b7c8b1694ec19497527b69ace392985794e0ebf2677a385557d467bd7250c5f2

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe
Size 243KB
Sample260806-syetsavbmf
SHA256 b7c8b1694ec19497527b69ace392985794e0ebf2677a385557d467bd7250c5f2
MD5 56ac02de9723e1a4380400736f17bf3d
SHA1 64dc05a400368f1f1f0ce7b923c968e0a004dd85
SHA512 4d18008efa638731886dbc66a8c10fbc87804ebcc1fc24389b15bb7590de93b97d2444ccc878aa81fde0516a07fa97ccf4557cb97bfec836f0d3acc32ac8ae9c
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:2vMsLaOa3lLNngoqRttA7N
TLSH
T175345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4360	CP.exe
5532	nlicavpnig.exe
2180	CP.exe
1364	CP.exe
1712	i_nlicavpnig.exe
5936	cusifausqk.sys
5200	CP.exe
3976	khfdxvpnhf.exe
3716	CP.exe
2400	CP.exe
940	i_khfdxvpnhf.exe
6024	fcxusmcxus.sys
4708	CP.exe
4124	pmhfzxupmh.exe
616	CP.exe
2276	CP.exe
2544	i_pmhfzxupmh.exe
4372	urpjhfzxup.sys
248	CP.exe
1040	jhezxuomke.exe
928	CP.exe
6052	CP.exe
4740	i_jhezxuomke.exe
5428	zurmkecwur.sys
4576	CP.exe
1156	urmkecwuom.exe
5948	CP.exe
1256	CP.exe
1936	i_urmkecwuom.exe
2096	rojgbztrlj.sys
5760	CP.exe
4536	wtomgebwtr.exe
1260	CP.exe
3108	CP.exe
5608	i_wtomgebwtr.exe
4080	oigbytqolg.sys
5632	CP.exe
5772	igebvtnlgd.exe
1252	CP.exe
1736	CP.exe
5468	i_igebvtnlgd.exe
1964	ytqoigdyvt.sys
1172	CP.exe
3696	ayoidaysqo.exe
832	CP.exe
5900	CP.exe
1504	i_ayoidaysqo.exe
4140	igdxvtqlfd.sys
1152	CP.exe
5424	avtnlfdxvq.exe
3680	CP.exe
4644	CP.exe
1880	i_avtnlfdxvq.exe
5440	sqkicaxsqk.sys
4600	CP.exe
4516	qnhfaxsnki.exe
5920	CP.exe
3212	CP.exe
1968	i_qnhfaxsnki.exe
3700	usqkifspnh.sys
5260	CP.exe
4816	khcaurpkhf.exe
2084	CP.exe
4140	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5432_1242824805\_locales\vi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayoidaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcaurpkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrlgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlicavpnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlicavpnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezxuomke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnhfaxsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfcxuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igebvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrlgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igebvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnhfaxsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcaurpkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvpnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvpnifdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfcxuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezxuomke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayoidaysqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4848	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3160	ipconfig.exe
6044	ipconfig.exe
2844	ipconfig.exe
1708	ipconfig.exe
4604	ipconfig.exe
5812	ipconfig.exe
4484	ipconfig.exe
5836	ipconfig.exe
1648	ipconfig.exe
3348	ipconfig.exe
2544	ipconfig.exe
4620	ipconfig.exe
5800	ipconfig.exe
3152	ipconfig.exe
3048	ipconfig.exe
3956	ipconfig.exe
2496	ipconfig.exe
2444	ipconfig.exe
3256	ipconfig.exe
3472	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305039153469286"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{07F23D1E-325F-4EEA-AD1A-C7392DC31399}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe
5432	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	i_nlicavpnig.exe
Token: SeDebugPrivilege	940	i_khfdxvpnhf.exe
Token: SeDebugPrivilege	2544	i_pmhfzxupmh.exe
Token: SeDebugPrivilege	4740	i_jhezxuomke.exe
Token: SeDebugPrivilege	1936	i_urmkecwuom.exe
Token: SeDebugPrivilege	5608	i_wtomgebwtr.exe
Token: SeDebugPrivilege	5468	i_igebvtnlgd.exe
Token: SeDebugPrivilege	1504	i_ayoidaysqo.exe
Token: SeDebugPrivilege	1880	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	1968	i_qnhfaxsnki.exe
Token: SeDebugPrivilege	4632	i_khcaurpkhf.exe
Token: SeDebugPrivilege	5660	i_xrpmhfcxuh.exe
Token: SeDebugPrivilege	5468	i_omhezxrmje.exe
Token: SeDebugPrivilege	3268	i_bywtrljhbz.exe
Token: SeDebugPrivilege	2104	i_gbztrljdbw.exe
Token: SeDebugPrivilege	3956	i_gbytrlgdbv.exe
Token: SeDebugPrivilege	2792	i_qoigaysqoi.exe
Token: SeDebugPrivilege	3648	i_yvpnifdxvs.exe
Token: SeDebugPrivilege	4220	i_fcxvpnhfax.exe
Token: SeDebugPrivilege	5608	i_zxspkecaus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 2780	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	89
PID 2780 wrote to memory of 5432	2780	iexplore.exe	90
PID 5432 wrote to memory of 4588	5432	msedge.exe	91
PID 5432 wrote to memory of 2624	5432	msedge.exe	92
PID 5432 wrote to memory of 4848	5432	msedge.exe	93
PID 5432 wrote to memory of 2624	5432	msedge.exe	92
PID 5432 wrote to memory of 2624	5432	msedge.exe	92
PID 5432 wrote to memory of 356	5432	msedge.exe	94
PID 5432 wrote to memory of 356	5432	msedge.exe	94
PID 5432 wrote to memory of 3612	5432	msedge.exe	96
PID 5432 wrote to memory of 3500	5432	msedge.exe	95
PID 5432 wrote to memory of 3612	5432	msedge.exe	96
PID 5432 wrote to memory of 3612	5432	msedge.exe	96
PID 5432 wrote to memory of 3500	5432	msedge.exe	95
PID 5432 wrote to memory of 3500	5432	msedge.exe	95
PID 5432 wrote to memory of 2408	5432	msedge.exe	98
PID 5432 wrote to memory of 5780	5432	msedge.exe	99
PID 5432 wrote to memory of 2408	5432	msedge.exe	98
PID 5432 wrote to memory of 2408	5432	msedge.exe	98
PID 5432 wrote to memory of 5780	5432	msedge.exe	99
PID 5432 wrote to memory of 5780	5432	msedge.exe	99
PID 5432 wrote to memory of 2360	5432	msedge.exe	100
PID 5432 wrote to memory of 2360	5432	msedge.exe	100
PID 5432 wrote to memory of 2360	5432	msedge.exe	100
PID 5432 wrote to memory of 2076	5432	msedge.exe	102
PID 5432 wrote to memory of 2076	5432	msedge.exe	102
PID 4960 wrote to memory of 4360	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	103
PID 5432 wrote to memory of 5676	5432	msedge.exe	105
PID 5432 wrote to memory of 5676	5432	msedge.exe	105
PID 5432 wrote to memory of 5676	5432	msedge.exe	105
PID 5532 wrote to memory of 2180	5532	nlicavpnig.exe	107
PID 5432 wrote to memory of 5028	5432	msedge.exe	110
PID 5432 wrote to memory of 2132	5432	msedge.exe	111
PID 5432 wrote to memory of 5028	5432	msedge.exe	110
PID 5432 wrote to memory of 2132	5432	msedge.exe	111
PID 5432 wrote to memory of 4596	5432	msedge.exe	113
PID 5432 wrote to memory of 4204	5432	msedge.exe	114
PID 5432 wrote to memory of 4204	5432	msedge.exe	114
PID 5432 wrote to memory of 716	5432	msedge.exe	115
PID 5432 wrote to memory of 716	5432	msedge.exe	115
PID 4960 wrote to memory of 1364	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	116
PID 5432 wrote to memory of 2168	5432	msedge.exe	120
PID 5432 wrote to memory of 5592	5432	msedge.exe	121
PID 5432 wrote to memory of 5592	5432	msedge.exe	121
PID 5432 wrote to memory of 2168	5432	msedge.exe	120
PID 4960 wrote to memory of 5200	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	125
PID 3976 wrote to memory of 3716	3976	khfdxvpnhf.exe	127
PID 4960 wrote to memory of 2400	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	130
PID 5432 wrote to memory of 5680	5432	msedge.exe	134
PID 5432 wrote to memory of 5680	5432	msedge.exe	134
PID 5432 wrote to memory of 5680	5432	msedge.exe	134
PID 4960 wrote to memory of 4708	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	135
PID 4124 wrote to memory of 616	4124	pmhfzxupmh.exe	137
PID 4960 wrote to memory of 2276	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	140
PID 4960 wrote to memory of 248	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	144
PID 1040 wrote to memory of 928	1040	jhezxuomke.exe	146
PID 4960 wrote to memory of 6052	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	149
PID 5432 wrote to memory of 4384	5432	msedge.exe	152
PID 5432 wrote to memory of 2168	5432	msedge.exe	153
PID 5432 wrote to memory of 2876	5432	msedge.exe	154
PID 4960 wrote to memory of 4576	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	157
PID 1156 wrote to memory of 5948	1156	urmkecwuom.exe	159
PID 4960 wrote to memory of 1256	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	162
PID 4960 wrote to memory of 5760	4960	2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe	166

C:\Users\Admin\AppData\Local\Temp\2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_56ac02de9723e1a4380400736f17bf3d_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x314,0x7ffcfc80c188,0x7ffcfc80c194,0x7ffcfc80c1a0
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,2377450306782994147,10033345595713572605,262144 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:2
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,15190801166135555557,12140294027464400962,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
      4⤵
      System Time Discovery
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,9049924574805787549,11281628919321605989,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
      4⤵
      PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,4840918121964381450,4621788473450326037,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,18126735862805808114,9640170485740879799,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,17418354979138950570,11144811483987599634,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,5858956325416750653,1313145031036148422,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3820,i,5203362991170243704,532545960317739687,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,419670227054515605,6324298126944795513,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5476,i,12642755085461366924,14128703799548332955,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,3788026759673641086,1214686694929348430,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,4618369475052719650,16274643755715773729,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,10830823642010158393,3469245931939231847,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,10830823642010158393,3469245931939231847,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,11708176059833538773,16394007639649551950,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,10169457660521817749,16472314831100773638,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,1413413919253191764,52018610441273248,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,10930235596799501463,891040340990239505,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3520,i,6648182947944425592,15518873161386171933,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,7562105621035379748,17720868761988791009,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,9088314864468223910,14052963060390538400,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,4859208957140067698,13525327177738269170,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=2356,i,4895725274681413352,12555399102203096776,2097152 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,14597780387619709956,12587632104555954664,524288 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:14
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6920,i,11160951354539233784,12893009483921066302,262144 --field-trial-handle=2676,i,10888510593311821274,15997648319749344220,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlicavpnig.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4360
- - C:\Temp\nlicavpnig.exe
    C:\Temp\nlicavpnig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlicavpnig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\i_nlicavpnig.exe
    C:\Temp\i_nlicavpnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfdxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5200
- - C:\Temp\khfdxvpnhf.exe
    C:\Temp\khfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfdxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2400
- - C:\Temp\i_khfdxvpnhf.exe
    C:\Temp\i_khfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Temp\pmhfzxupmh.exe
    C:\Temp\pmhfzxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\i_pmhfzxupmh.exe
    C:\Temp\i_pmhfzxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezxuomke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:248
- - C:\Temp\jhezxuomke.exe
    C:\Temp\jhezxuomke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezxuomke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\i_jhezxuomke.exe
    C:\Temp\i_jhezxuomke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\urmkecwuom.exe
    C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1256
- - C:\Temp\i_urmkecwuom.exe
    C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgebwtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Temp\wtomgebwtr.exe
    C:\Temp\wtomgebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgebwtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_wtomgebwtr.exe
    C:\Temp\i_wtomgebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igebvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5632
- - C:\Temp\igebvtnlgd.exe
    C:\Temp\igebvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igebvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1736
- - C:\Temp\i_igebvtnlgd.exe
    C:\Temp\i_igebvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayoidaysqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1172
- - C:\Temp\ayoidaysqo.exe
    C:\Temp\ayoidaysqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayoidaysqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5900
- - C:\Temp\i_ayoidaysqo.exe
    C:\Temp\i_ayoidaysqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4644
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnhfaxsnki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\qnhfaxsnki.exe
    C:\Temp\qnhfaxsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnhfaxsnki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_qnhfaxsnki.exe
    C:\Temp\i_qnhfaxsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcaurpkhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\khcaurpkhf.exe
    C:\Temp\khcaurpkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcaurpkhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4140
- - C:\Temp\i_khcaurpkhf.exe
    C:\Temp\i_khcaurpkhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmhfcxuh.exe ups_run
  2⤵
  PID:5992
- - C:\Temp\xrpmhfcxuh.exe
    C:\Temp\xrpmhfcxuh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmhfcxuh.exe ups_ins
  2⤵
  PID:4584
- - C:\Temp\i_xrpmhfcxuh.exe
    C:\Temp\i_xrpmhfcxuh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrmje.exe ups_run
  2⤵
  PID:3352
- - C:\Temp\omhezxrmje.exe
    C:\Temp\omhezxrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrmje.exe ups_ins
  2⤵
  PID:5640
- - C:\Temp\i_omhezxrmje.exe
    C:\Temp\i_omhezxrmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywtrljhbz.exe ups_run
  2⤵
  PID:4572
- - C:\Temp\bywtrljhbz.exe
    C:\Temp\bywtrljhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywtrljhbz.exe ups_ins
  2⤵
  PID:4896
- - C:\Temp\i_bywtrljhbz.exe
    C:\Temp\i_bywtrljhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrljdbw.exe ups_run
  2⤵
  PID:4832
- - C:\Temp\gbztrljdbw.exe
    C:\Temp\gbztrljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrljdbw.exe ups_ins
  2⤵
  PID:3344
- - C:\Temp\i_gbztrljdbw.exe
    C:\Temp\i_gbztrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrlgdbv.exe ups_run
  2⤵
  PID:3216
- - C:\Temp\gbytrlgdbv.exe
    C:\Temp\gbytrlgdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrlgdbv.exe ups_ins
  2⤵
  PID:1336
- - C:\Temp\i_gbytrlgdbv.exe
    C:\Temp\i_gbytrlgdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqoi.exe ups_run
  2⤵
  PID:5912
- - C:\Temp\qoigaysqoi.exe
    C:\Temp\qoigaysqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqoi.exe ups_ins
  2⤵
  PID:1484
- - C:\Temp\i_qoigaysqoi.exe
    C:\Temp\i_qoigaysqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvpnifdxvs.exe ups_run
  2⤵
  PID:1140
- - C:\Temp\yvpnifdxvs.exe
    C:\Temp\yvpnifdxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvpnifdxvs.exe ups_ins
  2⤵
  PID:5000
- - C:\Temp\i_yvpnifdxvs.exe
    C:\Temp\i_yvpnifdxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfax.exe ups_run
  2⤵
  PID:3700
- - C:\Temp\fcxvpnhfax.exe
    C:\Temp\fcxvpnhfax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfax.exe ups_ins
  2⤵
  PID:1056
- - C:\Temp\i_fcxvpnhfax.exe
    C:\Temp\i_fcxvpnhfax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkecaus.exe ups_run
  2⤵
  PID:816
- - C:\Temp\zxspkecaus.exe
    C:\Temp\zxspkecaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkecaus.exe ups_ins
  2⤵
  PID:5812
- - C:\Temp\i_zxspkecaus.exe
    C:\Temp\i_zxspkecaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:916

C:\Temp\cusifausqk.sys
C:\Temp\cusifausqk.sys
1⤵
- Executes dropped EXE
PID:5936

C:\Temp\fcxusmcxus.sys
C:\Temp\fcxusmcxus.sys
1⤵
- Executes dropped EXE
PID:6024

C:\Temp\urpjhfzxup.sys
C:\Temp\urpjhfzxup.sys
1⤵
- Executes dropped EXE
PID:4372

C:\Temp\zurmkecwur.sys
C:\Temp\zurmkecwur.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\rojgbztrlj.sys
C:\Temp\rojgbztrlj.sys
1⤵
- Executes dropped EXE
PID:2096

C:\Temp\oigbytqolg.sys
C:\Temp\oigbytqolg.sys
1⤵
- Executes dropped EXE
PID:4080

C:\Temp\ytqoigdyvt.sys
C:\Temp\ytqoigdyvt.sys
1⤵
- Executes dropped EXE
PID:1964

C:\Temp\igdxvtqlfd.sys
C:\Temp\igdxvtqlfd.sys
1⤵
- Executes dropped EXE
PID:4140

C:\Temp\sqkicaxsqk.sys
C:\Temp\sqkicaxsqk.sys
1⤵
- Executes dropped EXE
PID:5440

C:\Temp\usqkifspnh.sys
C:\Temp\usqkifspnh.sys
1⤵
- Executes dropped EXE
PID:3700

C:\Temp\rpkhfcausm.sys
C:\Temp\rpkhfcausm.sys
1⤵
PID:1336

C:\Temp\rpjhczusmk.sys
C:\Temp\rpjhczusmk.sys
1⤵
PID:3420

C:\Temp\geywurmjeb.sys
C:\Temp\geywurmjeb.sys
1⤵
PID:2592

C:\Temp\mgeywrojgb.sys
C:\Temp\mgeywrojgb.sys
1⤵
PID:948

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:3540

C:\Temp\ytqlidaysq.sys
C:\Temp\ytqlidaysq.sys
1⤵
PID:1352

C:\Temp\aysqnlfdxv.sys
C:\Temp\aysqnlfdxv.sys
1⤵
PID:4468

C:\Temp\kifaxsqkic.sys
C:\Temp\kifaxsqkic.sys
1⤵
PID:2168

C:\Temp\czxspkhfcx.sys
C:\Temp\czxspkhfcx.sys
1⤵
PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cusifausqk.sys

Path C:\Temp\cusifausqk.sys
Size 141KB
SHA256 a6c6f7193e80299e0ef4848bb3a256ec1936a9b6f1b15a1f6d5f6d7297129557
MD5 d94a852681b352a164830b212a8c7b33
SHA1 7090d689417fc5f6805fb46874da09c0b64dcf8d
SHA512 ba6a80d90372f3e993dba8075d965c4be03d8aeab83565edeea7cefb3da47edf2206983ec0bed98e4fa164ef394e55c7f09d886b9082e538a5bd70f84c02ed5b
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusmcxus.sys

Path C:\Temp\fcxusmcxus.sys
Size 141KB
SHA256 3c9b38d7622a32836194b24f1d12dbe072cb82e52abf00e3574dc470b20ede5f
MD5 1f2adce6deac8c20c80b0f8bcaa91a7a
SHA1 82b44fae900782db3363d56e42d4dd039ba5ccc1
SHA512 e9a8d9ae761c670fa2bd280c30a3445621c5997c1ad13c500bfc9433872091b1cf16d9159d7d8cc7cb389a48f7dbeec98abdae870e8b71f89b0e7137935ef68d
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhezxuomke.exe

Path C:\Temp\i_jhezxuomke.exe
Size 243KB
SHA256 5f8fd9230c358a4ff0443dec0a2e0dd227d9b904e4203c958c5123f4429310fc
MD5 75fff3fb4e7e56a4df3f7866861aa619
SHA1 6052fb599aff245e09a936047bd1c749cdd4b770
SHA512 a922abe3d7a4faf7bd5e14d27629032a5b858c9677c43c7662c81e7247dc3ee3c9a7d7c21e5b31097861340051c1c4d1a04ebf0aa23d21a0757f766db9c6dce3
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:4vMsLaOa3lLNngoqRttA7f
TLSH
T19A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khfdxvpnhf.exe

Path C:\Temp\i_khfdxvpnhf.exe
Size 243KB
SHA256 37a19d497ba0748d6bc90b424bddd075670fb27a408eefdfecaa2fa5a09eb6ab
MD5 835fadf78a9d33cd4d47a6601cd43178
SHA1 de28290ba90823d791882f6af61729e13defc991
SHA512 d12f7508d5a941c50b4a8e86c55c36fa7bd12ecdf1a763df29000fb5c985c2174225ea3e51861c0925f8a16291a031a99575cf6647fb196876ff67fb6c9d52fe
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:PvMsLaOa3lLNngoqRttA7u
TLSH
T149345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlicavpnig.exe

Path C:\Temp\i_nlicavpnig.exe
Size 243KB
SHA256 ecf01c3f4fea3e85bc8cbe6941cb7eaf597f58ee198c1bea3df9cecd1b2e55ff
MD5 a52e5ba965ae70d01ccca3730658e0e3
SHA1 1683d82cb0a0b4d5e250c0f9f27cf4eb85a3f05f
SHA512 bcb2eb6a7dfbb03b228059b1fca0293e7b14b9f0aca5699deb84d1675e7c978f9cee9bf6c307f3912c75d0331f32825efa9c7a13c128c6f416c30c43b059d45b
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:ovMsLaOa3lLNngoqRttA7H
TLSH
T1B5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxupmh.exe

Path C:\Temp\i_pmhfzxupmh.exe
Size 243KB
SHA256 cc46476fd076770e836ba2f56bb4a042efe5b598499154c17f4d32e82bf429cf
MD5 07a5144bf557ce863a2c131b1d915d6f
SHA1 d64fc7d176ef8dcd2af58a6606ced35fcec4217c
SHA512 0bc9bd7d93dc5227a1ef6119de9e778da2c1c515adabde4ece7568cbdfe753550aed6b201655c33e8a79a1f8ba3708e2a7333ede1799cf96673f65422ceddcb8
SSDEEP 3072:lCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:ovMsLaOa3lLNngoqRttA7H
TLSH
T159345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwuom.exe

Path C:\Temp\i_urmkecwuom.exe
Size 243KB
SHA256 ebeb53d2342324dbd1d682f7050f4169773c5a2818245bba37197da72a33cb16
MD5 d387c087037d6dae903cea447f234494
SHA1 51c0474b757c7fb8eadd7ea192958699567eeb57
SHA512 599d0b114f1d9c54982d00bfc4076bd045137e8becf990de849c7e73bfa7cbe99071945bed479c10df520a3e28b783577bc672a9fae0549e7fd781eccff05410
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:YvMsLaOa3lLNngoqRttA7H
TLSH
T1BB345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezxuomke.exe

Path C:\Temp\jhezxuomke.exe
Size 243KB
SHA256 b9db505f5f26e4f33a583ad2b94172889243d1ede556f7f468667f0422ab6963
MD5 2420bba78bb6cf69588098582adaa45f
SHA1 a187bd305d88995ab7c0819de7d278e2bf97a172
SHA512 dbf8f8b584e7880a5bbde8892c0168837bae1cff4462f532cfc3973ba965ce9f8e1099c845e62d56dbd3b5b4c583e6e501aeb960aa1475d26f65b754b1b60b21
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:FvMsLaOa3lLNngoqRttA7k
TLSH
T18C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfdxvpnhf.exe

Path C:\Temp\khfdxvpnhf.exe
Size 243KB
SHA256 910a307b529e010546eaf2aeedeb5440212a0498bc2f31bf00193a308a607fcf
MD5 a11c618d68833de267d0b7f3d242f39b
SHA1 19e790accb67bbaefb5ddda98910704811d55a40
SHA512 0b5d82194983e1c4025899155c8f4a29ff92b70e92e036721322097e5d545a2b4c09be9d8c6579611b9fcf7d1110f025fb9e5be424dbf2f8d116811128eff16a
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:qvMsLaOa3lLNngoqRttA7x
TLSH
T1D3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlicavpnig.exe

Path C:\Temp\nlicavpnig.exe
Size 243KB
SHA256 e70ff338839fa800bfc646544099d5df0acd04f3b58b7ee43b9e3f2f01f26ccd
MD5 2355e86ab581277356bd525717967c5d
SHA1 cc5397ec4d41932a33f39df4be3a47d465c4dff9
SHA512 c5281f0532270c3d0c85302c79fa42b83a5f21496d0ecba5e34c7567f4a693c816aa04bb5058a9618dbc70a7c9edd44e25b1f36510375d1ed864465cf5bdcd26
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:NvMsLaOa3lLNngoqRttA7g
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxupmh.exe

Path C:\Temp\pmhfzxupmh.exe
Size 243KB
SHA256 e3988edf1ca55700371a42b32438aa276e70fca44fbf50952cc1e82e5b58ca15
MD5 f276adedf04a4cfc67699e47b4312566
SHA1 bff98ce17b8c8a3fc199d117e8d753084ebd29c2
SHA512 2d8bed32011d0aee7c5793c0294ad6a67514d53082b9ce7ea4f5d49fec2d2a522aced65346ddb5105561a3551785234fa07d0ece003cbbf6a007304956657b07
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:KvMsLaOa3lLNngoqRttA7d
TLSH
T1E6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbztrlj.sys

Path C:\Temp\rojgbztrlj.sys
Size 141KB
SHA256 c4bc6e082951edb18bb257882638b0e73a05303152d21ef0bb7af25cafb15996
MD5 4f5b27f4fd6c2add81cceac0ed8056c0
SHA1 a681c5dcfdfcdcb199f9a475a512a55117a3efef
SHA512 759f2c74464e43b06e64a48d376128a0b0458522d7e8754c451452c0ee2e88a6fadc096e74f2ef8fd1b86b794c77d53f20d7f451c3f7d37c5e369519c17e9c9b
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.exe

Path C:\Temp\urmkecwuom.exe
Size 243KB
SHA256 01945f64722770d887e51f3e4c3734dbfec650855d15cd5ccb57c47774511fe9
MD5 fb3b637de34e12b4f7d54fae6de6c0dd
SHA1 435681d5f909f33dc757731406134f2e927f329a
SHA512 9ea090fa9da11090f809ad889fc4bd6381b4472d7e75888b1f7b376441ca66c81c50a54ac251979ba93f156aadb9fbe70617f67f6204075d485c6313616ff692
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7m:PvMsLaOa3lLNngoqRttA7m
TLSH
T14E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhfzxup.sys

Path C:\Temp\urpjhfzxup.sys
Size 141KB
SHA256 f5d3322fdec15d179edc78dbdc15ea71e7eb3b7160b2a6d54a3e96b434e84473
MD5 0f268161ab613f4e3cdba481aa02e416
SHA1 39bd917dbbcce271d340c4035153de8010e3e3a4
SHA512 53884ce13467dc5e691145a3f2753bdca922f1ec7aa62e20a6740eebb4cc5bd7a2f1c5f61950941906aad5dc6cfb6cd72a781ae7700e3ee99eee2edb64b45b20
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T144E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgebwtr.exe

Path C:\Temp\wtomgebwtr.exe
Size 243KB
SHA256 6117a631435daf5e28fc189ec4d0328ac491fe8aa0db81187ceacbf657250c9b
MD5 c50106c5121f593d4f39451a91348a3e
SHA1 4e78f9824d466a1489ca83106967f1050fe45447
SHA512 34a92a693762024313b46b8b24ceca223f17d5dcdc4e70ddac586c421e1ab850629532aadf1c62178945ea28c68188966250f93bd752b76ef753e2b0c4014f05
SSDEEP 3072:aCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7E:FvMsLaOa3lLNngoqRttA7E
TLSH
T17D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwur.sys

Path C:\Temp\zurmkecwur.sys
Size 141KB
SHA256 8b2d93bd3e271cfed7e21431a236c1869d0be5259327982d01d455baa84d9526
MD5 8a824b1cdd81f74a2c42bf4b0bdcea32
SHA1 67a6d7c90ea3dcb08f044622e9345c6e60d6de7e
SHA512 d21943a09e69b9b3cfcde0d2e985e070d7e34e096fa1af757176603b002878a5cdf5922c5ed75165a9d630c904ba7da5b12b6473bbd1ae99f759d3f991eacb20
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d341c341a0af2af2f37aa9129a96bc1f83a9f0840f06fd3bbb38b895ad781c88
MD5 76e19ac90d59d434e3dce217ac6f229e
SHA1 8505c92801d2b6c26a3c45152174a650fa9f98e1
SHA512 7ade212a8ae3328611e77ed4c053e4387d93538ca3313d60ad2a8471d8197a58a6e86c4e3573d1a4b8d1a2e1fc4a32c9dab56303703c47c8b4a2e6b4c37e0545
TLSH
T17B512EB52B2CEBDEF72444B947E6D88B3FF8A4B906071A00C0156DF44ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0be8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0be8.TMP
Size 2KB
SHA256 ccac4676bd4f17e0db5698631106456e9c2035f5e522f8513234fd4261473242
MD5 392f1cf9f182e9702dc14d9f12fa144f
SHA1 ca393eb08727734f6555b7152e8fc32ec80fd8b4
SHA512 6fd4e477b38d1e8f53c94658371b683f9227fe43b61b22433d23a8c6b0a9b06d1f3453379f84ce6600b56452a0427462c37455a9a393de370d107165cc4a52cb
TLSH
T147513EB52B2CEBCEF72444B947E6D48B3EF8A4B906071A00C0156DF40ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f949071948230d01eba2b0616e098c537b7c4530e114b1201a83a477ee00b50e
MD5 f79ab69541fddbff53d5f22409626ce3
SHA1 21ed66e76817fa56f2b01a5a74d88549735ea1b9
SHA512 e9d4657ac77e220c0c187f4358204647bc94e485f2feb47c34a82cf37176b193967a7a7c4a6f920bb4f97878444e68e7c551a7703ca8165f47022daa7013840b
TLSH
T1D651CFF3C6E8866E890156F0AB18BE2BCE2D0954832C3D5AC9E4AF1BA7E3471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 642eb9afd6cdbeb9f95b452d183c15f19f3513e09704440398bb3aa29ba6e58a
MD5 f334ca972cba4ed06860d4fba6ca6f2a
SHA1 48662815f57eca44c3fc98a5de1bfca0d0fc2786
SHA512 0e64fe80428675e125e53db404168de97f5af83bec6e204ef757486e9b55eaabdd830b29f4384539f58d0b92640e576e53736c6424e124ee8eb4ec8ea48d12bd
SSDEEP 192:sxRQRqyM/jK1Ml8wCR/f6sr91CZQzoA8prG/g6+WNCM0/YoLuYwGrIgDtrPLJ:sxRQY8R/f6sp1EJy/5W/S4v
TLSH
T13462E945AA345D778CCBD60DFA45BF93D2F94563A1901E48AAFCDA0C00E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ebc076ee66fefb56b6cc634a3646c020814d005abd610f900cc493486dcd4fcd
MD5 c2119a31650add71702f51e9c63112f8
SHA1 d68784c146b05075d667c0d4c57c9792ada2d161
SHA512 bef4fb0435be701852a2b168e501ab37af4299036f7ede50c6e2721a8896ce701e9df48e3dc9a14ff968c29143a03bf0fe8f9668b25c237cec86a3317b7b2bbc
SSDEEP 192:sxRrRqyM/jK1Ml8wCR/f6s89tCZQzoA8p9z/g6+WNIYoXbYwGrIgVrPLJ:sxRr48R/f6s4tEJ1/5Ir4L
TLSH
T14062F905AA345977CCCBD60DFA457F93D2F95523A1901E44AAFCDA0C00E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0bf44230dcf507028ee8fda5836ca913785ba47d9d99626b86558b3f13b755d6
MD5 5ddf315989a5ffa17079c659884a2e60
SHA1 afd450569b612a69778f0d29be576b4dad27595e
SHA512 3d0a7c39442c492c55268152ab5997a5d7e218c736b58b27f3cd2cdd286e1575e5176bd3994557cf8df625959706096d3157ce45c350326a414d49ed45c8323c
SSDEEP 192:sxRQRqyM/jK1Ml8UQg5CR/f6sr91CZQzoA8prG/g6+WNCM0/YoLuYwGrIgDtrPLJ:sxRQYqgAR/f6sp1EJy/5W/S4v
TLSH
T13762F945AA345D778CCBD60DFA45BF93D2F94563A1901E48AAFCDA0C00E6BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4e2bba728a239825b415fe241679253997f859a0ddfaa0c8b3084381265bd4fb
MD5 1337a75c81ec7ca6b94c854d71d7c402
SHA1 20659e423c981b612b1dc4792e868e3c4c8e1cad
SHA512 032ba33d7c4ddeaa27a828bc1affda31b9296797fdd3bcd7891a195c107478abbc3fa382f1eeaea970589228a3fe5ec66fbdb4a6ca5965e2e7ce6c90e4ea6cea
SSDEEP 192:sxRQRqyM/jK1Ml8wCR/f6sr9tCZQzoA8p9z/g6+WNIYoXbYwGrIgDfrPLJ:sxRQ48R/f6sptEJ1/5Ir4t
TLSH
T10862E905AA385977CCCBD60DFA457F93D2F95563A1901E48AAFCDA0C00E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 7a0e72c613eba3c2831d5caac88794027800f85443a792b6240e9af077a0b202
MD5 32d27dc7321e71cae0bee11f5be1eb5b
SHA1 f79a385a17bb2877fbb46054774a89c98df997a9
SHA512 de1f85f6c930e6c91225d81aaf001e544c9f41fe65422a3a10de717dfc3e0633ca9b43ed5d1608254ede1ac1f60629b8d129eb2081a5ff1944e9b97aa1cdbae1
SSDEEP 768:jXwHn47pLuLfmRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVXIKVuGorocklek:jXwHnkEfmRWgs2fJ2u1jaYIK4GTd+6l
TLSH
T132E2FC7B680CCBBE4F40499CEC29BD9E6DA802CB56D8CD9447FA440C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6052fa109cefff6281a59cb2d8024637c3712256b5f9befd127a9059cbab769a
MD5 2ddb00cc2eebdde338d9cd67f28c0c33
SHA1 5051e78f3f3b9ded627e0db3b8d2dba3575c2e29
SHA512 e350803a9b5411258e48c60c9badc87ed528665b0a8ef8952aaf7e77d89b28d26933c0936d03fe2b750eb514957b8a941d082240eb19f4345248707bb7f64202
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHpm3zBj3TWH0ig7TK4Kg1Tc5xMvC8YKJqz:CeTieYgQxAl+eODgc1W+9M+XHpm3zBjM
TLSH
T132911515707F02503EBE664C80A98C6D83C278E63158A92B77A941DA1F6BE135EFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 efbaa10be871a8accead170f6f464e494f56f67d122376d59cd4504763bc0630
MD5 ae2f4b3f0d5c08a1de9b549caf6928fa
SHA1 b3d9334a9a202a1a1c92a1e60b8422f4ed60e359
SHA512 3cfd4bc1d0f48d2c2f27916df7865b7aca3f1a968145f73154619002f941a099e04a595275172b761d3ea017c5aac58b504c8639204c0f86f5ab4bf2bf4f9c88
SSDEEP 768:MU3KiH/TBOWOiLQbIONXyer1IRCzni9Mr2ewBKZO0WOPd:MU3KqxKISIqnPr2evZPJPd
TLSH
T1ECF2AF71E4699D234CD5F386B24B6383AEF86073D5C45A54EAEE6F1E008365D170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e41260c998e0315158489a5c9cdfc8390b23c25c39ddd859c7b39e474471e980
MD5 839254891dd1dee45b82ef7d46f8b7b6
SHA1 6c9256430f47fe9d28a5e1c4bb4dfaaab37c7afe
SHA512 12e33b7ee4724eac4a392ab44bf519cbfbb836354484ec5383905bb48b4f07dfa6fc71cb75c4f8c7191120fbf1d6635cccb227429712f0b5848b9bc4f7b801d5
SSDEEP 768:6l3KR4VsOWOiLQbBONXyer1IRCzni9Mr2ewBKZO0WOPd:6l3KG0KBSIqnPr2evZPJPd
TLSH
T1221317F494E79932C89D9383A33E6E429DBCD063B5884994BBD91E0DCC8257FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32d540e0a0a009b2670768cd07a96222c2e7060eb2b4cbb199afdc61413c7f74
MD5 6a0cabe4648c0fc7b21c7d7966dd71ae
SHA1 6ecb918f1415bf451c9355e3e6f47e58dd18f3a8
SHA512 3b67b964413f48bb6a9fbe50f49c812287e0ed2519fd64343880475b1134bcbb1e84f30d73da27e286a0cd5cd3f9e88c363b5fb6508002b5c23fe74e415d3d91
SSDEEP 768:kU38gH/TBOWOiLQbIONXyer1IRCzni9Mr2ewBKZO0WOPd:kU384xKISIqnPr2evZPJPd
TLSH
T1AFF2BF71E4699D234DD5B386F24B6383AEF86073E5C45B90EAEE6B1E008365D170F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3a7b03207b00bff28b24cbe62cfa6979a72c2e17f5bb5a3b4abfd84e6f7f5bb0
MD5 b9c56f7d8c97ed7e6e0f934ef7a8c91b
SHA1 66938e9d156d56434002fc886318334447ddbec5
SHA512 06b85b2186d5652b8ea97fbb13624cdafd25c8f02f6062b8ac81c3bf39b6ba3fced880c49f38b336eb214dc355b5475ad1cee4d6a6da3e5c711c607d037fc623
SSDEEP 768:hrv+4UNbdz3P3/TBOWOiL0ONXyer1IRCzniBMeVH1SK7:hbsbV3/x0SIqnLEH1l
TLSH
T13E03BE36E5A89E338CE2A3C6B14772037FF86057C6840790E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

385f3596-fd65-4989-a66f-4e22f0c6838c.tmp

Path C:\Users\Admin\AppData\Local\Temp\385f3596-fd65-4989-a66f-4e22f0c6838c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5432_272340990\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-621-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1336-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1352-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1964-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2096-522-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2168-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2472-651-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2592-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3420-613-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3700-588-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4080-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4140-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4372-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-635-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5428-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5428-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5440-571-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5936-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6024-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download