6a749540e5a067de288e52f75e67f
MD5 f9c4aaa306c7d7105e1e142be22f6cc0
SHA1 78c48d8a0b912cd6f1f9098daf233a4bc6987e85
SHA512 05b634e38d378b0c15e27d4f36413e8c39cfd6f80269ea112f565433054dccc1910876356b4bc4fee1d2989ebe312e24ea503ae66571d66a645530f8023c0c42
TLSH
T17C514290A36E1ED2C7EBB9B2F9E104DA72F988558E434E16FC906EF46902F0470D1127
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 52c3652b5a6f2912d1a24841c544c7a59c3f7ca476e0295052f74beafa7242ce
MD5 d2a2e0233969bf817bed3e7ee022d666
SHA1 88ecbd1e23726c4b650dd3611681409b94398420
SHA512 652170ea0398491d035eee996c52977b1162a43db0ae1e8cd7b8498356a37ed03b97fa8d59818e28645352de2cf4da9aff2b06e932bdb9fc1f3c1293d8c2ddf0
TLSH
T1B551C1F3C3E8856D890196F0AB147E2BCE1D0925432C3D5AC8E4EE6BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3d86f8ff82c5e3d31c7384e3c0c2195c21e8ebb6298f5a76f84dd056e02b5c22
MD5 9682e0e1c658389b0e9e1d5be95cda5d
SHA1 7a5a54ede6c262b32c9a9877a01af448f2541ccf
SHA512 7ee60a0aed28762e9114c20188a742466c58ec1f59308d08e74a5eacd649bf4bdd7b940857a1e4b775f937b77cab48a44bfcfc16752f6d78bd6714fe093bc4e0
SSDEEP 192:sxRuaRTCd/fvksFSCZfNn9zoA8p9C/g6+WNCjI/YZFLjRGCIgV8E35J:sxRua8d/fvksFSEVwA/5N/Sxlj
TLSH
T17442E8557928A93B4CC7D21DBA66BF53D3F96132A1911E48E6FC9A1C14EB6CD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5a9cb15e46f6e06d139466b4b7e7ac6ecb98f8b8adf842586895fcd627fc2327
MD5 cd8ddc8afc0dc7dcb1ca041bd5e68c99
SHA1 e369684fa4cc154bf091dc79ff04a65476054f99
SHA512 5dcb66ebceee2d6bdaa1f10aa0c41bb8f1d8b1d909c5bdc42035baace0eeff0a0f5e3dffdb6a8d70c4edc91b2b6c615733311a81f578e7b1f67033967f6e1304
SSDEEP 192:sxRraRTCd/fvksAsCZfNn9zoA8p9C/g6+WNCjI/YZFLlRGCIgD9+8E35J:sxRra8d/fvksAsEVwA/5N/SXmj
TLSH
T1B342E8557928A93B4CC7D21DBA557F53E3F86132A1911E48A6FC9A1C14FB6CD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5b82855e8db7d227d27a7b2c07b66b29a5b0cc9bb1714cf664c098ffe3bd3f4f
MD5 873f11850de5ef5fb5e4b11fa9b378d6
SHA1 563b847c94911a43de39a36533be0b22ceeeb776
SHA512 79ab2d5531dfa8238452f71c724939b5751c7dfe78a132ceb95f292aee957fc8cfe911798322a08c09c0778e2ebf01d814e50c696f1ae9078a5fe3ce677db09e
SSDEEP 192:sxRraRTCd/fvksASCZfNn9zoA8p9C/g6+WNCjI/YZFLjRGCIgD9M8E35J:sxRra8d/fvksASEVwA/5N/Sxwj
TLSH
T1DA42D8557928A93B4CCBD21DBB55BF53D3F96132A1911E48E6FC9A1C04EB6CD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4749e40e93c1bfe2e49cd198e54727c29188c9087c173864fde2a5cbc5d9d828
MD5 afaf9bb06fb48c7cd7eb6e9fd09526a0
SHA1 b138a4e5bcd341eeab5b020723115415862126f0
SHA512 41bf41ff4f6d2f3bfbf2af73fe86cd927943720999027fb4a9c4ff2fa45694949c4adc877b8443e84228e1377024e8228a88c9dfc102c87b947d669dc4f0fda7
SSDEEP 768:K80EqS7pLuLfrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmPowLWnroL+40:K80EqqEfrwWgNhfVNu1jalPogW0L+40
TLSH
T1B3D2D97B740DCA7E4F804ADDAC197E9A6DA802CB96D8CD8047FE841C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dbdf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dbdf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 23badbe40e7d1082cdfba8d520c1c4aefccf4e564ee2ee80ca90a59c0fdb0759
MD5 382b4ddc31fd7b1652563e9b5584d819
SHA1 d8a5f7eac43252e837a15503251d19c467a1dca1
SHA512 25034976e65a882ea4f69025dc5d39dccc7f9d27b07cc1131cb37835bce8d61bd772b183f9c9109f04d698bd3feaf7b6b2bd46c1b93d210dfe4ce14f13af9193
SSDEEP 768:Kp3bmE+LeSFOUI+HX4fouOToPvB2thtA9VAg5ojKgqmUthOG/:Kp3isnnwthtt4fgRUt8G/
TLSH
T168F2C0B1A4A98D63CDE9E298720A37825FF05173D5D00FD49AED9B0D0547ADD1B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4875865406a41e81c45581a8bc77d845acbe1906a67a3cbebc1a4239b0aab1d8
MD5 e851cb3397777bf340b52dc5b039213e
SHA1 5fb4c74220a7d045324580131a3c5e31917a3270
SHA512 00c5daddf428c99c10ad044072cab4f60c4fdfa712d26fc8dab9d8701045ffc9e9941c1ae58dd4f50af0f095d9168501065b6663448a4a5635328cdfffeaefc2
SSDEEP 768:XFQw3ywgCklh1OUI+PX4fouOToPvB2thtA9VAg5ojKgqmUthOG/:qw3Ssnnwthtt4fgRUt8G/
TLSH
T16B1338F194D78A37D8AE9787633D2E469AFCC163B5844A94BBD84D0CCC825BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 4f0f9cfe88dee48e69e0f06198786c438dc4b3687400a4086772bcc894cf5a39
MD5 aeee700cdadb804bd991ce6ea30e938d
SHA1 0f50eff30a0d9ddd522e8a28ce7e3e76ec345118
SHA512 b2e1cd7e1042914daa3795438744568f3b8822bca91d449610d153624a46272470ac1a0b02189368a389d40879b19bf3cd8d14267b15e319acd2ab236358bc55
SSDEEP 768:drv+4UNbdC3O7E+LeSFOUI+PX4fouOToPvB2thtA9VAg5ojKgqmUthOGE:dbsbU3Wsnnwthtt4fgRUt8GE
TLSH
T1B413CF71A06D8A63CDE6E298710B36872FF0116399C00FD4DAED5B4D064B9DE1B0FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c5191c79cf2228f5b65e39b943695b5ea6717e161d44ab5f69c89965b9ecf331
MD5 7ea0c0e6718d40300952a9965a64ef6b
SHA1 a1e1473240878eee9fbd5a1e30e7df3b39dfc576
SHA512 46760e0ca20b38546d974bf0279191c921b45ebfe69da91ae0b9506dcde20c647f2ddcb2084483784dfdfdd6768f016f674999f48cdc87b7d82dcfca119cd044
SSDEEP 768:grv+4UNbdH3G4+LeSFOUIfX4fouOToPvB2thtA9VAwxeVH1SlX:gbsbh3xsnnwthttUEH1Y
TLSH
T13303CF32A8AC8A33DDE6D398710B72572FF4916396900FD499DE1B4D079B9DD030BC6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 22981a4d657d6438fb5aea24f1429ef74b8e537cb18b4b89fa65b6297ac067c7
MD5 1f9432240243f0de5c99805a177f3ef8
SHA1 b527d7df7b38a4f371725b93e15f4ef3d3a3033a
SHA512 8dd6623eed95d76d1e559aba6a460c726e874c7cb036d806b742cd92e8a480416c719aee8e131bfd2de39341eea053fd237afb494210c3ee283443449f13dee0
SSDEEP 768:zp3amE+LeSFOUI+HX4fouOToPvB2thtA9VAg5ojKgqmUthOG/:zp3xsnnwthtt4fgRUt8G/
TLSH
T118F2C0B1A4A98D63DDE9E298720A37821FF05173D5D00FD89AED9B0D0547ADD0B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90a473aa-d632-4e44-abdb-3a17b1842137.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\90a473aa-d632-4e44-abdb-3a17b1842137.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe591989.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe591989.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

312fe515-1079-4142-87c2-108a55eadc8a.tmp

Path C:\Users\Admin\AppData\Local\Temp\312fe515-1079-4142-87c2-108a55eadc8a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4864_647856965\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1452-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1472-623-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1576-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1604-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2084-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2160-703-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2276-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-587-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3824-539-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3824-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4924-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5048-727-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5524-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download