9c69f8a8bae4e6ab30f7b4a607788946e052c78a316b718aa600a56aa329ed2e

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 06:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe
Size 243KB
Sample260813-gzbb7sstdw
SHA256 9c69f8a8bae4e6ab30f7b4a607788946e052c78a316b718aa600a56aa329ed2e
MD5 9eff9093ccf4778ad5d922739f0390d0
SHA1 6ad26de95e9d33739df38af00f993552f74155ee
SHA512 6764c9098bd8a0c9777418f2682984338497ca6185ff562c0008e88817e164817c585cde575fbf6cf67c4965cb69603600c9174cfc3b6d5a3205445fc9cfcee6
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA79:uvMsLaOa3lLNngoqRttA79
TLSH
T11C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3588	CP.exe
3676	spkicaupkh.exe
4776	CP.exe
4888	CP.exe
5228	i_spkicaupkh.exe
5068	kecwrpjhcz.sys
4964	CP.exe
2344	urpmhfzxrp.exe
4212	CP.exe
5452	CP.exe
1168	i_urpmhfzxrp.exe
2896	omjezwromg.sys
3336	CP.exe
3448	jebztomjec.exe
5544	CP.exe
1260	CP.exe
2428	i_jebztomjec.exe
1708	ebwtolgebw.sys
3736	CP.exe
428	ytqojdbztq.exe
5656	CP.exe
4580	CP.exe
1300	i_ytqojdbztq.exe
5980	wqoigaywqo.sys
3256	CP.exe
1908	wqljdbvtnl.exe
5124	CP.exe
4968	CP.exe
2744	i_wqljdbvtnl.exe
1112	vqolfdbvtn.sys
1940	CP.exe
1240	ifaysqkiga.exe
3004	CP.exe
2488	CP.exe
4768	i_ifaysqkiga.exe
4368	nigaysqkid.sys
3328	CP.exe
3812	igavsnlfdx.exe
2916	CP.exe
2336	CP.exe
2396	i_igavsnlfdx.exe
1300	xspnhfdxvp.sys
2980	CP.exe
4616	xvpnhczxsp.exe
2496	CP.exe
704	CP.exe
4840	i_xvpnhczxsp.exe
5820	ausmkfcxup.sys
3244	CP.exe
2696	mkeczusmke.exe
5800	CP.exe
2444	CP.exe
4268	i_mkeczusmke.exe
1052	zxrpkhcaup.sys
4416	CP.exe
4512	mhecwurmjh.exe
4260	CP.exe
1016	CP.exe
4840	i_mhecwurmjh.exe
3524	hezwrpjhbz.sys
2148	CP.exe
3856	bztrmjhezw.exe
4768	CP.exe
5264	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1428411674\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1354217032\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1915501183\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_1428411674\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4692_716813112\_locales\am\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoljdbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicaupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicaupkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqojdbztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqojdbztq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztomjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoljdbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlfdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnifayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnifayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlfdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpmhfcxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpmhfcxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurpjhc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5380	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3956	ipconfig.exe
4332	ipconfig.exe
2464	ipconfig.exe
2456	ipconfig.exe
6040	ipconfig.exe
4324	ipconfig.exe
4252	ipconfig.exe
3956	ipconfig.exe
3012	ipconfig.exe
2556	ipconfig.exe
4360	ipconfig.exe
4512	ipconfig.exe
3296	ipconfig.exe
920	ipconfig.exe
4908	ipconfig.exe
3292	ipconfig.exe
5848	ipconfig.exe
2064	ipconfig.exe
252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310752681785125"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{C8255FD1-4DEB-4998-9145-4B35714CC898}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5592	msedge.exe
5592	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	i_spkicaupkh.exe
Token: SeDebugPrivilege	1168	i_urpmhfzxrp.exe
Token: SeDebugPrivilege	2428	i_jebztomjec.exe
Token: SeDebugPrivilege	1300	i_ytqojdbztq.exe
Token: SeDebugPrivilege	2744	i_wqljdbvtnl.exe
Token: SeDebugPrivilege	4768	i_ifaysqkiga.exe
Token: SeDebugPrivilege	2396	i_igavsnlfdx.exe
Token: SeDebugPrivilege	4840	i_xvpnhczxsp.exe
Token: SeDebugPrivilege	4268	i_mkeczusmke.exe
Token: SeDebugPrivilege	4840	i_mhecwurmjh.exe
Token: SeDebugPrivilege	5736	i_bztrmjhezw.exe
Token: SeDebugPrivilege	2528	i_wqoljdbzwu.exe
Token: SeDebugPrivilege	4300	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	5272	i_vtqlfdbvqo.exe
Token: SeDebugPrivilege	3944	i_axvpnifayv.exe
Token: SeDebugPrivilege	5964	i_nhfaxspnic.exe
Token: SeDebugPrivilege	5672	i_axvpmhfcxr.exe
Token: SeDebugPrivilege	3524	i_keczurpjhc.exe
Token: SeDebugPrivilege	5192	i_ywuomgezwu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1660	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	89
PID 1660 wrote to memory of 4692	1660	iexplore.exe	90
PID 4692 wrote to memory of 4612	4692	msedge.exe	91
PID 4692 wrote to memory of 5108	4692	msedge.exe	92
PID 4692 wrote to memory of 5380	4692	msedge.exe	93
PID 4692 wrote to memory of 5108	4692	msedge.exe	92
PID 4692 wrote to memory of 5108	4692	msedge.exe	92
PID 4692 wrote to memory of 2960	4692	msedge.exe	94
PID 4692 wrote to memory of 2960	4692	msedge.exe	94
PID 4692 wrote to memory of 2228	4692	msedge.exe	95
PID 4692 wrote to memory of 2228	4692	msedge.exe	95
PID 4692 wrote to memory of 2228	4692	msedge.exe	95
PID 4692 wrote to memory of 5624	4692	msedge.exe	96
PID 4692 wrote to memory of 5624	4692	msedge.exe	96
PID 4692 wrote to memory of 5624	4692	msedge.exe	96
PID 4692 wrote to memory of 4900	4692	msedge.exe	99
PID 4692 wrote to memory of 1120	4692	msedge.exe	98
PID 4692 wrote to memory of 4900	4692	msedge.exe	99
PID 4692 wrote to memory of 4900	4692	msedge.exe	99
PID 4692 wrote to memory of 1120	4692	msedge.exe	98
PID 4692 wrote to memory of 1120	4692	msedge.exe	98
PID 4692 wrote to memory of 2200	4692	msedge.exe	100
PID 4692 wrote to memory of 2200	4692	msedge.exe	100
PID 2524 wrote to memory of 3588	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	102
PID 3676 wrote to memory of 4776	3676	spkicaupkh.exe	105
PID 4692 wrote to memory of 5408	4692	msedge.exe	108
PID 4692 wrote to memory of 3972	4692	msedge.exe	109
PID 4692 wrote to memory of 5408	4692	msedge.exe	108
PID 4692 wrote to memory of 3972	4692	msedge.exe	109
PID 4692 wrote to memory of 2296	4692	msedge.exe	111
PID 4692 wrote to memory of 5268	4692	msedge.exe	112
PID 4692 wrote to memory of 5268	4692	msedge.exe	112
PID 4692 wrote to memory of 1988	4692	msedge.exe	113
PID 4692 wrote to memory of 1988	4692	msedge.exe	113
PID 2524 wrote to memory of 4888	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	116
PID 4692 wrote to memory of 4912	4692	msedge.exe	118
PID 4692 wrote to memory of 4912	4692	msedge.exe	118
PID 4692 wrote to memory of 3280	4692	msedge.exe	119
PID 4692 wrote to memory of 3280	4692	msedge.exe	119
PID 4692 wrote to memory of 3268	4692	msedge.exe	122
PID 4692 wrote to memory of 3268	4692	msedge.exe	122
PID 4692 wrote to memory of 3268	4692	msedge.exe	122
PID 2524 wrote to memory of 4964	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	123
PID 2344 wrote to memory of 4212	2344	urpmhfzxrp.exe	125
PID 4692 wrote to memory of 3008	4692	msedge.exe	128
PID 4692 wrote to memory of 3008	4692	msedge.exe	128
PID 4692 wrote to memory of 3008	4692	msedge.exe	128
PID 2524 wrote to memory of 5452	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	129
PID 4692 wrote to memory of 5736	4692	msedge.exe	132
PID 4692 wrote to memory of 5736	4692	msedge.exe	132
PID 4692 wrote to memory of 5736	4692	msedge.exe	132
PID 2524 wrote to memory of 3336	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	134
PID 3448 wrote to memory of 5544	3448	jebztomjec.exe	136
PID 2524 wrote to memory of 1260	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	139
PID 2524 wrote to memory of 3736	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	143
PID 428 wrote to memory of 5656	428	ytqojdbztq.exe	145
PID 4692 wrote to memory of 2252	4692	msedge.exe	149
PID 4692 wrote to memory of 3748	4692	msedge.exe	150
PID 4692 wrote to memory of 1860	4692	msedge.exe	151
PID 2524 wrote to memory of 4580	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	152
PID 2524 wrote to memory of 3256	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	156
PID 1908 wrote to memory of 5124	1908	wqljdbvtnl.exe	158
PID 2524 wrote to memory of 4968	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	161
PID 2524 wrote to memory of 1940	2524	2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_9eff9093ccf4778ad5d922739f0390d0_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff8c661c188,0x7ff8c661c194,0x7ff8c661c1a0
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,10575851112281797659,5023616540024383990,262144 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7650619651989788281,11675461470035119992,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
      4⤵
      System Time Discovery
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,5056951193105529414,3266342953284338293,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,15121779322525324363,5968413893420706191,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,1134656788960330501,12153072020844226171,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13237271820111874286,913958341622281156,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11213565169454765435,15235173970180815999,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,2292465195826773049,12835377312495861516,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,6763739967289074013,8708451734313736330,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,11530427965022393061,15792393531258333660,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8834637753375699897,11360854488069747865,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,8834637753375699897,11360854488069747865,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,2564021446454916277,12729538085677888228,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:5268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,7116990218488230748,8047209433075586737,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13121945713460344924,101527466779556431,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,15152705025267520600,17111787491281825283,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6616,i,1120289922061563098,11770642892777328443,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3660,i,1615613384994527284,1296044317400418886,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6116,i,7715023995477349668,15050136822768966840,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15133359841866003973,5402448634401793843,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,6694222033619617112,17164744622111083454,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,16952699261955899535,14460063973576652654,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:14
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5576,i,16206572512701220757,7658768750441143391,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,17473075389531026838,15676895817805195200,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,10776282809453701859,2551938268352324036,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,10149724956246750258,13685053455745384075,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,17239332058793898351,3173102107619208482,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,16245442447922412129,12720350238602846649,262144 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5472,i,12359867208011168740,18385006103774703341,2097152 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,11086675978836092699,11411112725390424601,524288 --field-trial-handle=2256,i,6662795180425952231,620436378093638508,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicaupkh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3588
- - C:\Temp\spkicaupkh.exe
    C:\Temp\spkicaupkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicaupkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4888
- - C:\Temp\i_spkicaupkh.exe
    C:\Temp\i_spkicaupkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpmhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\urpmhfzxrp.exe
    C:\Temp\urpmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpmhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5452
- - C:\Temp\i_urpmhfzxrp.exe
    C:\Temp\i_urpmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebztomjec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Temp\jebztomjec.exe
    C:\Temp\jebztomjec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebztomjec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\i_jebztomjec.exe
    C:\Temp\i_jebztomjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqojdbztq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3736
- - C:\Temp\ytqojdbztq.exe
    C:\Temp\ytqojdbztq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqojdbztq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_ytqojdbztq.exe
    C:\Temp\i_ytqojdbztq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3256
- - C:\Temp\wqljdbvtnl.exe
    C:\Temp\wqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4968
- - C:\Temp\i_wqljdbvtnl.exe
    C:\Temp\i_wqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\ifaysqkiga.exe
    C:\Temp\ifaysqkiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\i_ifaysqkiga.exe
    C:\Temp\i_ifaysqkiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igavsnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\igavsnlfdx.exe
    C:\Temp\igavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igavsnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2336
- - C:\Temp\i_igavsnlfdx.exe
    C:\Temp\i_igavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhczxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\xvpnhczxsp.exe
    C:\Temp\xvpnhczxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhczxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:704
- - C:\Temp\i_xvpnhczxsp.exe
    C:\Temp\i_xvpnhczxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkeczusmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\mkeczusmke.exe
    C:\Temp\mkeczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkeczusmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2444
- - C:\Temp\i_mkeczusmke.exe
    C:\Temp\i_mkeczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhecwurmjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4416
- - C:\Temp\mhecwurmjh.exe
    C:\Temp\mhecwurmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhecwurmjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1016
- - C:\Temp\i_mhecwurmjh.exe
    C:\Temp\i_mhecwurmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjhezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\bztrmjhezw.exe
    C:\Temp\bztrmjhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjhezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5264
- - C:\Temp\i_bztrmjhezw.exe
    C:\Temp\i_bztrmjhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoljdbzwu.exe ups_run
  2⤵
  PID:3656
- - C:\Temp\wqoljdbzwu.exe
    C:\Temp\wqoljdbzwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoljdbzwu.exe ups_ins
  2⤵
  PID:2604
- - C:\Temp\i_wqoljdbzwu.exe
    C:\Temp\i_wqoljdbzwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  PID:4248
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  PID:3664
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqlfdbvqo.exe ups_run
  2⤵
  PID:4292
- - C:\Temp\vtqlfdbvqo.exe
    C:\Temp\vtqlfdbvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqlfdbvqo.exe ups_ins
  2⤵
  PID:5896
- - C:\Temp\i_vtqlfdbvqo.exe
    C:\Temp\i_vtqlfdbvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpnifayv.exe ups_run
  2⤵
  PID:4332
- - C:\Temp\axvpnifayv.exe
    C:\Temp\axvpnifayv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpnifayv.exe ups_ins
  2⤵
  PID:3248
- - C:\Temp\i_axvpnifayv.exe
    C:\Temp\i_axvpnifayv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxspnic.exe ups_run
  2⤵
  PID:5660
- - C:\Temp\nhfaxspnic.exe
    C:\Temp\nhfaxspnic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxspnic.exe ups_ins
  2⤵
  PID:2928
- - C:\Temp\i_nhfaxspnic.exe
    C:\Temp\i_nhfaxspnic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpmhfcxr.exe ups_run
  2⤵
  PID:1932
- - C:\Temp\axvpmhfcxr.exe
    C:\Temp\axvpmhfcxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpmhfcxr.exe ups_ins
  2⤵
  PID:2324
- - C:\Temp\i_axvpmhfcxr.exe
    C:\Temp\i_axvpmhfcxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczurpjhc.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\keczurpjhc.exe
    C:\Temp\keczurpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczurpjhc.exe ups_ins
  2⤵
  PID:5036
- - C:\Temp\i_keczurpjhc.exe
    C:\Temp\i_keczurpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomgezwu.exe ups_run
  2⤵
  PID:5288
- - C:\Temp\ywuomgezwu.exe
    C:\Temp\ywuomgezwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomgezwu.exe ups_ins
  2⤵
  PID:4404
- - C:\Temp\i_ywuomgezwu.exe
    C:\Temp\i_ywuomgezwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1320

C:\Temp\kecwrpjhcz.sys
C:\Temp\kecwrpjhcz.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Temp\omjezwromg.sys
C:\Temp\omjezwromg.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\ebwtolgebw.sys
C:\Temp\ebwtolgebw.sys
1⤵
- Executes dropped EXE
PID:1708

C:\Temp\wqoigaywqo.sys
C:\Temp\wqoigaywqo.sys
1⤵
- Executes dropped EXE
PID:5980

C:\Temp\vqolfdbvtn.sys
C:\Temp\vqolfdbvtn.sys
1⤵
- Executes dropped EXE
PID:1112

C:\Temp\nigaysqkid.sys
C:\Temp\nigaysqkid.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\xspnhfdxvp.sys
C:\Temp\xspnhfdxvp.sys
1⤵
- Executes dropped EXE
PID:1300

C:\Temp\ausmkfcxup.sys
C:\Temp\ausmkfcxup.sys
1⤵
- Executes dropped EXE
PID:5820

C:\Temp\zxrpkhcaup.sys
C:\Temp\zxrpkhcaup.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\hezwrpjhbz.sys
C:\Temp\hezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:3524

C:\Temp\trljgeywro.sys
C:\Temp\trljgeywro.sys
1⤵
PID:5688

C:\Temp\igbywqoigb.sys
C:\Temp\igbywqoigb.sys
1⤵
PID:4840

C:\Temp\dyolfdyvqo.sys
C:\Temp\dyolfdyvqo.sys
1⤵
PID:3204

C:\Temp\kigaysqnlf.sys
C:\Temp\kigaysqnlf.sys
1⤵
PID:4468

C:\Temp\nlfcxvsnki.sys
C:\Temp\nlfcxvsnki.sys
1⤵
PID:5104

C:\Temp\auspkiczxs.sys
C:\Temp\auspkiczxs.sys
1⤵
PID:4636

C:\Temp\hezwusmkec.sys
C:\Temp\hezwusmkec.sys
1⤵
PID:5228

C:\Temp\ezxrpjhbzw.sys
C:\Temp\ezxrpjhbzw.sys
1⤵
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtolgebw.sys

Path C:\Temp\ebwtolgebw.sys
Size 141KB
SHA256 da613e03a1753d56e1e14bb7810ffad8daa0b74fc0c41db85152c2e522580b8c
MD5 8e059d9fd1a31ae23b8fb5b1f84ff64f
SHA1 be5df16702dca0a5422631428538bf70d4d44b27
SHA512 d4f3d8fa176224208a748928836466ea1f3a32790270a9e2d0e7763e56275548fbdea9fab8854d41cee2d0c68c220397c12a7b1d13b619fbb09af76e532355f1
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebztomjec.exe

Path C:\Temp\i_jebztomjec.exe
Size 243KB
SHA256 4b18486d1e7b529a68008610b427cb3a6fe204bd7df3eba89d80c123bf6044a6
MD5 629ecf3cf91db754682aaaf101dc3da6
SHA1 d9db2158c75f72f1ce65947aab52d3dc223c124a
SHA512 d3a61f05439b0519b19245c9aab68b3385955efb0aed06c572fea5147a8bfcb62de6ff0971769150e51270dfa4b5953d0ab67d6c43188eec27f3305f476df363
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:8vMsLaOa3lLNngoqRttA7P
TLSH
T16B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicaupkh.exe

Path C:\Temp\i_spkicaupkh.exe
Size 243KB
SHA256 c52770a426b2103789874587f7eca3820b310147c80d8d9caa482fa3b385b81a
MD5 519bf0b45d7f1b0ca83c5a09078683c4
SHA1 fcc058efb1f3074b8590f30f3efcc97f3377761a
SHA512 ffda333de651fd859364d291158dd08dfa32f01a215ca578afd0147d17f90b7fc9597a2c6a46fb917f83f9abbd3c00ac7a23e1cf028b715e32cf779a01ad0dc4
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:WvMsLaOa3lLNngoqRttA7p
TLSH
T1CE345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpmhfzxrp.exe

Path C:\Temp\i_urpmhfzxrp.exe
Size 243KB
SHA256 0af265052f59c4fda803524e2f7b3afce12dcbbd2e9992ef40c7da7c518a7975
MD5 4ca2bf39ba3895626fad1b76cdda4225
SHA1 721cd8a011911aab5b68a9a60cd6b34f92cdce23
SHA512 ba982550700ad34880d790ada46b35f4d3dda5026b50ca9f045279b779e21beb27c54ff3441193f93a7da7423aa2387bed315ababd2545fca8bc094e9809a396
SSDEEP 3072:ACvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:7vMsLaOa3lLNngoqRttA7a
TLSH
T13E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqljdbvtnl.exe

Path C:\Temp\i_wqljdbvtnl.exe
Size 243KB
SHA256 e1f3ac6e3df20666a6bf3f70b927b7a3142d89ee550aef55de61050671487932
MD5 6a08c908931db3e4f528190975c2c137
SHA1 f984a7e850259c4b83cd8b083ba8bd281b29e164
SHA512 dfffb5c2ee738ad06a11fc5538e05186ea3a961836133a18a9c4cbaae078ff74cc7de711a05d9dbee79484e1da14ca352ebe6c81f1a8999329e8ba366237ae50
SSDEEP 3072:sCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7u:PvMsLaOa3lLNngoqRttA7u
TLSH
T10E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqojdbztq.exe

Path C:\Temp\i_ytqojdbztq.exe
Size 243KB
SHA256 d987310f049a14b39602cd9c9c3ee792fb9cad8c0f4a341c993b74703995a204
MD5 e61b5482e181c2455755bf6fb96ce2fa
SHA1 2431daa6fbfc2d0739f92e765e4a0f8736e6798f
SHA512 35f39a03ac35b9b7110140138097f607677c26bb3363684c977c880682e62e623b76112156fbc3c80723f5860685a2eff942a39a9221529b85cc9e3085fb7c42
SSDEEP 3072:4CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:jvMsLaOa3lLNngoqRttA7a
TLSH
T1B9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkiga.exe

Path C:\Temp\ifaysqkiga.exe
Size 243KB
SHA256 7ff7df6fd4128b872d894e0b9293b27cd6b0310b0f1390e7f04d1acf0ce7090a
MD5 6d98512e9c3b737b7c6da3e6337651d0
SHA1 82998c3a6934d4e897fc64012bbe5adcdae4f21b
SHA512 8021bb3ab497b2073a9878713d882691979a049568485568b54077d415da5828f210a57068aeb5ea367523122590c9edf9777e7c65871ea7fd745221c4630984
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA72:bvMsLaOa3lLNngoqRttA72
TLSH
T1DF345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztomjec.exe

Path C:\Temp\jebztomjec.exe
Size 243KB
SHA256 fd4ab884015237f32703f84bba68130005c148a322705c1059cc6d22a7b09c03
MD5 63ea9c06bb65d542748499b82333e006
SHA1 c52553f94300707eb743eeb2e6918b884ad013ae
SHA512 7f186a6fb4a574476ace2152f802fdb50df2595b67b2f50a6667fe50edabc6145695ff6bed43dad1c2b795b55af87d869d0693131217a0fa54f1065405bf46a4
SSDEEP 3072:CCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:9vMsLaOa3lLNngoqRttA7o
TLSH
T1FA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwrpjhcz.sys

Path C:\Temp\kecwrpjhcz.sys
Size 141KB
SHA256 e3b0fb24c098fcb30f24d284f642cb4b1f9718576e751e2d752d79b60b0b35ce
MD5 442d673a3cf01cdc26ffc0eb75a78f2b
SHA1 320baaabe6fad0602e0e9d53518be09b2462e886
SHA512 f9568b5d9572e50027ff07fe716b4860ce3b1a8696d048a804f75e0bb1f0690aacfdf6aff9030523a084dc749f20e38e87bd0f230888579dc7bbecf561e4a002
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjezwromg.sys

Path C:\Temp\omjezwromg.sys
Size 141KB
SHA256 51f8371f5a04591200a04b21fe447d0e2c8832091ce5ccfe07f4cd3c54beac5e
MD5 50fa618138ead1556b4b85056506bf14
SHA1 d73d36c4f21e9aec74d37daba2e635080323e4ca
SHA512 a3d5102de37709f87fecb08b06e7a3b6a1c60c47a125cc88ee69dec422678f53c9da5b41c7d7024b768620c3a96375cf49c23a270729fe379548d4d0253d62fa
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicaupkh.exe

Path C:\Temp\spkicaupkh.exe
Size 243KB
SHA256 0971b11772cfca7015dc0c437b6472d7e1c5e674581a7601dbd7aab8ea1b0a59
MD5 b0e11f79a473eb559d73fa1bc9b20682
SHA1 79b1ac70177af8367e928e2c0e26db449f7dd792
SHA512 b842032ee0180ad4969d82bbf3472b153499eca0252413d5dc3d9030c9e5622dae15226a2ee0eba942b5d56e983a83e313035285f0b3037694d4312d72c6ea10
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:QvMsLaOa3lLNngoqRttA7j
TLSH
T126345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpmhfzxrp.exe

Path C:\Temp\urpmhfzxrp.exe
Size 243KB
SHA256 1f0665ae3a90926f587e28af7a7966a1ccd761f770ceaff11409586b5a003f7d
MD5 ff65792915a8b31beeb4bfba2f40593f
SHA1 cfed0f0da1910803196cf69d179321fda6a710d5
SHA512 6188e71a633c0beb651f3b502a90230baf8967ca4b197bf768e7133730a1b50b4f78539c5dc5a582f1681becb6e1df96b033815581bf72ebcd57313a5c5b6bcc
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:4vMsLaOa3lLNngoqRttA7r
TLSH
T111345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqolfdbvtn.sys

Path C:\Temp\vqolfdbvtn.sys
Size 141KB
SHA256 e8f443e7e18857682380d38bf16a4f99e3ad120131f820ec32fcd2518859fec4
MD5 693e9a16167319a8668fae4578fd9283
SHA1 01f6c553cd6ea5cdb1ba29c61405e84e82cf0c39
SHA512 cb13eb9c63f8423fa8e0a530eb78de7b261715b5d186be8d842b3376143c35d91c3cd22f53feb44926eddab9e879808fe7e6ae075b151cd3f3f834eb221809e8
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqljdbvtnl.exe

Path C:\Temp\wqljdbvtnl.exe
Size 243KB
SHA256 cb0b41e1a5367c6ec991138f4a63d72a503f34d07716eda28ea271725f7ba2cd
MD5 1ba656675f8603ffa6deee2e90fec570
SHA1 b6b7434a436739e15d206594df848754ea25ca7b
SHA512 b614787cd3d2f6bf3cebe51a898277f9a73008db167ae39188ea099c4cc7dd17ce64a021a865e628cf7a9ec125982fd3e940dc7de91388962c4fabc38d16e804
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:SvMsLaOa3lLNngoqRttA7Z
TLSH
T16D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaywqo.sys

Path C:\Temp\wqoigaywqo.sys
Size 141KB
SHA256 f6a3d3ac703362aab9ce6261dd85568e0c60624ba62c5ee08c1831c053f978c0
MD5 c9ddfc686b74327eaac2cb878e69b028
SHA1 b2e18d5fe6ac03145946f0278e85f72a53361982
SHA512 6eb308336ff9f407641df54787fe0ae8d933ea8e6c44bd77a2c1763d5259354798f1dcf1bd8523b424468bcee606365bbb2d59e630fcff1320f91e0a83e4e71d
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B9E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqojdbztq.exe

Path C:\Temp\ytqojdbztq.exe
Size 243KB
SHA256 2495c2d53592c4485b1de65515ca2432a200089bfbe05575e0a56c110074a7b4
MD5 f1f532cfb4486dd47a594ad6b7ecff39
SHA1 bce0f689b2918463e73acad22db5bef8b72669ab
SHA512 2ae111f620fb1ed39d159595aab99636d0f8685154d2a3f3634a5b709c4057fc3c468b23d40c3754949848650c11c482863975fedb94e9c7ba541367d79ee2c8
SSDEEP 3072:fCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:qvMsLaOa3lLNngoqRttA7R
TLSH
T13A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4e9c18aca9cf34d05144ecf57eed7b6235878303b041afec54efb5360c4d4926
MD5 b3bddd40fffa559f5f8757ef2fce9420
SHA1 74bcc68700a44c891a322776385fcd49905c25f9
SHA512 f2d9a414269d0f2a82eed115092a1c19f981266d1ab706ae71905a2933855b75106e619852263af8e20412efe8fd31c55de172719119e93284bf33ede0c3ad5b
TLSH
T16D513FCE5325ADE9DB6295B1D0E5541936F6B5AB02839FC058B33EF45E22F4C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595412.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595412.TMP
Size 2KB
SHA256 cd1428b2072f488c26ecac002a5698b441c2fbe8d445e514d16f75af19f01fa7
MD5 58349a7da47bfd99b71b9dbf00c390d2
SHA1 d7effcdc62f616d937bc12c11f50c83f72dc7868
SHA512 b5db8e76f319214e881382893d0e24ac179189a667d1342f96e3dc72bab726dbb9f0219fd68036a7aafcff15fee5863a7ba2be156f5573fc820bb5c8879a6f53
TLSH
T1BB513DCE5325ADE8DB6295B1D0E4511936F6B5AB0283AFC048B33EF05E22F4C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4e185dffef6757cd0f3fca0727eea8d8ebe29e63dad04b6bef6548b3e56aa07c
MD5 09c14c1834e9b67bbdb05b6e62ca11a6
SHA1 47e30dede451a68a297d611009db848f6335e6b0
SHA512 6ce874f4577d048d35d82bf2d02ac168363b0bfa1bf298f579dfb08bcffbddfe354b4827ad053cbe144de79d606abcaf835d4ff0ce8f296fad1e5ff21237924b
TLSH
T19F41DEF3C3E8852E9A0156F0AA146E1BCE2D0924432C7D56C9E4AE2BA3E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf4c335c3c41ae981e5a501aca20562a3f7551ff534da3ae3e197addcd537c3f
MD5 9c482c8b8b570ea51e42b39f86ed89c7
SHA1 2dde91e0833ac14439bc4429cab1c3fe3ef11af0
SHA512 45d7d500f4c508c3234e2f0b3b3f5461dc59ecb66e579a40840fb020cbe54678713f21f5e33e8b611b46837371786855f433b286bcd37dba44a86383504b95cc
SSDEEP 192:sxRBRPCk/fFsUKydlZ+E8zoD8p9d/g6+WNIYC2GuOo+GqIgDnwAx1J:sxRBok/fFsUXL/U//5ITowN
TLSH
T14542D7166A28A97B9CC7E20DBB55BF53D7F9503261902F48ABFC8A1C00EB6DD121740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a823d9f015916f63f2b83e0fe1d11301a481f41a3e20e74456e8470589d3a46d
MD5 00db7072e7d441f8550e58c0169d6ede
SHA1 a732de0b562e2e82225876c9febf3de59115f186
SHA512 e48418106f3c03ff9408a9775e37aa1b9650f6eb25e65303d10c6f7bd9af6cb7eb04316b46f290db0c4ddb4b646c266b648b84a0ed0cd5448c2ce6907d8110a4
SSDEEP 192:sxRuRPCk/fFs2dydlZ+EYzoD8pi/g6+WNIYCnyuOo+GqIgVwAx1J:sxRuok/fFs2gL/oi/5IIow3
TLSH
T1DE32C6166E28A93B8CC7E24DBB15BF53D7F95032A1D42B48ABFC861C04EB6DD521740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 432bba703ed918d129052a7d3c8ddb4d83f43bac68d8fe561393e01229fffc3e
MD5 3bf3985364cac0fcffe10bdad1aea9ba
SHA1 e4be399d2182152c15560870ac8d3963a8621d03
SHA512 9877f355b4baf32b4eca5618f14bf8bf1f9392b8af24730136162c2b2511727c7408fe64e7cc6578347b6b98071c9118623e862a2340af3c9cf79d91b73fba35
SSDEEP 192:sxRBRPCk/fFsUdydlZ+E8zoD8p9d/g6+WNIYCNyuOo+GqIgD9wAx1J:sxRBok/fFsUgL/U//5I6owL
TLSH
T1E442C7166E28A97B8CC7E21DBB55BF53D7F95032A1902F48ABFC861C00EB6DD521740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ba4c435d3c4d094cd614f2004f72bb8fa780d284325d6e52d2b9952861e8ddb6
MD5 2ae94482363853cdd0effa139392854c
SHA1 bd6602b0d55683879f839656ff4a14ce5c1f8b57
SHA512 73bd74c23360812cb19d7825e83bd10ab2c4f6482d8d2418b441619cf551a747c41fd46f53fe98dfb4b1f0c581e20c61f4948ce2296a9fa8b7885f754a3fb570
SSDEEP 768:jC+v+B7pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJf0QqcAroZyYj:jC+v+3EfDQWgQ+f4+u1jaKf0VcLrj
TLSH
T1B5D2DA7B640DCB7F4F804ADDEC197E9E6DA802CB9698CD4047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 905d0648c92c1c9d050869d1dba12a9618cb779141fb75a4afb7a852e8ba280e
MD5 f98efd3ea49a315344102fad912931cb
SHA1 3289dea4f5b34cfea697f6d5cbe81ec429eda9b9
SHA512 d3eca3efd5deadc9b98dbd87e0582a2c7213ae5deeeb36e9ebc145ac9c7a7f54d33e09d3659fccb32fa063a2b9a5dfde9dd4a8d93b0b2214952007e509c6a69e
SSDEEP 768:Am3klbc2p8+p3bd66j+4BRv86aLIWtPi9PmyW:Am3k6g8+p3Z6n4yzPzyW
TLSH
T136F2BFB1E8A9AD634CF5D785B2962B437FF81163E5C00D98E9D89B0E048725E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 c1b0b42aab1b1c089e977258bcbed2ed514aff2b5c37f77e2b3c0acbf5fa608d
MD5 4a7a2bfef155f4ebabf1311473722b76
SHA1 8f76de29054d14323bc9bf97fdbd1a93ae35a1da
SHA512 3e8b10c4d68aaee313512b0cede6747ddab1523477e8f16335ccec619be1badc1cb3da90165bdc8895e685d0b8936ac3791b8cf1792a621b21db8369d61512e3
SSDEEP 768:eF3klAPp8+p3bd66j+4BRv86aLIWtPi9PmyW:eF3k08+p3Z6n4yzPzyW
TLSH
T1D8039E71E8A5EE675CE6D7C5B7923B47AEF8116396C40CC8D9D85F0D00C729E1B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d0d3230e3feefba4e5bac540920ad88ca43d6449b87a74f627f9c5495e1989b4
MD5 b327268c28f5ff7f94a26ca1323ab368
SHA1 3e6829c5b659fa9b355e292bc99ab88c0e97f9a2
SHA512 50bcef4257a1b46a0e96d985aef4f2749577e37264811a142f29b1c36cde8e7e9b1285fcf656ca523c7f22d86085edde8252d2c06c93fbbab0734ad1c5871591
SSDEEP 768:1m3dtbcVp8+p3bd66j+4BRv86aLIWtPi9PmyW:1m3dSj8+p3Z6n4yzPzyW
TLSH
T168F2B071E8A9AD634CF5D785B2963B437FF81163E5C01D98E9D89B0E048725E1B0B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 51c7315a8173abc3eea66123d691bbb8a223e7a0c8c48af8bdef06653eba7f3e
MD5 7bfd02d181e5fe43256baacb49f1d3ae
SHA1 46bd5142ff95383d65b36f30c43fa16a91430b2d
SHA512 53a8da9eff76c42891b1b252827ed03325a29650b7bd355bc03926c2f921eaba6b0b7ab6caaea4d655288962a32fd1993094cb38bc98a5ab8003fb780b367e5f
SSDEEP 768:Irv+4UNbdD3UcuNp8+p3bd66j+4BRv86aLIic2bwCl1:Ibsbp3KL8+p3Z6n4yu0ww
TLSH
T12903CF73F8A899739CE6C644724A7A433FF851A396C10AC4D5DD2B4E415B19E230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ee371d7fa3511da03fd9fef6d83affb19531ac9fd28b2a08d57238ff0cdadd31
MD5 011964660bb317eed9a9dca2efbc1ac9
SHA1 43a5a5a471b682a198eda688181885c3396c28fa
SHA512 31009a1a7b0909efde000623f07cbaac9474238af74f9b418a173f8df5fa1b1bfc0fc055758156868aa1494f982db9dafa9bb94cceb3251b9aaeb2beb044ee68
SSDEEP 768:Irv+4UNbdD3/1cNp8+p3bd66j+4BRv86aLITt2bwCl1:Ibsbp36L8+p3Z6n4yE0ww
TLSH
T1CD03CE72F468AD339CE6C64471867B837FF821A399C10EC4D9D96B4E005A29F270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b16db8d8-1abb-47c8-8681-95a20c77c916.tmp

Path C:\Users\Admin\AppData\Local\Temp\b16db8d8-1abb-47c8-8681-95a20c77c916.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4692_1626883533\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1112-532-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1300-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-688-0x0000000000010000-0x000000000004D000-memory.dmp

Download

memory/3204-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3524-585-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-539-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4636-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5068-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-681-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5228-686-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5572-712-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5820-582-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5820-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download