e95010a4f4eaaf88611d9ae535054f98ee948643cb39f70d205def9ace635c44

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
Size 243KB
Sample260809-k33gmscl8v
SHA256 e95010a4f4eaaf88611d9ae535054f98ee948643cb39f70d205def9ace635c44
MD5 7ae1b0bd40e2828f26f227dcf65b76cf
SHA1 8e8a16f07d2409911cec1dca557284890811d950
SHA512 8ea9d6b22bbad5b32318653be4a65a7b960959d94d3edff0fb697b5e9c9da9dfdea9559cd09f8d307a02560523583b5143c70fb1b7e79ec930fc0a8238f2f89d
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:hvMsLaOa3lLNngoqRttA7A
TLSH
T1A0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1696	CP.exe
2552	mhezxrpkec.exe
876	CP.exe
1824	CP.exe
2876	i_mhezxrpkec.exe
2800	mkebwuomge.sys
1504	CP.exe
2284	cwuomjhezw.exe
976	CP.exe
400	CP.exe
2304	i_cwuomjhezw.exe
4732	ecwuomgezw.sys
2240	CP.exe
6072	uomgeywqoj.exe
2988	CP.exe
3492	CP.exe
1796	i_uomgeywqoj.exe
5412	tolgeywqol.sys
4864	CP.exe
2708	lgdyvtrojg.exe
4208	CP.exe
3132	CP.exe
3568	i_lgdyvtrojg.exe
5832	olgdywqoig.sys
2940	CP.exe
1588	dbvqnlfdyv.exe
4292	CP.exe
3888	CP.exe
1468	i_dbvqnlfdyv.exe
2436	tnligayvtn.sys
4604	CP.exe
1744	sqnifdaysq.exe
5272	CP.exe
3700	CP.exe
4532	i_sqnifdaysq.exe
3288	xvpnifaxsq.sys
2840	CP.exe
5436	pnhfzxvpnh.exe
1548	CP.exe
1160	CP.exe
360	i_pnhfzxvpnh.exe
3892	caxspkicau.sys
3656	CP.exe
3980	causmkfcxv.exe
1012	CP.exe
5992	CP.exe
3316	i_causmkfcxv.exe
4404	czxrpmheca.sys
5704	CP.exe
3928	zxrpkhczus.exe
4440	CP.exe
1332	CP.exe
3308	i_zxrpkhczus.exe
3572	CP.exe
2876	urmjecwuom.exe
5420	CP.exe
4544	CP.exe
4220	i_urmjecwuom.exe
576	ecwurmjhbz.sys
2968	CP.exe
4512	trojgebwtr.exe
5456	CP.exe
3408	CP.exe
2228	i_trojgebwtr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_490130896\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4740_1903514003\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1361420529\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_490130896\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_1100716258\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4740_671618211\_locales\et\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icayspnlic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icayspnlic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvqnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvqnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifdaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtrojg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1708	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2448	ipconfig.exe
4660	ipconfig.exe
5876	ipconfig.exe
5020	ipconfig.exe
2208	ipconfig.exe
2300	ipconfig.exe
5280	ipconfig.exe
2452	ipconfig.exe
1452	ipconfig.exe
3140	ipconfig.exe
952	ipconfig.exe
5012	ipconfig.exe
4956	ipconfig.exe
4220	ipconfig.exe
4404	ipconfig.exe
1656	ipconfig.exe
5124	ipconfig.exe
4220	ipconfig.exe
5340	ipconfig.exe
3008	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307401140411016"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{6E996383-D39D-4ABB-8C17-BAC0440E3773}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2876	i_mhezxrpkec.exe
Token: SeDebugPrivilege	2304	i_cwuomjhezw.exe
Token: SeDebugPrivilege	1796	i_uomgeywqoj.exe
Token: SeDebugPrivilege	3568	i_lgdyvtrojg.exe
Token: SeDebugPrivilege	1468	i_dbvqnlfdyv.exe
Token: SeDebugPrivilege	4532	i_sqnifdaysq.exe
Token: SeDebugPrivilege	360	i_pnhfzxvpnh.exe
Token: SeDebugPrivilege	3316	i_causmkfcxv.exe
Token: SeDebugPrivilege	4220	i_urmjecwuom.exe
Token: SeDebugPrivilege	2228	i_trojgebwtr.exe
Token: SeDebugPrivilege	1432	i_rljdbwtolg.exe
Token: SeDebugPrivilege	8	i_bytqligayt.exe
Token: SeDebugPrivilege	2624	i_dxvqnifdyv.exe
Token: SeDebugPrivilege	1164	i_icayspnlic.exe
Token: SeDebugPrivilege	4564	i_dxvsqkifax.exe
Token: SeDebugPrivilege	6100	i_uspkhcausm.exe
Token: SeDebugPrivilege	2884	i_upmhczurmk.exe
Token: SeDebugPrivilege	1308	i_hbztrmjhbz.exe
Token: SeDebugPrivilege	2308	i_bztrljebwu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 2040	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	88
PID 2040 wrote to memory of 4740	2040	iexplore.exe	90
PID 4740 wrote to memory of 4288	4740	msedge.exe	91
PID 4740 wrote to memory of 4428	4740	msedge.exe	93
PID 4740 wrote to memory of 1708	4740	msedge.exe	94
PID 4740 wrote to memory of 4428	4740	msedge.exe	93
PID 4740 wrote to memory of 4428	4740	msedge.exe	93
PID 4740 wrote to memory of 4260	4740	msedge.exe	95
PID 4740 wrote to memory of 4260	4740	msedge.exe	95
PID 4740 wrote to memory of 400	4740	msedge.exe	96
PID 4740 wrote to memory of 248	4740	msedge.exe	97
PID 4740 wrote to memory of 400	4740	msedge.exe	96
PID 4740 wrote to memory of 400	4740	msedge.exe	96
PID 4740 wrote to memory of 248	4740	msedge.exe	97
PID 4740 wrote to memory of 248	4740	msedge.exe	97
PID 4740 wrote to memory of 2232	4740	msedge.exe	98
PID 4740 wrote to memory of 2232	4740	msedge.exe	98
PID 4740 wrote to memory of 2232	4740	msedge.exe	98
PID 4740 wrote to memory of 2584	4740	msedge.exe	99
PID 4740 wrote to memory of 2584	4740	msedge.exe	99
PID 4740 wrote to memory of 2584	4740	msedge.exe	99
PID 4740 wrote to memory of 4536	4740	msedge.exe	101
PID 4740 wrote to memory of 4536	4740	msedge.exe	101
PID 3388 wrote to memory of 1696	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	102
PID 4740 wrote to memory of 1920	4740	msedge.exe	105
PID 4740 wrote to memory of 2148	4740	msedge.exe	106
PID 4740 wrote to memory of 1920	4740	msedge.exe	105
PID 4740 wrote to memory of 2148	4740	msedge.exe	106
PID 2552 wrote to memory of 876	2552	mhezxrpkec.exe	107
PID 4740 wrote to memory of 1900	4740	msedge.exe	111
PID 4740 wrote to memory of 4892	4740	msedge.exe	112
PID 4740 wrote to memory of 4892	4740	msedge.exe	112
PID 4740 wrote to memory of 1768	4740	msedge.exe	115
PID 4740 wrote to memory of 1768	4740	msedge.exe	115
PID 3388 wrote to memory of 1824	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	116
PID 3388 wrote to memory of 1504	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	120
PID 2284 wrote to memory of 976	2284	cwuomjhezw.exe	122
PID 3388 wrote to memory of 400	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	125
PID 3388 wrote to memory of 2240	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	129
PID 6072 wrote to memory of 2988	6072	uomgeywqoj.exe	131
PID 3388 wrote to memory of 3492	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	134
PID 4740 wrote to memory of 4600	4740	msedge.exe	136
PID 4740 wrote to memory of 4600	4740	msedge.exe	136
PID 4740 wrote to memory of 4844	4740	msedge.exe	137
PID 4740 wrote to memory of 4844	4740	msedge.exe	137
PID 3388 wrote to memory of 4864	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	140
PID 2708 wrote to memory of 4208	2708	lgdyvtrojg.exe	142
PID 3388 wrote to memory of 3132	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	145
PID 4740 wrote to memory of 4796	4740	msedge.exe	148
PID 4740 wrote to memory of 4444	4740	msedge.exe	149
PID 4740 wrote to memory of 2968	4740	msedge.exe	150
PID 3388 wrote to memory of 2940	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	153
PID 1588 wrote to memory of 4292	1588	dbvqnlfdyv.exe	155
PID 3388 wrote to memory of 3888	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	158
PID 3388 wrote to memory of 4604	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	162
PID 1744 wrote to memory of 5272	1744	sqnifdaysq.exe	164
PID 3388 wrote to memory of 3700	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	167
PID 3388 wrote to memory of 2840	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	171
PID 5436 wrote to memory of 1548	5436	pnhfzxvpnh.exe	173
PID 3388 wrote to memory of 1160	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	176
PID 3388 wrote to memory of 3656	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	180
PID 3980 wrote to memory of 1012	3980	causmkfcxv.exe	182
PID 3388 wrote to memory of 5992	3388	2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe	185
PID 4740 wrote to memory of 1900	4740	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7ae1b0bd40e2828f26f227dcf65b76cf_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff99d8ac188,0x7ff99d8ac194,0x7ff99d8ac1a0
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,6756416128221281355,13788362016572894392,262144 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:2
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,9373527385371313130,3901455114770822774,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:11
      4⤵
      System Time Discovery
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,4861036027187187962,12082441363743602259,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,18175286995191022183,3777099323029715317,2097152 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,14361282257680505545,6568723084415581673,2097152 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,622770275622485312,1193459862966850889,2097152 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,15101678337049552012,8033784099333462872,2097152 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11703803283799069766,4753765840627234872,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,9044230312037534633,9067827598772891882,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15648622699242627855,16755622312075708207,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12188420675543065091,5239044384442227651,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12188420675543065091,5239044384442227651,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17820830440748572633,13716578083307468322,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,7403841142529149575,13118795506296918271,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,5395222061802137642,9671955885805879664,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,4219534017284155732,9884408871253641817,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,14056280976672106291,10676718912856256114,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,226687395936619876,4102112280494631318,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,90818264512160506,9975931324217454686,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,10685621956612151675,2470977545645742653,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,11355468385862084744,450599915896415899,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,9261090856255690240,16610794561265262935,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,2332079662486101667,16481955095992746991,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6800,i,7265502350719268236,2047723296659168889,262144 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4195741891869768671,9136132039399955841,524288 --field-trial-handle=2488,i,349139877114323060,5924926681618478904,262144 --variations-seed-version --mojo-platform-channel-handle=1192 /prefetch:14
      4⤵
      PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpkec.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1696
- - C:\Temp\mhezxrpkec.exe
    C:\Temp\mhezxrpkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_mhezxrpkec.exe
    C:\Temp\i_mhezxrpkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomjhezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Temp\cwuomjhezw.exe
    C:\Temp\cwuomjhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomjhezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:400
- - C:\Temp\i_cwuomjhezw.exe
    C:\Temp\i_cwuomjhezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2240
- - C:\Temp\uomgeywqoj.exe
    C:\Temp\uomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3492
- - C:\Temp\i_uomgeywqoj.exe
    C:\Temp\i_uomgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvtrojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Temp\lgdyvtrojg.exe
    C:\Temp\lgdyvtrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvtrojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3132
- - C:\Temp\i_lgdyvtrojg.exe
    C:\Temp\i_lgdyvtrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvqnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2940
- - C:\Temp\dbvqnlfdyv.exe
    C:\Temp\dbvqnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvqnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3888
- - C:\Temp\i_dbvqnlfdyv.exe
    C:\Temp\i_dbvqnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnifdaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\sqnifdaysq.exe
    C:\Temp\sqnifdaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnifdaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3700
- - C:\Temp\i_sqnifdaysq.exe
    C:\Temp\i_sqnifdaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\pnhfzxvpnh.exe
    C:\Temp\pnhfzxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1160
- - C:\Temp\i_pnhfzxvpnh.exe
    C:\Temp\i_pnhfzxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5992
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Temp\zxrpkhczus.exe
    C:\Temp\zxrpkhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1332
- - C:\Temp\i_zxrpkhczus.exe
    C:\Temp\i_zxrpkhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3572
- - C:\Temp\urmjecwuom.exe
    C:\Temp\urmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4544
- - C:\Temp\i_urmjecwuom.exe
    C:\Temp\i_urmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgebwtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\trojgebwtr.exe
    C:\Temp\trojgebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgebwtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3408
- - C:\Temp\i_trojgebwtr.exe
    C:\Temp\i_trojgebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolg.exe ups_run
  2⤵
  PID:2472
- - C:\Temp\rljdbwtolg.exe
    C:\Temp\rljdbwtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolg.exe ups_ins
  2⤵
  PID:5352
- - C:\Temp\i_rljdbwtolg.exe
    C:\Temp\i_rljdbwtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqligayt.exe ups_run
  2⤵
  PID:3892
- - C:\Temp\bytqligayt.exe
    C:\Temp\bytqligayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqligayt.exe ups_ins
  2⤵
  PID:984
- - C:\Temp\i_bytqligayt.exe
    C:\Temp\i_bytqligayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnifdyv.exe ups_run
  2⤵
  PID:1480
- - C:\Temp\dxvqnifdyv.exe
    C:\Temp\dxvqnifdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnifdyv.exe ups_ins
  2⤵
  PID:5376
- - C:\Temp\i_dxvqnifdyv.exe
    C:\Temp\i_dxvqnifdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icayspnlic.exe ups_run
  2⤵
  PID:4952
- - C:\Temp\icayspnlic.exe
    C:\Temp\icayspnlic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icayspnlic.exe ups_ins
  2⤵
  PID:3124
- - C:\Temp\i_icayspnlic.exe
    C:\Temp\i_icayspnlic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvsqkifax.exe ups_run
  2⤵
  PID:5804
- - C:\Temp\dxvsqkifax.exe
    C:\Temp\dxvsqkifax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvsqkifax.exe ups_ins
  2⤵
  PID:4584
- - C:\Temp\i_dxvsqkifax.exe
    C:\Temp\i_dxvsqkifax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkhcausm.exe ups_run
  2⤵
  PID:1100
- - C:\Temp\uspkhcausm.exe
    C:\Temp\uspkhcausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkhcausm.exe ups_ins
  2⤵
  PID:5980
- - C:\Temp\i_uspkhcausm.exe
    C:\Temp\i_uspkhcausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhczurmk.exe ups_run
  2⤵
  PID:4252
- - C:\Temp\upmhczurmk.exe
    C:\Temp\upmhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhczurmk.exe ups_ins
  2⤵
  PID:5932
- - C:\Temp\i_upmhczurmk.exe
    C:\Temp\i_upmhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjhbz.exe ups_run
  2⤵
  PID:1856
- - C:\Temp\hbztrmjhbz.exe
    C:\Temp\hbztrmjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjhbz.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_hbztrmjhbz.exe
    C:\Temp\i_hbztrmjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  PID:6060
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  PID:828
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3980

C:\Temp\mkebwuomge.sys
C:\Temp\mkebwuomge.sys
1⤵
- Executes dropped EXE
PID:2800

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
- Executes dropped EXE
PID:4732

C:\Temp\tolgeywqol.sys
C:\Temp\tolgeywqol.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\tnligayvtn.sys
C:\Temp\tnligayvtn.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
- Executes dropped EXE
PID:3288

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
- Executes dropped EXE
PID:3892

C:\Temp\czxrpmheca.sys
C:\Temp\czxrpmheca.sys
1⤵
- Executes dropped EXE
PID:4404

C:\Temp\ecwurmjhbz.sys
C:\Temp\ecwurmjhbz.sys
1⤵
- Executes dropped EXE
PID:576

C:\Temp\jgebwtrljd.sys
C:\Temp\jgebwtrljd.sys
1⤵
PID:1892

C:\Temp\jdbvtrljdb.sys
C:\Temp\jdbvtrljdb.sys
1⤵
PID:2776

C:\Temp\igaytqkida.sys
C:\Temp\igaytqkida.sys
1⤵
PID:3776

C:\Temp\nlfdavtnli.sys
C:\Temp\nlfdavtnli.sys
1⤵
PID:3720

C:\Temp\xusqnhfdav.sys
C:\Temp\xusqnhfdav.sys
1⤵
PID:4664

C:\Temp\cxusmkecxu.sys
C:\Temp\cxusmkecxu.sys
1⤵
PID:4468

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
PID:3460

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
PID:4944

C:\Temp\bwurpjgebw.sys
C:\Temp\bwurpjgebw.sys
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomjhezw.exe

Path C:\Temp\cwuomjhezw.exe
Size 243KB
SHA256 1bf2083b632c662546483b3c04a6baed9ecb6888f5ae1da843f5581dce1fe384
MD5 9e00935d118fea681ca5d4e8416a3efc
SHA1 8dd05bf15f8eb6f1f3e5728996fd8371ef4defff
SHA512 cebab36e6c11f7f97e027671b3e60045c7c7a84a9eb897c65116cc1f89eccaacd49bde981f41746fdfa468d10b6a71c34ebce30bed44bf127e906c85ea215faf
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:uvMsLaOa3lLNngoqRttA7l
TLSH
T169345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvqnlfdyv.exe

Path C:\Temp\dbvqnlfdyv.exe
Size 243KB
SHA256 6cf7d0f3309140e638602e6a37feac9764c84f0d66df9fca7542ea876c8f134c
MD5 202ebe29d845e0e142e68f04d85aa822
SHA1 fe61f3b2eeb9683759cdde68355bb467c28dba86
SHA512 375c3e3f85b861d89e42c76397c5cc3c07a837d4d68a27fc5e2d5c0eeb089d23144836b77bc572b7f025b9d8a9d5b84a5117c85070a882726d673a343d9a249a
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:PvMsLaOa3lLNngoqRttA7y
TLSH
T12C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.sys

Path C:\Temp\ecwuomgezw.sys
Size 141KB
SHA256 96097dfeed135c25fd7a243af0bd5bdd2c4be62de8deb937425e5caf7a3915cb
MD5 3db485c82a6d988c61df34ed19f561bf
SHA1 980c99f4894360925c32d1f53defbf8a489182eb
SHA512 e31b255007ede8ab54b47d6ec6b3b11496f96c55153537cf7487fd997fba94503b45de56aa2831016b792d71bd9711a4d29a08f68f687b3511696b42452604f8
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomjhezw.exe

Path C:\Temp\i_cwuomjhezw.exe
Size 243KB
SHA256 b62e890c47a5546c2ff4b5a541de2c8947c123073f522e8361293ec5db3de1d7
MD5 a7841e7418080ea7f0d5ddb3193805b0
SHA1 b95405ae0ab09390eb750a331e0aba0a7d60a2f5
SHA512 2b1a876f47242e149715491a16f97b8c40b2e2bf1767fe071608b8bf29d237d0ee7c248262691345b1e27f82ea00661ba2c94cfd1a79ab8191c97d8753047b7d
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:gvMsLaOa3lLNngoqRttA7b
TLSH
T1E3345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvqnlfdyv.exe

Path C:\Temp\i_dbvqnlfdyv.exe
Size 243KB
SHA256 89ef2c63b5488b4210dfda4544861b1863d53e055c8c434a0aca51592e6e1e0a
MD5 7798f5ce5231f4ce757558b886cd64c4
SHA1 cc174935ea09e7734366ad5b828a193a4c890c1f
SHA512 ed3eb5feabd2098e54646ed6f75ad85a11ae33d740f531292e4d7e563bb6753ebdd6624add68f4347f2e4ee8b7285148a785c7f4ed8ebbb176dd1b655c29e70b
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:gvMsLaOa3lLNngoqRttA7D
TLSH
T115345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvtrojg.exe

Path C:\Temp\i_lgdyvtrojg.exe
Size 243KB
SHA256 4b8ed5c03070cb6b43b359cb1738be5cfbd207e44b5928ad5ced37ebc7412532
MD5 bcff6ff847434bed07b97945e6fba76c
SHA1 081d3d39b5abe8b900fc913cc404cfbb48fb515d
SHA512 8b58f948e3ce32c4cdcb301479f1c8ca82d7fffe11d8ab28cabfbe652e23c92a111d72b334a19a04701364c85834803724ddfee8c4ec7e85252355f854a0dde3
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:PvMsLaOa3lLNngoqRttA7y
TLSH
T10B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpkec.exe

Path C:\Temp\i_mhezxrpkec.exe
Size 243KB
SHA256 1e74367c92acefc83de5fc93a0737f392d3d3bd4dc6410d9a81fc7f71ae6988a
MD5 bebc1c54b39d70aa917f78f66e8aa3da
SHA1 667bebcdb2ec113a10aa392dde5725be6e7f6a26
SHA512 ba21e9cd5ad0bd3d9ee3e3cfe329ae0a6700bdb5b57ca305857427c707fed67241694a3856ac98f6e5eaad06533b030b6fac7c322c7331510ff76a3e4a2a8b73
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:JvMsLaOa3lLNngoqRttA74
TLSH
T157345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnifdaysq.exe

Path C:\Temp\i_sqnifdaysq.exe
Size 243KB
SHA256 c5ef964278b56f260079ee711c8367f6bff4ba3f55bcef1250cb017441cecb0b
MD5 286edbea8120e94c398decabc33fa91e
SHA1 f228ca75f58909e8709c96ec70d99748d7df89f5
SHA512 ae59b8a65ed2b5dd79103e488dffd87ee33f3f0476fa43e2d9e21462bc2734b8900fc2fb59f958af95699363b5b22c03eccfd1159d779dde4b9211af8ce8a717
SSDEEP 3072:pCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:UvMsLaOa3lLNngoqRttA7f
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgeywqoj.exe

Path C:\Temp\i_uomgeywqoj.exe
Size 243KB
SHA256 c33610d02309c3a6d16e195da3b818f6d890c3293a04543630b7ea6987978b89
MD5 fb7ec46969f718fb72e9f2de0869b9b9
SHA1 dab88890a9ae2e7b08d4de649aa86929ae5f6c74
SHA512 355eee11c4286a4a44909088cf4416df50940087b8c36022b6eda6e8a25aefa5339b0fc7038d7eb9caa9d39d7822829678664a59123aba3d7dbe0959d454c6dc
SSDEEP 3072:cCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:/vMsLaOa3lLNngoqRttA7K
TLSH
T129345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvtrojg.exe

Path C:\Temp\lgdyvtrojg.exe
Size 243KB
SHA256 7086e94a363ae56a7f442b493ce4654edf2cbbb36df01373840876eda799945b
MD5 74be27018fbf495cdc01dc45a81d5144
SHA1 4ce4750953ecb641ecaacce4d07b72805be0ecba
SHA512 4b5c6ebb7250954142ea6a108becccdc77a6e80a49c0067f5b1ac64b87ac6bae049d2726d03c9fc07a14d55272b22bd4750cf00743fef7b957b731ee69de85e5
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:gvMsLaOa3lLNngoqRttA7v
TLSH
T17D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpkec.exe

Path C:\Temp\mhezxrpkec.exe
Size 243KB
SHA256 1b29b2da435e24c0ce3634ffaa5e6aef740885448e47826cc82d363a9607ea0a
MD5 0d4cea26ef204b4b8510ba460379bbdb
SHA1 5f358ee9a1f388912f5ee09e1a5139062ee289e2
SHA512 4b71e6c23af6c0a3a59f4a533ffb5c96a9bd5ed8935d0f08b157770affe7f9b91c3b793cb227c210b22d8132b61ce6f02f630466ddab4c3b25649ba3a32ace4c
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:7vMsLaOa3lLNngoqRttA7S
TLSH
T1E0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkebwuomge.sys

Path C:\Temp\mkebwuomge.sys
Size 141KB
SHA256 b3bbb0dc741fc92397124378c629d177c5a67ae598396df9315c4fdafbcc26ac
MD5 4132a3a5771e05d257d7358509102b84
SHA1 0541685baddf109daa7842e48c90b1395ad9c6dd
SHA512 97403e62d421c317acc3c87920153882677eb69d7f3050b80f3e4ea082cd881e2f73546cffc572bfcbd248b1e870592f3e69706c4401b27b0b153561cacc5ace
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 141KB
SHA256 dffcb3e2f6652def5e37560f8a3427bc35163214f761e795fd539b793d371b38
MD5 f614d341b201a74dfb343cd34cc0445f
SHA1 1a0229181a8766ac9659fa03d2d67057b04093d5
SHA512 30eaa7f3b888265ea2c07640d643fe5a37eeb69ec50834f4006b08c306203b1d317a2f408cb7407e3ab568ae5ac1edbc4653fb4fcf3169fb5e4b7ce6cdefd388
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifdaysq.exe

Path C:\Temp\sqnifdaysq.exe
Size 243KB
SHA256 17c4ecb300f66a9c9b73d02073ab5b03193c9f0a4822e0e4e2b4b09bb6e0c62b
MD5 aa4dce01d6c76a55590266443c33eb84
SHA1 83b4ab97e7fbb702145fc631ca2be74766dbae0a
SHA512 9e6c670250cf451c0b1de4ab6cb0dd1f779a335c268ae412a86aa56f5b65901c71277a0508527b3c9710cb5e4a85c9267db9e028443aacc3a3f82c77d875015f
SSDEEP 3072:oCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:TvMsLaOa3lLNngoqRttA7+
TLSH
T1E5345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnligayvtn.sys

Path C:\Temp\tnligayvtn.sys
Size 141KB
SHA256 b2d7cf37663a64d7597dd7f2d7eb575af6a07a11be0345bdf9cf0ec31d855d07
MD5 8500b9936d3379eea1f16c10e2a8d758
SHA1 35af59d5797367a775515dc78ec69da442fba2bb
SHA512 e5300758a348cdc34ec418d35063e6683d0629df60147edfaa057571d053ee7e80f1becc8e4eacaed65cdb30aa81f5ecf957a799cd662ab9c1787e1a9b18d8e6
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T135E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqol.sys

Path C:\Temp\tolgeywqol.sys
Size 141KB
SHA256 3fd6f94bec606f6f5f6a7f4920af1fc37e487717d005f9a54e9206a856af3c39
MD5 fa71935f3e7e2b444803fcbbdf352d27
SHA1 93686d4d573d570b44985a76de503e7f11a2cac9
SHA512 2c77bbe954c3ab96b1302d3a63510f17491adb6bfecff0cda65c2136f5c848249d348f6c88683c9099227dabec7cdf81aa4799df7e3b514af4318d0c4a6c3dbe
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T181E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywqoj.exe

Path C:\Temp\uomgeywqoj.exe
Size 243KB
SHA256 d45f028af36974722a4c498ef0cd9758d180eb6f554b63795eb733bd2fd71922
MD5 8dfbcc47f241cde29fffd0b065abb1cd
SHA1 f021f4540162d230d7498e8bbd635ebee707147e
SHA512 54152d6d1b20f550f9a49947129d065850c576522e64a6833f135fcffa00bfb67bd44c5d290cc9c588fa79f1e042e0bac9e183550e743c75b4c9095cf73170c9
SSDEEP 3072:SCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:NvMsLaOa3lLNngoqRttA7k
TLSH
T19C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 15ccd1a395578ec22e3c96a5320f8e2f73f54a130860887179b6c6b4df8b7d70
MD5 01dcf9bd68fd4a8a29fb998d9ae4652c
SHA1 6a1249fa90dbf9537c882dd744156295b30513c1
SHA512 5218d034f3fe115f4792a7d670c213b135e70e16d4b4c0a7a806985c45c791217e701e22d82784c464c087e1c6f22bd2847ddda2a34a588d160eaba2450dd655
TLSH
T17851841F676D99D2D72874B150DB27943AF2B229EBC7AE10D0505EB88882F74C0C3C63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5969fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5969fb.TMP
Size 2KB
SHA256 2780b3d7c096035ea510ca1b95bcf7f9f485ae48c1cbfa93a41f6e37e4cf0856
MD5 2420a0f6444904046c8fa8529fdbdf18
SHA1 213e78034330734ea5bf0decd8380f7f99d2f153
SHA512 c7bb4d1a136d4e7cd3d101466baf5009c6980b4c8521b7293acc9328a105f66f926cf1a4f377abc0ef5419bb295e7faae172c18e18200fb08cf82191d4c46d5b
TLSH
T14F51841F67AD99D2D718747140DB27943AF6B229EBC7AE10D0509EB88882F34D0C3C63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ac87899ac0bf7ad50018325ed0314a415167f7c1711af3d03d917bb653ef5f2b
MD5 9413360aff42b9bf5f8f4245b922e0c4
SHA1 f1e37013a8b18757c2a61aa54e0d9592ec1c31c8
SHA512 003afddb7a403328ac674f24a2c7abbb2456d59dc525309c19f281e00743bed5d28f3f68e2f40d81340901ed758e76001775fca148f91cc35fe13b4a2b3448c1
TLSH
T122419BF3C3F8856E890156F0AB146E2FCE2D0915432C7D5AC9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bc6a12c4-bd0c-42b5-bcb6-27c3a7983dc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bc6a12c4-bd0c-42b5-bcb6-27c3a7983dc2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5ba8b4a2ac0cd7b5b272ea02d186135c1ee820c63bacf3d8036d29a59f39aa6d
MD5 4f50fa271f83ec6a23f1491c1aa97f7e
SHA1 9870947c280c6e4a94396295de70cb25f79de28b
SHA512 050914cf5496bd26cfdb062d35113d5c49f74667315368f9a5153d739f356786dece487bbd5b0926104bdf2b35be28aeadba66ebec849eab8865f9957a94c359
SSDEEP 192:sxRErCl/fpsvQKCA94/CzoA8p9s/g6+WNCBu/YD9j96Sc+GspIgVlVcJ:sxREel/fpsvQZ8Ou/5d/lSc4u
TLSH
T15042C8166A28AD3B8CCBE21DBA157F53D2F9503361D11E58A7FC9A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ac7bef78b14fc7b6429ebe03d1931ac73dc69cf7dd30ecad2737888b6f0a066a
MD5 6d933df605b2fd6e26b51b04bbc24565
SHA1 8fc7b291b0897c981d4b9377ff3793a2ad5787ad
SHA512 40892ddaa0da7865e061cce84238fa1f355942e205f0ba10d969b379aa6f8f8eeb67f965138b07f94f9e839701916a3ab82ee71d24379244a58f6b68cc291c8e
SSDEEP 192:sxR7rCl/fpsaJXZWL1zoA8p9s/g6+WNCBu/YD9p96Sc+GspIgDdlVcJ:sxR7el/fpsaJpSYu/5d/JSc4i
TLSH
T1D142B615AA286D3B8CCBE219BA157F53E2F95033A0D11E58E7FC9A1C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 daed650b0e88fd3c557f25f277b4cde8efc8a1ab804ebdf977b0115db38bb2ac
MD5 f6f4b243a5aba2a603d94d4b364ee8ef
SHA1 90a4145c59ebba0c4885c90853c4b3738fe566fd
SHA512 48ab267937a0654c26dbed32e0248544cc48644d486fb0c82a4f7f0ea0ba8872c51b35c5a6fd9b15fd99abf65d65f4aad0577c59ba23d0e114d8233b36ce990b
SSDEEP 192:sxR7rCl/fpsaQKCA94/CzoA8p9s/g6+WNCBu/YD9j96Sc+GspIgDPlVcJ:sxR7el/fpsaQZ8Ou/5d/lSc4k
TLSH
T1BA42C8166A28AD3B8CCBE21DBA157F53D2F9503361D11E58A7FC9A1C04EB7DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2123be0dcc143e3a7827d18dfabe34581f1109c4b8cd786fd68d4188da78287e
MD5 5745a6f60b04cbd765952b61a412ebc0
SHA1 749482f9936e1cd4bd1547f5f9e1b1499c7ce1a0
SHA512 e172ae0bd173d9bcfbf96efaceb734f23bd4fbdc2c4f3a64ef12e8664a573447901cffef532eea4fdb0615171a4a0e4c2d187d72aed2ddc6741e87fdce71e8be
SSDEEP 768:azfWS57pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOc163ropSKBix1:azfWSPEf30Wg/XfHfu1jazy6kpSKS
TLSH
T1B6C2EA7B640CCE7F4F800AD9AD197EDB6DA802CB969CCD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4a0364168ee3a844b2f5e165dbcf3f722bb97c366f6c421c02c24597a6c2100c
MD5 e0f598cc61ab752c0e7982d1856b1fae
SHA1 7b419766aba27a3881fe67987007861c2b5ad0bd
SHA512 97841588cb58df0a94a2c26bab831a4f19059bde5309fa560318d80d261dbe3b1fcd69d0f298a47f9d8280fa47875be60266f084df796d7816de258e9f1fa773
SSDEEP 96:KREBE+EPErEZE7E/ELWEPEME6gETE5K4EQgEXE5cEfEXEWEJEqEzHE/nuE/nDE/b:CEBE+EPErEZE7E/EKEPEMErETEzEQgEv
TLSH
T12C912341757E0240387EA64C95B8892FC2817863311CF46B7BA945A28F6BE638DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1e21b7f-a204-41b4-91d5-fd404fd66fa5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e1e21b7f-a204-41b4-91d5-fd404fd66fa5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 371e624b9c349224208633a947933a1d7d876d977ac234e58702a5dd7158bd67
MD5 52bc62a34a608fe0b0213b45a9dc9822
SHA1 b8515b8cbe9dcc45ad99b83dae85aad70e8c082f
SHA512 c164f19e9b0db3252bf7d10a5f0bd29794a58fdeeab7acba09afa4eabf6f44d587e523cc79c35522d2a6c2f170d590826d55b1fc5428d81dd985138c7e58f2f9
SSDEEP 384:nJZcI738NRbjhb/lumWZlf8hyEGY8FJ6EF4Zy2rEoajo4cdR8eHhVODjYPNDUMPV:B73wcXi0PY/rEnjN3Gac1FQ2ewBKZOsA
TLSH
T13FF2BFB06C789DB38CEAE345B5477743AEE442A3D4D50AA8DADDA61C058379C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1aeb1c0e443dedc3be351b1f713707f82d869debbc5f341d274789e060e99834
MD5 a23279e03988d2bc2055ce21e45141b3
SHA1 d15ddd4ff5a5983972ac354c1cbc3a6b27f7c6f5
SHA512 3b09201460519afef22e2f3067c996856d01affd06610b31279096144e433260b62e0a3100d6bccb2a3218ed25d0e9fcc6a7a359fed2250a44617a06d204794b
SSDEEP 768:YFQI3swgzg0sPjnrEnjN3Gac1FQ2ewBKZOsA:7I3KgDQnjMa72evZJA
TLSH
T1341318F598E78977D9EE9387673E6E4299BCC263B4940994B7C85D0CCC821BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ea7a9df1690922c1d3695d74591a862f969c3470ef2ba864e7a7fa62e023adb3
MD5 e7fe0f12753b6ae5027f7ddf5f7ea31b
SHA1 811eb0c75707b2de336d46a38b6cd128190a0b0b
SHA512 3f70f387b2ead6e69477f5c8f11ec313f550390f23099a21d3635d2111318b67bb5430ad0f658971db2a93c52eb5118fcf3f1842c061aa22a2ac174b925e0952
SSDEEP 768:/rv+4UNbdc33wXi0P4rEnjN3Gac1FQeVH1SCx:/bsby33KAQnjMa7EH1X
TLSH
T1F913BF3169B89E738CEBD38571877A437FE4126384D50BA4C9D96B0C06876EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 39b935aafe7241b6cd00da582649da92bdbc8d5cd1236b5e073e8dabb371ffb1
MD5 de1da6ed7da18ae06b7f8f3c85c9acaf
SHA1 d7274cde0c1e1e768b6c73dc9e96810012b6badc
SHA512 a3f3f23141d1de6a634c28f6eb4cd595bbe5acf7445b01af6176fb17ef9b7bead18a0d2d86ec35f35cf37279aa2eced966982736839d1ad030fc0bc2db8a0c87
SSDEEP 768:rrv+4UNbdS3Umi0PqrEnjN3Gac1ZbeVH1SCz:rbsbg3TyQnjMaUEH1V
TLSH
T1D503CF3269B88EB38CE7938571877A037FF4525386C40BA4CADD2B0D06975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2717604d184602bd91ea898a659eaa87b1885290bbc30f2110f75d33db59fa13
MD5 7120889697caeaa711cee778d8f9236e
SHA1 ce242c6ef5b14bc1505422fa8636a9d91132d876
SHA512 d7467769b2962526dc17791f58a9c7939b69e497ca16035e09db8b701a2965acdf2fd7f3617f8327b8a6e0c068350f8be1f886630d2a7bb75ac592ed61cb5d1e
SSDEEP 768:Crv+4UNbdS3YJi0PxrEnjN3Gac1oQeVH1SCz:Cbsbg3A5QnjMaQEH1V
TLSH
T18003BF3169B88E738CE7E38571877A437FE4526385C50BA4C9D96B0D0A875EC230F967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b6a269e4-9977-4a84-a724-b37d4ae85eea.tmp

Path C:\Users\Admin\AppData\Local\Temp\b6a269e4-9977-4a84-a724-b37d4ae85eea.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4740_1833488384\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1112-726-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1892-623-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1892-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2776-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-381-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3288-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3460-705-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-668-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3776-648-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3892-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4404-572-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4664-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4732-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4944-709-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5832-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download