754aa00aa0cd4e967970dc04627f11374b43c2ca2efc9f0ebd0cd993e7eabbec

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
Size 243KB
Sample260809-sb2d9szgla
SHA256 754aa00aa0cd4e967970dc04627f11374b43c2ca2efc9f0ebd0cd993e7eabbec
MD5 09765b084adb153e15b779ed9ecd1eee
SHA1 9cf829f8dcfc21d28234f8a1caf52a202f8b15cf
SHA512 bc027ad191dc4418b7cab7f76871d69955eec4a87396685d6247d85204e77fed50406ebeb02bd42a0e21b0bcce2cee08d0fc578a3998882b7d241174bf0a0f6a
SSDEEP 3072:8CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:fvMsLaOa3lLNngoqRttA7e
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4144	CP.exe
5716	wrpjhbztrm.exe
5612	CP.exe
3752	CP.exe
5532	i_wrpjhbztrm.exe
4712	rojgbytrlj.sys
624	CP.exe
1328	dbytrojgey.exe
1852	CP.exe
4732	CP.exe
4068	i_dbytrojgey.exe
3208	lfdbvqnljd.sys
4416	CP.exe
4196	lgdytqljdb.exe
4688	CP.exe
4128	CP.exe
4584	i_lgdytqljdb.exe
5912	iyvqnlfdav.sys
6008	CP.exe
4704	vsqkigaysq.exe
3820	CP.exe
5636	CP.exe
3364	i_vsqkigaysq.exe
1240	cavsqkidav.sys
5596	CP.exe
3564	xnhfaxspki.exe
2644	CP.exe
1892	CP.exe
2840	i_xnhfaxspki.exe
5356	sqnhfcxusn.sys
1036	CP.exe
4248	usmkicaxsq.exe
4584	CP.exe
5412	CP.exe
5348	i_usmkicaxsq.exe
4512	urpkhczxsp.sys
124	CP.exe
3644	upmkecaxrp.exe
1972	CP.exe
2944	CP.exe
5252	i_upmkecaxrp.exe
2416	ecwusmkeuo.sys
5532	CP.exe
5396	urpjhbzxrp.exe
1664	CP.exe
4164	CP.exe
1240	i_urpjhbzxrp.exe
4660	pmhbztrpjh.sys
5356	CP.exe
4588	gezwuomhez.exe
5556	CP.exe
3412	CP.exe
6036	i_gezwuomhez.exe
3640	bwuomgeywq.sys
4552	CP.exe
4924	wtolgdbwto.exe
5252	CP.exe
2284	CP.exe
5380	i_wtolgdbwto.exe
1372	vtnlgdywqo.sys
3948	CP.exe
4608	wqolgeywqo.exe
3144	CP.exe
2452	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_322734940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping944_1833136114\_locales\hu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkecaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmheczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkicaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmheczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkecaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmhecwur.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1792	ipconfig.exe
2568	ipconfig.exe
2348	ipconfig.exe
4728	ipconfig.exe
5160	ipconfig.exe
3380	ipconfig.exe
5844	ipconfig.exe
4712	ipconfig.exe
5128	ipconfig.exe
4356	ipconfig.exe
6064	ipconfig.exe
4712	ipconfig.exe
1712	ipconfig.exe
1968	ipconfig.exe
2016	ipconfig.exe
5260	ipconfig.exe
1508	ipconfig.exe
5408	ipconfig.exe
2720	ipconfig.exe
4604	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307610797810932"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{1EC72021-0B67-4701-9A4C-C9A27D25EEDE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5532	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	4068	i_dbytrojgey.exe
Token: SeDebugPrivilege	4584	i_lgdytqljdb.exe
Token: SeDebugPrivilege	3364	i_vsqkigaysq.exe
Token: SeDebugPrivilege	2840	i_xnhfaxspki.exe
Token: SeDebugPrivilege	5348	i_usmkicaxsq.exe
Token: SeDebugPrivilege	5252	i_upmkecaxrp.exe
Token: SeDebugPrivilege	1240	i_urpjhbzxrp.exe
Token: SeDebugPrivilege	6036	i_gezwuomhez.exe
Token: SeDebugPrivilege	5380	i_wtolgdbwto.exe
Token: SeDebugPrivilege	3160	i_wqolgeywqo.exe
Token: SeDebugPrivilege	4484	i_sqoigdxvtq.exe
Token: SeDebugPrivilege	1424	i_qfaxsqkica.exe
Token: SeDebugPrivilege	2936	i_kicaxspnkf.exe
Token: SeDebugPrivilege	4808	i_smkfcxusmk.exe
Token: SeDebugPrivilege	2416	i_upmheczurm.exe
Token: SeDebugPrivilege	5368	i_zurmhecwur.exe
Token: SeDebugPrivilege	5728	i_bwuomjhbzt.exe
Token: SeDebugPrivilege	1272	i_gdbvtqoige.exe
Token: SeDebugPrivilege	2024	i_nlidbytqli.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 1152	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	88
PID 1152 wrote to memory of 944	1152	iexplore.exe	90
PID 944 wrote to memory of 1856	944	msedge.exe	91
PID 944 wrote to memory of 8	944	msedge.exe	92
PID 944 wrote to memory of 4468	944	msedge.exe	93
PID 944 wrote to memory of 4468	944	msedge.exe	93
PID 944 wrote to memory of 1040	944	msedge.exe	94
PID 944 wrote to memory of 1040	944	msedge.exe	94
PID 944 wrote to memory of 1040	944	msedge.exe	94
PID 944 wrote to memory of 124	944	msedge.exe	96
PID 944 wrote to memory of 124	944	msedge.exe	96
PID 944 wrote to memory of 124	944	msedge.exe	96
PID 944 wrote to memory of 4392	944	msedge.exe	97
PID 944 wrote to memory of 4392	944	msedge.exe	97
PID 944 wrote to memory of 4392	944	msedge.exe	97
PID 944 wrote to memory of 4176	944	msedge.exe	99
PID 944 wrote to memory of 1892	944	msedge.exe	98
PID 944 wrote to memory of 4176	944	msedge.exe	99
PID 944 wrote to memory of 4176	944	msedge.exe	99
PID 944 wrote to memory of 1892	944	msedge.exe	98
PID 944 wrote to memory of 1892	944	msedge.exe	98
PID 944 wrote to memory of 5420	944	msedge.exe	100
PID 944 wrote to memory of 5420	944	msedge.exe	100
PID 944 wrote to memory of 5420	944	msedge.exe	100
PID 944 wrote to memory of 2884	944	msedge.exe	102
PID 944 wrote to memory of 2884	944	msedge.exe	102
PID 944 wrote to memory of 3472	944	msedge.exe	103
PID 944 wrote to memory of 3472	944	msedge.exe	103
PID 944 wrote to memory of 3472	944	msedge.exe	103
PID 3276 wrote to memory of 4144	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	104
PID 5716 wrote to memory of 5612	5716	wrpjhbztrm.exe	107
PID 944 wrote to memory of 2808	944	msedge.exe	110
PID 944 wrote to memory of 2808	944	msedge.exe	110
PID 944 wrote to memory of 612	944	msedge.exe	111
PID 944 wrote to memory of 612	944	msedge.exe	111
PID 944 wrote to memory of 5728	944	msedge.exe	113
PID 944 wrote to memory of 2264	944	msedge.exe	114
PID 944 wrote to memory of 2264	944	msedge.exe	114
PID 944 wrote to memory of 4848	944	msedge.exe	115
PID 944 wrote to memory of 4848	944	msedge.exe	115
PID 3276 wrote to memory of 3752	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	118
PID 3276 wrote to memory of 624	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	122
PID 1328 wrote to memory of 1852	1328	dbytrojgey.exe	124
PID 3276 wrote to memory of 4732	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	127
PID 3276 wrote to memory of 4416	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	131
PID 4196 wrote to memory of 4688	4196	lgdytqljdb.exe	133
PID 3276 wrote to memory of 4128	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	136
PID 944 wrote to memory of 2416	944	msedge.exe	138
PID 944 wrote to memory of 2416	944	msedge.exe	138
PID 944 wrote to memory of 4248	944	msedge.exe	139
PID 944 wrote to memory of 4248	944	msedge.exe	139
PID 3276 wrote to memory of 6008	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	142
PID 4704 wrote to memory of 3820	4704	vsqkigaysq.exe	144
PID 3276 wrote to memory of 5636	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	147
PID 944 wrote to memory of 3940	944	msedge.exe	150
PID 944 wrote to memory of 5532	944	msedge.exe	151
PID 944 wrote to memory of 6064	944	msedge.exe	152
PID 3276 wrote to memory of 5596	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	155
PID 3564 wrote to memory of 2644	3564	xnhfaxspki.exe	157
PID 3276 wrote to memory of 1892	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	160
PID 3276 wrote to memory of 1036	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	164
PID 4248 wrote to memory of 4584	4248	usmkicaxsq.exe	166
PID 3276 wrote to memory of 5412	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	169
PID 3276 wrote to memory of 124	3276	2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_09765b084adb153e15b779ed9ecd1eee_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffd1d33c188,0x7ffd1d33c194,0x7ffd1d33c1a0
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1596,i,18420798159170615057,12537438280143789710,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      System Time Discovery
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,9621738981380799303,17111277514237441190,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,15391486488504616530,13498595001558026813,262144 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,2894678945388444948,4968122065203475615,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2164869831161408448,8386531786842793048,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,12079090384339782981,9381547341123114421,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,1953634132421329110,4088068485482518237,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5316,i,13845775655701989257,16180386841178558017,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6088450486623888331,16875175830146565780,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3580,i,8270209785939168569,8013621931598906405,2097152 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,10629884882416787822,4360539011511032892,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,10359777967375479786,6778859389650015816,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,686639640497697783,580150970720735749,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,686639640497697783,580150970720735749,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,12950069835280369443,11718346325339457342,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8637334106964387170,14049961833499428774,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,4262098057024048180,10002636794596457915,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,13063053810000275770,8389317433236740709,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,9573709699694568456,7501970351401594490,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,4329604632121411318,9549935662798128542,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,8458696265762537317,3646560244903885779,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,10999749922832655657,8267964571424969840,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,6625030682856571756,4922307655154976596,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4496,i,11262187009162430185,10749388855323915809,262144 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,8196633267770501351,2782532327373148877,524288 --field-trial-handle=2204,i,372595161947291992,10137228318457951553,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4144
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytrojgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:624
- - C:\Temp\dbytrojgey.exe
    C:\Temp\dbytrojgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytrojgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\i_dbytrojgey.exe
    C:\Temp\i_dbytrojgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4416
- - C:\Temp\lgdytqljdb.exe
    C:\Temp\lgdytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\i_lgdytqljdb.exe
    C:\Temp\i_lgdytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6008
- - C:\Temp\vsqkigaysq.exe
    C:\Temp\vsqkigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5636
- - C:\Temp\i_vsqkigaysq.exe
    C:\Temp\i_vsqkigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xnhfaxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Temp\xnhfaxspki.exe
    C:\Temp\xnhfaxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xnhfaxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1892
- - C:\Temp\i_xnhfaxspki.exe
    C:\Temp\i_xnhfaxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkicaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1036
- - C:\Temp\usmkicaxsq.exe
    C:\Temp\usmkicaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkicaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5412
- - C:\Temp\i_usmkicaxsq.exe
    C:\Temp\i_usmkicaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkecaxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:124
- - C:\Temp\upmkecaxrp.exe
    C:\Temp\upmkecaxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkecaxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2944
- - C:\Temp\i_upmkecaxrp.exe
    C:\Temp\i_upmkecaxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5532
- - C:\Temp\urpjhbzxrp.exe
    C:\Temp\urpjhbzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_urpjhbzxrp.exe
    C:\Temp\i_urpjhbzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwuomhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5356
- - C:\Temp\gezwuomhez.exe
    C:\Temp\gezwuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwuomhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3412
- - C:\Temp\i_gezwuomhez.exe
    C:\Temp\i_gezwuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\wtolgdbwto.exe
    C:\Temp\wtolgdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2284
- - C:\Temp\i_wtolgdbwto.exe
    C:\Temp\i_wtolgdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgeywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\wqolgeywqo.exe
    C:\Temp\wqolgeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgeywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2452
- - C:\Temp\i_wqolgeywqo.exe
    C:\Temp\i_wqolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqoigdxvtq.exe ups_run
  2⤵
  PID:1740
- - C:\Temp\sqoigdxvtq.exe
    C:\Temp\sqoigdxvtq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqoigdxvtq.exe ups_ins
  2⤵
  PID:2960
- - C:\Temp\i_sqoigdxvtq.exe
    C:\Temp\i_sqoigdxvtq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qfaxsqkica.exe ups_run
  2⤵
  PID:3436
- - C:\Temp\qfaxsqkica.exe
    C:\Temp\qfaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qfaxsqkica.exe ups_ins
  2⤵
  PID:1368
- - C:\Temp\i_qfaxsqkica.exe
    C:\Temp\i_qfaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxspnkf.exe ups_run
  2⤵
  PID:5492
- - C:\Temp\kicaxspnkf.exe
    C:\Temp\kicaxspnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxspnkf.exe ups_ins
  2⤵
  PID:3112
- - C:\Temp\i_kicaxspnkf.exe
    C:\Temp\i_kicaxspnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxusmk.exe ups_run
  2⤵
  PID:1952
- - C:\Temp\smkfcxusmk.exe
    C:\Temp\smkfcxusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxusmk.exe ups_ins
  2⤵
  PID:5888
- - C:\Temp\i_smkfcxusmk.exe
    C:\Temp\i_smkfcxusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmheczurm.exe ups_run
  2⤵
  PID:3956
- - C:\Temp\upmheczurm.exe
    C:\Temp\upmheczurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmheczurm.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_upmheczurm.exe
    C:\Temp\i_upmheczurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmhecwur.exe ups_run
  2⤵
  PID:1960
- - C:\Temp\zurmhecwur.exe
    C:\Temp\zurmhecwur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmhecwur.exe ups_ins
  2⤵
  PID:3460
- - C:\Temp\i_zurmhecwur.exe
    C:\Temp\i_zurmhecwur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomjhbzt.exe ups_run
  2⤵
  PID:4872
- - C:\Temp\bwuomjhbzt.exe
    C:\Temp\bwuomjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomjhbzt.exe ups_ins
  2⤵
  PID:5584
- - C:\Temp\i_bwuomjhbzt.exe
    C:\Temp\i_bwuomjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbvtqoige.exe ups_run
  2⤵
  PID:2148
- - C:\Temp\gdbvtqoige.exe
    C:\Temp\gdbvtqoige.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbvtqoige.exe ups_ins
  2⤵
  PID:6036
- - C:\Temp\i_gdbvtqoige.exe
    C:\Temp\i_gdbvtqoige.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidbytqli.exe ups_run
  2⤵
  PID:6140
- - C:\Temp\nlidbytqli.exe
    C:\Temp\nlidbytqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidbytqli.exe ups_ins
  2⤵
  PID:3388
- - C:\Temp\i_nlidbytqli.exe
    C:\Temp\i_nlidbytqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6012

C:\Temp\rojgbytrlj.sys
C:\Temp\rojgbytrlj.sys
1⤵
- Executes dropped EXE
PID:4712

C:\Temp\lfdbvqnljd.sys
C:\Temp\lfdbvqnljd.sys
1⤵
- Executes dropped EXE
PID:3208

C:\Temp\iyvqnlfdav.sys
C:\Temp\iyvqnlfdav.sys
1⤵
- Executes dropped EXE
PID:5912

C:\Temp\cavsqkidav.sys
C:\Temp\cavsqkidav.sys
1⤵
- Executes dropped EXE
PID:1240

C:\Temp\sqnhfcxusn.sys
C:\Temp\sqnhfcxusn.sys
1⤵
- Executes dropped EXE
PID:5356

C:\Temp\urpkhczxsp.sys
C:\Temp\urpkhczxsp.sys
1⤵
- Executes dropped EXE
PID:4512

C:\Temp\ecwusmkeuo.sys
C:\Temp\ecwusmkeuo.sys
1⤵
- Executes dropped EXE
PID:2416

C:\Temp\pmhbztrpjh.sys
C:\Temp\pmhbztrpjh.sys
1⤵
- Executes dropped EXE
PID:4660

C:\Temp\bwuomgeywq.sys
C:\Temp\bwuomgeywq.sys
1⤵
- Executes dropped EXE
PID:3640

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:1372

C:\Temp\dbvtolgdbv.sys
C:\Temp\dbvtolgdbv.sys
1⤵
PID:2108

C:\Temp\ysqkidavsn.sys
C:\Temp\ysqkidavsn.sys
1⤵
PID:5696

C:\Temp\nhfdavsqki.sys
C:\Temp\nhfdavsqki.sys
1⤵
PID:2052

C:\Temp\smkicausmk.sys
C:\Temp\smkicausmk.sys
1⤵
PID:4148

C:\Temp\cxupmhecau.sys
C:\Temp\cxupmhecau.sys
1⤵
PID:3724

C:\Temp\cwurmjhczu.sys
C:\Temp\cwurmjhczu.sys
1⤵
PID:2008

C:\Temp\bztrpjhbzt.sys
C:\Temp\bztrpjhbzt.sys
1⤵
PID:5128

C:\Temp\ywtrljgebw.sys
C:\Temp\ywtrljgebw.sys
1⤵
PID:5600

C:\Temp\vtqljdbytq.sys
C:\Temp\vtqljdbytq.sys
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsqkidav.sys

Path C:\Temp\cavsqkidav.sys
Size 141KB
SHA256 db4d8cc227a5d5a427d0ff4a0ba84fa564994305ac07de664cd1fed1d0f2ef0d
MD5 e830f446c4c8503f694615749ea439f7
SHA1 db87308522af86605bf70a64d15d976c2443fef0
SHA512 13d6f5062d0ac7b3a4004c4b17a8ae222a4999fd086176c4183112c1707b46f9d20e2fb54185d587f70f4d00ac3169baacad68256bd3c87be02c950bb4371a90
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T158E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytrojgey.exe

Path C:\Temp\dbytrojgey.exe
Size 243KB
SHA256 b2960dcdd588cd8c556c1e28848dec0a5cfba069311eb2818b45739e3a084941
MD5 d96b150ddddb9b6ccf56d07d267fd75f
SHA1 3173c1ed3f7ad3044dcea91d7413571d256b957a
SHA512 775cbb114ab7cc9d9fd12987e9f1b121064a7f512e0a53bd7678d72b3cbd04dedec685ff06a435ae3d94b10d115255a3d2bf73fe85a5dbf88a43422c8b30c393
SSDEEP 3072:5CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA73:kvMsLaOa3lLNngoqRttA73
TLSH
T180345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytrojgey.exe

Path C:\Temp\i_dbytrojgey.exe
Size 243KB
SHA256 ddb55d682f7abbdf3a14a1d4ea02d818bfc7861f9fb42fc7f67e9c17e744d39d
MD5 048af9bb58267860ca28a69c3ae7077e
SHA1 90b4663103f9c9e51e993766e5d169bb6e7fa625
SHA512 19c3496bd8631ad448086c0a4f221ed29be481f455562cf30253703c0cdfa66fb8e668ead69589819fc6c9498ab8a11338779be864108ce2a42805056408b0cf
SSDEEP 3072:9CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:wvMsLaOa3lLNngoqRttA7/
TLSH
T145345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdytqljdb.exe

Path C:\Temp\i_lgdytqljdb.exe
Size 243KB
SHA256 c98fc7d794e89a92dad1aa78ea8174651a267c26339095ba9e7580d5fc176f99
MD5 78f8212d9566778504509b91be0eda20
SHA1 d2e0691f3f71bc6cc721860f95a580bc20d3419d
SHA512 d0590f99515af485756588856990341836ecdd3222249c59daf5650ec00666d9ee3690e229a9897619def3884ea89f4bd868a0027cb424f0b82a97e08c09686b
SSDEEP 3072:MCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:vvMsLaOa3lLNngoqRttA7K
TLSH
T1F0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkigaysq.exe

Path C:\Temp\i_vsqkigaysq.exe
Size 243KB
SHA256 24cd6b74fbe2efd27291350418ff31c59c914d3c8bac3ed70566cbdb8a6ef261
MD5 04f910ca59b6226b82f4cc5f4cefeed6
SHA1 0bf9b40e50f62667f8d78d91a5dcb44ec19d6acd
SHA512 c5ccc35d8e9c46b7f24a4d4a83b19e4425a7a2fb8d2f80a230f0798b071bd6facb6e7227f75635816ace92f455010aa85bba38b51878904e4696b80970a431f7
SSDEEP 3072:nCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:CvMsLaOa3lLNngoqRttA7Z
TLSH
T189345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 243KB
SHA256 2f3c3fa8c700c5a8fb3e538c8058bee2e5d87a013f6280020ae811098e9be40d
MD5 c19da9b3f0b87d69df1b21fc8f8e5d94
SHA1 768c0e22d1dc3012568bad7967dcb752d5d71afd
SHA512 4dbe2893f1277b21c30ae6a68f4e096a0077b693201a77cf9d23419b88eea6981fa39edd7878bf9929151e4ca211b82d1ba04f52fa679961b5bd4a4cf0a51db6
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7L:svMsLaOa3lLNngoqRttA7L
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xnhfaxspki.exe

Path C:\Temp\i_xnhfaxspki.exe
Size 243KB
SHA256 35f98fbff6ab7397fd5da94ce1c0e2901cb78173f8f2ce418d8ede96750c25f3
MD5 9d9d02c0a6fa2ceb69db3e4a266deb61
SHA1 47e919aee13de4b05d3ac0c01f84a1e13dc51fc9
SHA512 b9f33a7e33b72a59511295059c4b62c0b2fb32fcea3afc33b2f565669f767b71274b69ddcc2e63f34dbbfcd412a56eb1c6ddca0165516793871a1fd9f10b09e2
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:jvMsLaOa3lLNngoqRttA7+
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

iyvqnlfdav.sys

Path C:\Temp\iyvqnlfdav.sys
Size 141KB
SHA256 7c533e6efef30024f1573b7ed95bce4fedb539eb48e9d743dab46365e9001175
MD5 743b66ac390b594aebc8ee14316e221b
SHA1 7a0085b5162761b9159fa42d41e9b5c34f1b74ab
SHA512 3280a1a5f9dd6aa363552cf87e07927a4ad51982e5c782de0634df48c13b3cfac20b16d5415688307a345f3b8f4fe74a18d2a636cb1732970492a4fc09a7b0ca
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdbvqnljd.sys

Path C:\Temp\lfdbvqnljd.sys
Size 141KB
SHA256 4fa613f8e323016fec5d30002954a95fa2b6e7f53c31195dc20567069a9a93a5
MD5 29b2d48b69dbd1ba1edc11603a4dd369
SHA1 8e720c62a52b744bde34597ae9b1ddc26b7c5bec
SHA512 0ce297b70651f7ae147764fcdf6998388fb7a848a0050175e93054bab58fb351d04f886dfe0e00a80b33b82471e66e73a9828683fe29d598ddd4811abf5ee5ba
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdytqljdb.exe

Path C:\Temp\lgdytqljdb.exe
Size 243KB
SHA256 cceaa7810f3dca8eff79638a91469e3bd81dafc59dd741bfa250685e44f3732a
MD5 c37bfb59fd08c95707ce86f85f93dba8
SHA1 557f48efaecefbdd0446b5c3f185c8a55379aefb
SHA512 64063dc570b357fd21093a2690249b0fcb393589d2b466cb38d13229053a9ef422579251c7a66dbd75bb3cee6843362bff8379352af93376a7c24b9100774909
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:GvMsLaOa3lLNngoqRttA7V
TLSH
T173345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbytrlj.sys

Path C:\Temp\rojgbytrlj.sys
Size 141KB
SHA256 c0dde3891fe4be4e7836c8fe50c5e5b0f7bc0c2c991e2bdb2629c500d59dc878
MD5 6fad1197df8b1982110a285ea5c932e8
SHA1 7abe0cb03f249d15d5882e06fc8e028730ca1a84
SHA512 c61effafa9743679be5d9f3eefbb06b051e5c1e67118cac3a07cc5717e8d67ad28cc21606dc2d2f83c34536cb478ad206367096f58caaa7b4c325fbd55fe711e
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnhfcxusn.sys

Path C:\Temp\sqnhfcxusn.sys
Size 141KB
SHA256 c4d90e29b0fe734951b47406b8a2f2b0304d8e1637405132163127f35ca0431c
MD5 2803c276bde86e015995daa3ea06e40a
SHA1 aeadad54450239fc5e6cca499d59e10bfb089fee
SHA512 c2a49476f910521c08edad7c0012ba18cb60d071862c9bcc68418678641515eed673d0767c9e4340933dc1692524f24d6fe0325565f1ec5a1a47baf03ba41313
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T105E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkicaxsq.exe

Path C:\Temp\usmkicaxsq.exe
Size 243KB
SHA256 4676ec858820dd0dca499082d4dd2b5acceeb5a127228f5ac2e32acfe9fb68c1
MD5 3408d6bf1a9d0ef8b2ee3ecc00bf7587
SHA1 bdac19f42835eb420c435f106ec84ab7b4e7d89a
SHA512 9a3221d37ece91c6e8d72ae9e3df4c76c170732e98fc1758be727994655ccb8c01aa770e9b79582d7ae90a7ee2a5578274f5a3ad9994e20e186b39c55246133d
SSDEEP 3072:PCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:avMsLaOa3lLNngoqRttA7B
TLSH
T132345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkigaysq.exe

Path C:\Temp\vsqkigaysq.exe
Size 243KB
SHA256 1f51917cce56a36ecb17a54828e44615dae45aad67db3eb66a53e0ce43b828c0
MD5 bcf792dded7574047899f676faf613dd
SHA1 7bc00887f3368f1acbbcc103d0c083d2e791fd0e
SHA512 d4f57bde27de2126b2c538e2371fd9c45e5660dc2fa1e19e86e60ff17a51cb5906a4309799ffe0aca7feb066dfe77284b00c7685417924c2e90f364484e1f969
SSDEEP 3072:ICvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:zvMsLaOa3lLNngoqRttA76
TLSH
T1D6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 243KB
SHA256 83edc1fae0e10c9dc9a20d2a207641069b9c6a0d7951ffe7df1369c826a75ed0
MD5 fad584d243e7861644b3eaa46a16c3b6
SHA1 20ae2ac404fd4969b30d52fe34d980532a9bd3dd
SHA512 24346b126d22bc3042992010e59ad74acbd7874adc7629d744648a06fe3f8e13bf7630730d32bdfce10d7a2baf1e58440b685288f3c7c10d0af39007cdf31945
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:8vMsLaOa3lLNngoqRttA7j
TLSH
T173345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xnhfaxspki.exe

Path C:\Temp\xnhfaxspki.exe
Size 243KB
SHA256 5302604daedd4e215521efdb8c4927421c808506aa54e29affeeac7d2a9ae35e
MD5 c2fad6e0eac3ef4f5439e3f1d55ccaea
SHA1 b4a6757b0cd78a0daf4d9a3f3b1c44bbc057209a
SHA512 824bf8b5f8daf89d0917bab712ef204cada23caf70d3e6d38d1170c1f1a66e9bc741ff65f6f67caaee8ddd57ab234e85c51b86ec0277bfed8fdbfac65947e887
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:jvMsLaOa3lLNngoqRttA7q
TLSH
T16E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ef717dac24644b3351c035424c5c7d1e2fa342057b5c0c5a683c5b384ff374bd
MD5 d12274ab84840cf06070470c18e99ded
SHA1 7d41ec6df40ca593d3219d49394e3e1dd7c9b527
SHA512 f477df5c543ac5026ccdc3294d7af956831e7ea50bd0d466da5ce5507c0ae9d36c98e2887d045645c66054eb168707e73c9d94798197a951ba5fe8f022451666
TLSH
T14E410D58837CCFCDDBA409B1BCF0D6843ABE98CE0307AE50D4A41BBC5A02B844991193
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599ed6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599ed6.TMP
Size 2KB
SHA256 bd52fac73178f2e4dddafdd76799035dbdb0e93905a064a73438c086b995860a
MD5 5098282bc8b1ee4c58c79bb27a435973
SHA1 db7c08673e720c459f1fb6d8fb9499cfce706dee
SHA512 3ac90c3e88692ba605078a864f47cb627888ce82b8c4ff336c290666e6bc26189435b07f90e6c3dfbcaca595d0fc015697dcbdca97c95e746d5227e1a8f9e06d
TLSH
T1F2410D58833CDFCDDBA409B1BCF0C6843ABED8CE0307AE40D4A41ABC4A06B845991193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b87e015fe041897b470b50020b196cf6d473d5678fb04ccfa62e77f3ecc38fb3
MD5 838ad13229801c76d9b50fdfe90cd675
SHA1 9d8a35e4836785717a76b5e82323afdc2d223393
SHA512 ff5803ef185c2c5ab83bb0be149c1c3e532dbbaa69b58fb7687187864335241bd2ba78c9abf0f9adc68ce70b0d0d1f0ec41e2250d91272a55c86392761c57105
TLSH
T16841ACF3C3F8856E890156F0AA146F2BDE2D0915832C7D5AC9E4AE2B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3595b43e47dbf948a09fb9c779c32168b3b7fe46f55501648c134896719f023d
MD5 e07f13a0f104f5def98e7c589303d928
SHA1 b36769311a881233b6039c81dd1da0559ad4dd23
SHA512 bf48aaab4ef3a06a4a3835be496bbb0bf3148a67c6a717437b6de405576630f7bf43150bd2ea548fb2c58d32e4fb4b8a0e9ff786a7475dd6d2065ea42d6146ff
SSDEEP 192:sxRucR+yM/jK1Ml8UQJCv/fxsDZMZlyzzoA8pri/g6+WNCKx/YnQhqehXGX8IgDJ:sxRucoqwv/fxsDZyz2/5F/tLGgt
TLSH
T16C62E815AA34AD7B9CDBD20DFA55BF53D6F81572A2901E44AAFC9E0C00E76DD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02a4f29881003846c5cd0c3a1c9aaacf0a0a1e10d596eee23f75447552f84794
MD5 94445f24ff3f764d113c8f79e0098567
SHA1 865c49d5f0193d5a2974785a7918a7f3d7e0aefb
SHA512 1ebfee9b5f1476e64f918f2c1ad555eb16c5266d3eedf27b77b72e18c379edca2dec26cef2dbf2c2dc4b9ed67f28cfbb61c04769a265eec83ffc713887b29739
SSDEEP 192:sxRuvR+yM/jK1Ml8wCv/fxsTnMZlyzzoA8p9i/g6+WNCKx/YnQU8hXGX8IgVSJ:sxRuvo8v/fxsTnyz8/5F/t7Ggw
TLSH
T14062E8156A34AD7B8CDBD20CFA557F53D6F81573A2901E44AAFC9A1C04E7AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3d1b67de159a7e932f25c1acac51812b4cbad4c1eb304bbda1622c3ed1d9155d
MD5 a2c1e79cbdc58e9cd4dae5889e3f2b87
SHA1 6692665b39926143490fe692a11ee9dd772498f5
SHA512 a6b256521529433a66c3aabdd496242585f6410aeac484c20fc8ab832218ab3300702bd698fd76369c8d6182a2390cd7e71d386ec66b473b9a27dd2653d7e516
SSDEEP 192:sxRucR+yM/jK1Ml8wCv/fxsDnMZlyzzoA8p9i/g6+WNCKx/YnQU8hXGX8IgD8SJ:sxRuco8v/fxsDnyz8/5F/t7Ggh
TLSH
T10162F9156A34AD7B8CDBD20CFA557F53D6F81573A2901E44AAFC9A1C04E76EC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a75c4339113b8d4e7d37c5cb078b5972cc663ca7a5a39c56e0f4142dd4cd6183
MD5 75ed1f7b9bc7351530cb07c89494de54
SHA1 5797fd614332759f0940ef20ad91545736a946dd
SHA512 d96e37fbc83df25272c649d6da89eafd655a9ade54bc340028bdb54346e9fb0550002ad3eb1d74e16e936acf8aef549f07ead6757dcb024af7b4844a2f331df2
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQPOu4YOroSj8ip:wGedPsE7X6WgoufDMu1jabPOVYFOp
TLSH
T1C5E2EC3B684CCB7E4F804DDCEC29BE9FADA801CB5AD8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88a36076732a21d619f23952e9407361dce28bd6b58767792af47362209f6e4f
MD5 0f6d207528fbf4cbb31b7fd6fbe08151
SHA1 864fe08c5288ff7ee9531a638e342d5ca43e01a1
SHA512 3647668b377f6bcebcd7d049df5d977ed2a827cc9ebbf9929598fff9b145795eb063423207eba566c47ec5435f61b9cfae3d84bc178755f603b04be90c6fe95e
SSDEEP 96:KRwBUAyeSIWWLbgIIK4Ng6Icoob6AFHjsJ9rhhdW18qgjbK4igtbcx50HPoHpm3V:CwBUAyeSfWLkIMNg6noob6AFHjsJ9rhB
TLSH
T1A091E245317E02403C7EAA0981F9982EE3D178E23554B42F7BE901E65B66E039EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a38f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a38f3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ee8e5e44ccf11478135e2b5440542419c541338822d5c70de5118c5ab96267b5
MD5 44e9b7d27d6fa08407e6d5ac2a34622e
SHA1 374303c18a18aad7787e57c128f91cb95c1a8e4c
SHA512 4ec3d1e2d290853d8a7982e7381d70c828abe2df3ee12e4d51e0176d3688961d1f8656192ff9ddcc63c6dca831f6520a8be7cf82b1b85680fec67ad842d6d29d
SSDEEP 768:hFQn38wgfjZQ5O0WhTCNzc4ReyIsPT2ewBKZOhY:wn3CCtc44bsL2evZJ
TLSH
T1981317F198E78936ECAE6387A73D6D429DFCD163B0885994B7985E0CCC421BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b75209bfcd591af0627a66511fc9b67c45438b3f76bae5c3acc993f73b9182ff
MD5 e30869335fdb0aa345be6328dc9d3b35
SHA1 1b2a4ee5a70d081524606e91b63742c1fa258c0b
SHA512 7198a2ab375a22db275d8b87c6899dc56b7d8415666cb81b31d4366da43bf22252be1775c451a5d421f9c4b0b3c898ebe36a6e2e628dcd71c6cafd5356a956d6
SSDEEP 768:lrv+4UNbds3lEDZIO0WhTWNzc4ReyIs2TeVH1S5D:lbsbS32Wtc44bsEEH1Y
TLSH
T1E303CE32E838DD33ACEA6285B10B72937EF8212B81840E94C9E95F4C4A471DE175F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7623f2f9ff30ee0f86afb7015eede75fb3ed5e1e6eb1ec15bd20e7ba69cac169
MD5 683025f44ebdc78dcaec72d77a8334fc
SHA1 239e0eeefefc1c74a473526cfef009f6f8480f71
SHA512 364170baaef6f4b44a9cd51a843844ab686eca2115b9817df534c76ebc3900a4dd606e34d5d31a5b75af3fb1486d9de1ade58a5bec58a358de3f39eef631afbc
SSDEEP 768:xrv+4UNbdb356DZIO0WhTeNzc4ReyIsPTeVH1S5F:xbsbN3Ietc44bsLEH1W
TLSH
T17713BE32A878DD33ACEA6245B54B76537EF8612B81840E94C9ED5F0C09872DE175FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f6347f8f1e8f3a07a96873761e21c673f53d35083c8888d126680753a9199ebe
MD5 a63f6737ecc101eace4bc5e1f0e0fbec
SHA1 77d53c124ffce18339adac4d702dd05bbd9d84ed
SHA512 6e5279aa39089b1bf6c623fcc6507e101ccaf716fcd0d442e7bcbec81e209177a5fc4c6c177316118856f02341a3cd8300afca363da8a43a6d3a504db7106399
SSDEEP 768:kA3w6DZIO0WhTeNzc4ReyIsPT2ewBKZOhY:kA3Retc44bsL2evZJ
TLSH
T157F2BF71EC389C63ACEA7245BA0A3243BDF4617781D85E58DAED6F0C044329D175FD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a5a8baca1abd688da79d7201eb3a3c94a733e692f976030cc42c7d237e6640e
MD5 a1e741169af119aa725946fc716113f9
SHA1 230bde5f6f70024b38dccc14de5487dc6bf3856c
SHA512 b5881ed6512a77fd7522ffbbbf49ca8d10e7209ac64e789ef06820755e1ea5488d22222b65fe64d2d112efa9c153325de244f2c6018177c1a495388f6f830492
SSDEEP 768:6rv+4UNbds3RPDZIO0W/Nzc4ReyIsXxeVH1S5D:6bsbS35tc44bsBEH1Y
TLSH
T16203BE32E8788977ACF66785B50B76533EF8912782981B94C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

61e00f19-fdeb-4698-b838-79a19dcb0828.tmp

Path C:\Users\Admin\AppData\Local\Temp\61e00f19-fdeb-4698-b838-79a19dcb0828.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir944_1823543100\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1372-620-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1372-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-714-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2052-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2108-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3208-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3640-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-671-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4512-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-575-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4712-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5128-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5356-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5356-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-694-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5696-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5912-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download