79ae6476a1cc84e558a46906ad2402de31ac48b7c30e4287d42beda27f806a0a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe
Size 243KB
Sample260826-e5rv2ayxd1
SHA256 79ae6476a1cc84e558a46906ad2402de31ac48b7c30e4287d42beda27f806a0a
MD5 e748bb97dfdb832641e6b6d8aad1df8a
SHA1 beab9856e01ca32b35a6f032821ae14a5bddaaa3
SHA512 008efcfbe1b40e36dc2550e2ca01bf5ca9e8417f86aee38d6b08af8518dea390b15a2f83d4260ab1be16ea708a8d1233fb12c933ab3a5b57dd4d4e1798cc1f5a
SSDEEP 3072:lF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7t:H3frLQsa3lLNngoqRttA7t
TLSH
T115345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3284	CP.exe
4376	xrpkhcavsm.exe
2720	CP.exe
996	CP.exe
1544	i_xrpkhcavsm.exe
5088	czurmkecwu.sys
3272	CP.exe
5488	urpjhczxup.exe
5380	CP.exe
1668	CP.exe
4876	i_urpjhczxup.exe
4060	pmhebwuomg.sys
3500	CP.exe
4372	mjecwuomhe.exe
1884	CP.exe
4956	CP.exe
6044	i_mjecwuomhe.exe
4120	trmjecwuom.sys
4600	CP.exe
1448	jdbztqojgb.exe
4364	CP.exe
4300	CP.exe
5776	i_jdbztqojgb.exe
6124	wtomgdbywq.sys
4592	CP.exe
6116	tolgdbvtol.exe
4332	CP.exe
2312	CP.exe
3336	i_tolgdbvtol.exe
3428	qlidbvtnlf.sys
2920	CP.exe
5288	nlgdywqlig.exe
4148	CP.exe
2092	CP.exe
6012	i_nlgdywqlig.exe
3868	nlidavsnlf.sys
4748	CP.exe
3676	lfdavsqnlf.exe
3444	CP.exe
4400	CP.exe
3524	i_lfdavsqnlf.exe
6088	aysqkicavs.sys
2548	CP.exe
936	spkicavsnk.exe
3132	CP.exe
1356	CP.exe
5672	i_spkicavsnk.exe
4684	hfzxspnhca.sys
2364	CP.exe
4388	hfzxvsnkfz.exe
2436	CP.exe
4488	CP.exe
824	i_hfzxvsnkfz.exe
852	zxrpmheczu.sys
5064	CP.exe
3248	wupmhfzxrp.exe
2612	CP.exe
2536	CP.exe
1656	i_wupmhfzxrp.exe
4112	erpjhbzurm.sys
4792	CP.exe
2084	urmkecwuom.exe
5776	CP.exe
1188	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1708462864\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1488184717\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1531547020\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1696_1488029086\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1671862881\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1488184717\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1531547020\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1488184717\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_1488184717\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1696_173281097\_locales\cs\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxvsnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqlifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcavsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavsqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqlifdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavsqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwugebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfaxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwugebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcavsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhczxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxvsnkfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywqojg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1308	ipconfig.exe
2556	ipconfig.exe
2680	ipconfig.exe
3852	ipconfig.exe
5052	ipconfig.exe
980	ipconfig.exe
896	ipconfig.exe
6140	ipconfig.exe
2288	ipconfig.exe
5308	ipconfig.exe
5484	ipconfig.exe
896	ipconfig.exe
1496	ipconfig.exe
1272	ipconfig.exe
4924	ipconfig.exe
3916	ipconfig.exe
1584	ipconfig.exe
1664	ipconfig.exe
2152	ipconfig.exe
2400	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321923122810066"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{B8734755-8EA0-4456-ADF5-F78CD05FA777}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	i_xrpkhcavsm.exe
Token: SeDebugPrivilege	4876	i_urpjhczxup.exe
Token: SeDebugPrivilege	6044	i_mjecwuomhe.exe
Token: SeDebugPrivilege	5776	i_jdbztqojgb.exe
Token: SeDebugPrivilege	3336	i_tolgdbvtol.exe
Token: SeDebugPrivilege	6012	i_nlgdywqlig.exe
Token: SeDebugPrivilege	3524	i_lfdavsqnlf.exe
Token: SeDebugPrivilege	5672	i_spkicavsnk.exe
Token: SeDebugPrivilege	824	i_hfzxvsnkfz.exe
Token: SeDebugPrivilege	1656	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	4936	i_urmkecwuom.exe
Token: SeDebugPrivilege	3924	i_hezwugebwr.exe
Token: SeDebugPrivilege	5256	i_ljgeywqojg.exe
Token: SeDebugPrivilege	1748	i_ywqojdbytq.exe
Token: SeDebugPrivilege	4632	i_bvtqlifdav.exe
Token: SeDebugPrivilege	5992	i_sqkigdxvqn.exe
Token: SeDebugPrivilege	2844	i_xvpnhfausn.exe
Token: SeDebugPrivilege	1308	i_xupnhfaxrp.exe
Token: SeDebugPrivilege	3348	i_rpmhezxrpj.exe
Token: SeDebugPrivilege	4196	i_bzurmjhezw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 1988	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	89
PID 1988 wrote to memory of 1696	1988	iexplore.exe	90
PID 1696 wrote to memory of 3244	1696	msedge.exe	91
PID 1696 wrote to memory of 4168	1696	msedge.exe	92
PID 1696 wrote to memory of 4436	1696	msedge.exe	93
PID 1696 wrote to memory of 4168	1696	msedge.exe	92
PID 1696 wrote to memory of 4168	1696	msedge.exe	92
PID 1696 wrote to memory of 4548	1696	msedge.exe	94
PID 1696 wrote to memory of 4548	1696	msedge.exe	94
PID 1696 wrote to memory of 4624	1696	msedge.exe	96
PID 1696 wrote to memory of 4624	1696	msedge.exe	96
PID 1696 wrote to memory of 4624	1696	msedge.exe	96
PID 1696 wrote to memory of 3424	1696	msedge.exe	97
PID 1696 wrote to memory of 3424	1696	msedge.exe	97
PID 1696 wrote to memory of 3424	1696	msedge.exe	97
PID 1696 wrote to memory of 1772	1696	msedge.exe	98
PID 1696 wrote to memory of 1772	1696	msedge.exe	98
PID 1696 wrote to memory of 1772	1696	msedge.exe	98
PID 1696 wrote to memory of 2756	1696	msedge.exe	99
PID 1696 wrote to memory of 2756	1696	msedge.exe	99
PID 1696 wrote to memory of 2756	1696	msedge.exe	99
PID 1696 wrote to memory of 4964	1696	msedge.exe	101
PID 1696 wrote to memory of 4964	1696	msedge.exe	101
PID 3644 wrote to memory of 3284	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	102
PID 1696 wrote to memory of 4380	1696	msedge.exe	103
PID 1696 wrote to memory of 5044	1696	msedge.exe	104
PID 1696 wrote to memory of 4380	1696	msedge.exe	103
PID 1696 wrote to memory of 5044	1696	msedge.exe	104
PID 1696 wrote to memory of 1384	1696	msedge.exe	107
PID 4376 wrote to memory of 2720	4376	xrpkhcavsm.exe	109
PID 1696 wrote to memory of 1172	1696	msedge.exe	112
PID 1696 wrote to memory of 1172	1696	msedge.exe	112
PID 1696 wrote to memory of 1268	1696	msedge.exe	113
PID 1696 wrote to memory of 1268	1696	msedge.exe	113
PID 1696 wrote to memory of 2740	1696	msedge.exe	116
PID 1696 wrote to memory of 2740	1696	msedge.exe	116
PID 1696 wrote to memory of 4892	1696	msedge.exe	117
PID 1696 wrote to memory of 4892	1696	msedge.exe	117
PID 3644 wrote to memory of 996	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	118
PID 3644 wrote to memory of 3272	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	122
PID 5488 wrote to memory of 5380	5488	urpjhczxup.exe	124
PID 3644 wrote to memory of 1668	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	127
PID 3644 wrote to memory of 3500	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	131
PID 4372 wrote to memory of 1884	4372	mjecwuomhe.exe	133
PID 3644 wrote to memory of 4956	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	136
PID 3644 wrote to memory of 4600	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	140
PID 1448 wrote to memory of 4364	1448	jdbztqojgb.exe	142
PID 3644 wrote to memory of 4300	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	145
PID 1696 wrote to memory of 3916	1696	msedge.exe	148
PID 1696 wrote to memory of 5088	1696	msedge.exe	149
PID 1696 wrote to memory of 2240	1696	msedge.exe	150
PID 3644 wrote to memory of 4592	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	153
PID 6116 wrote to memory of 4332	6116	tolgdbvtol.exe	155
PID 3644 wrote to memory of 2312	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	158
PID 3644 wrote to memory of 2920	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	162
PID 5288 wrote to memory of 4148	5288	nlgdywqlig.exe	164
PID 3644 wrote to memory of 2092	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	167
PID 3644 wrote to memory of 4748	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	171
PID 3676 wrote to memory of 3444	3676	lfdavsqnlf.exe	173
PID 3644 wrote to memory of 4400	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	176
PID 3644 wrote to memory of 2548	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	180
PID 936 wrote to memory of 3132	936	spkicavsnk.exe	182
PID 3644 wrote to memory of 1356	3644	2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe	185
PID 1696 wrote to memory of 5688	1696	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e748bb97dfdb832641e6b6d8aad1df8a_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ffdf071c188,0x7ffdf071c194,0x7ffdf071c1a0
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,5058664899127992010,11540659819869499818,262144 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,14195914338971116607,16835340294427689688,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
      4⤵
      System Time Discovery
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,15499786121191277992,308999607713548892,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,7268547034845737321,4803458170409806058,2097152 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,10650200797489263872,203772678180370798,2097152 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,9545192636061119305,1657203392205553585,2097152 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:9
      4⤵
      PID:1772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,5936160047493594244,5335268477907380257,2097152 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,1211141460774265685,17433928321633912481,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,3591054007649704669,9107234848911788822,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,9850843951667106589,13808108281290317418,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,18122765292420690486,9305303680631899136,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,18122765292420690486,9305303680631899136,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,11118113069869729225,4536242523636415914,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,8536956587376405519,6193501051555902972,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,5529960070006502555,3576148247831821149,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,12142066929461516549,1314990183448550728,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,13810345540522136095,1375548546944475820,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,11484735765613057689,12041974888880239501,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4086794138289517750,4652323452779428534,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,18127090042852027105,13608974060404522987,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,5888260670252535409,14524750448244281717,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:14
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,1955899669634652278,15040675666045208122,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,8365413428709928834,2390737387159518735,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,8537694194454398567,17240682030122064218,262144 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15488352670117658574,17793410396490453896,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,15428060974667533925,3704274657727026754,524288 --field-trial-handle=2368,i,3219740888084029995,17179119170610257277,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcavsm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3284
- - C:\Temp\xrpkhcavsm.exe
    C:\Temp\xrpkhcavsm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcavsm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:996
- - C:\Temp\i_xrpkhcavsm.exe
    C:\Temp\i_xrpkhcavsm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhczxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3272
- - C:\Temp\urpjhczxup.exe
    C:\Temp\urpjhczxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhczxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Temp\i_urpjhczxup.exe
    C:\Temp\i_urpjhczxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\i_mjecwuomhe.exe
    C:\Temp\i_mjecwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbztqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\jdbztqojgb.exe
    C:\Temp\jdbztqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbztqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Temp\i_jdbztqojgb.exe
    C:\Temp\i_jdbztqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\tolgdbvtol.exe
    C:\Temp\tolgdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2312
- - C:\Temp\i_tolgdbvtol.exe
    C:\Temp\i_tolgdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqlig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2920
- - C:\Temp\nlgdywqlig.exe
    C:\Temp\nlgdywqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqlig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Temp\i_nlgdywqlig.exe
    C:\Temp\i_nlgdywqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdavsqnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\lfdavsqnlf.exe
    C:\Temp\lfdavsqnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdavsqnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Temp\i_lfdavsqnlf.exe
    C:\Temp\i_lfdavsqnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2548
- - C:\Temp\spkicavsnk.exe
    C:\Temp\spkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1356
- - C:\Temp\i_spkicavsnk.exe
    C:\Temp\i_spkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxvsnkfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2364
- - C:\Temp\hfzxvsnkfz.exe
    C:\Temp\hfzxvsnkfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxvsnkfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\i_hfzxvsnkfz.exe
    C:\Temp\i_hfzxvsnkfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5064
- - C:\Temp\wupmhfzxrp.exe
    C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\i_wupmhfzxrp.exe
    C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4792
- - C:\Temp\urmkecwuom.exe
    C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\i_urmkecwuom.exe
    C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwugebwr.exe ups_run
  2⤵
  PID:1388
- - C:\Temp\hezwugebwr.exe
    C:\Temp\hezwugebwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwugebwr.exe ups_ins
  2⤵
  PID:624
- - C:\Temp\i_hezwugebwr.exe
    C:\Temp\i_hezwugebwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgeywqojg.exe ups_run
  2⤵
  PID:4896
- - C:\Temp\ljgeywqojg.exe
    C:\Temp\ljgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgeywqojg.exe ups_ins
  2⤵
  PID:1244
- - C:\Temp\i_ljgeywqojg.exe
    C:\Temp\i_ljgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojdbytq.exe ups_run
  2⤵
  PID:3520
- - C:\Temp\ywqojdbytq.exe
    C:\Temp\ywqojdbytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojdbytq.exe ups_ins
  2⤵
  PID:5748
- - C:\Temp\i_ywqojdbytq.exe
    C:\Temp\i_ywqojdbytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtqlifdav.exe ups_run
  2⤵
  PID:6012
- - C:\Temp\bvtqlifdav.exe
    C:\Temp\bvtqlifdav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtqlifdav.exe ups_ins
  2⤵
  PID:5616
- - C:\Temp\i_bvtqlifdav.exe
    C:\Temp\i_bvtqlifdav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkigdxvqn.exe ups_run
  2⤵
  PID:5088
- - C:\Temp\sqkigdxvqn.exe
    C:\Temp\sqkigdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkigdxvqn.exe ups_ins
  2⤵
  PID:1496
- - C:\Temp\i_sqkigdxvqn.exe
    C:\Temp\i_sqkigdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfausn.exe ups_run
  2⤵
  PID:1744
- - C:\Temp\xvpnhfausn.exe
    C:\Temp\xvpnhfausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfausn.exe ups_ins
  2⤵
  PID:5292
- - C:\Temp\i_xvpnhfausn.exe
    C:\Temp\i_xvpnhfausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfaxrp.exe ups_run
  2⤵
  PID:976
- - C:\Temp\xupnhfaxrp.exe
    C:\Temp\xupnhfaxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfaxrp.exe ups_ins
  2⤵
  PID:3492
- - C:\Temp\i_xupnhfaxrp.exe
    C:\Temp\i_xupnhfaxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhezxrpj.exe ups_run
  2⤵
  PID:4108
- - C:\Temp\rpmhezxrpj.exe
    C:\Temp\rpmhezxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhezxrpj.exe ups_ins
  2⤵
  PID:5672
- - C:\Temp\i_rpmhezxrpj.exe
    C:\Temp\i_rpmhezxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmjhezw.exe ups_run
  2⤵
  PID:5996
- - C:\Temp\bzurmjhezw.exe
    C:\Temp\bzurmjhezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmjhezw.exe ups_ins
  2⤵
  PID:3512
- - C:\Temp\i_bzurmjhezw.exe
    C:\Temp\i_bzurmjhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:980

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:5088

C:\Temp\pmhebwuomg.sys
C:\Temp\pmhebwuomg.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\wtomgdbywq.sys
C:\Temp\wtomgdbywq.sys
1⤵
- Executes dropped EXE
PID:6124

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\nlidavsnlf.sys
C:\Temp\nlidavsnlf.sys
1⤵
- Executes dropped EXE
PID:3868

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\hfzxspnhca.sys
C:\Temp\hfzxspnhca.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\zxrpmheczu.sys
C:\Temp\zxrpmheczu.sys
1⤵
- Executes dropped EXE
PID:852

C:\Temp\erpjhbzurm.sys
C:\Temp\erpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\hbzxrpjhbz.sys
C:\Temp\hbzxrpjhbz.sys
1⤵
PID:2328

C:\Temp\mgdbztrojg.sys
C:\Temp\mgdbztrojg.sys
1⤵
PID:5484

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:3348

C:\Temp\ljdbvtnljd.sys
C:\Temp\ljdbvtnljd.sys
1⤵
PID:2324

C:\Temp\sqkigdbvsn.sys
C:\Temp\sqkigdbvsn.sys
1⤵
PID:4112

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
PID:1692

C:\Temp\axspkhcaxs.sys
C:\Temp\axspkhcaxs.sys
1⤵
PID:3568

C:\Temp\ezxupnhfzx.sys
C:\Temp\ezxupnhfzx.sys
1⤵
PID:4560

C:\Temp\czxrpjhczu.sys
C:\Temp\czxrpjhczu.sys
1⤵
PID:1840

C:\Temp\ebwtrojgeb.sys
C:\Temp\ebwtrojgeb.sys
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 141KB
SHA256 51a977b5eed4031707969832c14b99b0afa04ec830fe4556622aaf8e0993b190
MD5 212bbe61cc89114102c2bd1c1b43de3e
SHA1 cd19f753923cdeffb32d0d9525ad7d92b5c16ec9
SHA512 e6d54190e63e4c2f026854325cf7fee29023b6ce57ba5e39c8ebcfc8b57856ee8f0bca2123e9d11ea87598712914ddffef2ef0d3a17c01ec909b38e1e5f898e3
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbztqojgb.exe

Path C:\Temp\i_jdbztqojgb.exe
Size 243KB
SHA256 8beaafaf3ea375a57502df25e60a6d8d24cdf7461c041b69ca5ee63957fb2bb1
MD5 b600497f54f731c5026bf7e7f0f74b1f
SHA1 4ebc4a189a866cd48e5801af007e33caa20fa120
SHA512 4ed0aa2ef25dfc03b9df2acc491e0122bbba5d58289da54ac965a468de0169085cd30c2bcc5198be177f5a12c818e1710571c4e4c3f4a4a00b3e64da65827df4
SSDEEP 3072:zF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:x3frLQsa3lLNngoqRttA7P
TLSH
T176345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjecwuomhe.exe

Path C:\Temp\i_mjecwuomhe.exe
Size 243KB
SHA256 853efd1a37538cd1f34482f90b4de876d8ab2833813c309fda622c1f64d75719
MD5 82098fc130b54f861da2b14b9bc87e1f
SHA1 f3a39abbfbc73d346e8c33ecb264eb6dc52d972c
SHA512 a6fa349c295affbd0a738ab24e8134484fec9b0858a773f99c37cda8907f280d8fe9c8db829c8eb946c547608ce7ccad8c5e16ee648d30618df94a4f188a3682
SSDEEP 3072:uF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:u3frLQsa3lLNngoqRttA7e
TLSH
T1E2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgdbvtol.exe

Path C:\Temp\i_tolgdbvtol.exe
Size 243KB
SHA256 8c6b7def82fc7285a0c6d2db7fe67549c1cf22bf2031439d4065eb1cc5ea2799
MD5 bf5b695a5ab516f679bf6da0610179e9
SHA1 36e958946a757f75411fe72f9b01450ef29cbb8b
SHA512 e4b51c71ff37cea49ef448bd07715a7d70c2f3cfaee391009caa784b493d130a0fe860dbe16672ed129fd1fb0dc164ea5cdd5e5f83230c97e6d0366e1046cdc3
SSDEEP 3072:8F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:o3frLQsa3lLNngoqRttA7g
TLSH
T145345A0172818032E7150B78045AE7A1867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhczxup.exe

Path C:\Temp\i_urpjhczxup.exe
Size 243KB
SHA256 c6fbb5e96989bbb6d45bd45a752df64ee0920adf9ee6793e43ad4858a69e86ce
MD5 6cb6147285636cbe64d403ccee60c7d1
SHA1 447601c778bace87f9c4f1aa824f1af27ccc3626
SHA512 4f99317d3a233053dc21b16813fa99cc101736cfbb298d60948aba02e945bc0c7f5a45aad9b2d8723337afbcf3f5227c2e98ef3b20c772dfcc3d96b9caf8500b
SSDEEP 3072:VF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:X3frLQsa3lLNngoqRttA7N
TLSH
T1C4345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpkhcavsm.exe

Path C:\Temp\i_xrpkhcavsm.exe
Size 243KB
SHA256 a6d404a61bd32d3c44607226491161f481e51bc54ae67f13424cf3779d403146
MD5 d6ba4b280d66f0276568439f2387cd94
SHA1 82dc9192a5648d892466b9f64b0bbcae9b809984
SHA512 11c67942ad05150d5d2851230699914a2504f57e7d86a15c6bdb0b68b78b4eaeefafa5410f250b05b8fdfc95e4be525ef8105931a16987a93a6b205666d8b53f
SSDEEP 3072:9F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:/3frLQsa3lLNngoqRttA7V
TLSH
T1D2345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbztqojgb.exe

Path C:\Temp\jdbztqojgb.exe
Size 243KB
SHA256 7a212a45774c192c79a27de7835758da672278124d1ba68ffde1a21415c56d1b
MD5 6ffb26d9a9bc98d362e1a17d524c1c4a
SHA1 d39ea417e77e693ed078884bc2d8a86ea7934fe1
SHA512 9c0ce7c115a2fa4d019e613f41695fd45bdf4074fc242f665d15b2bd01357c12c1d6bb6bc126c707ad9e4cfde3bf2c8af31e3bae0a8d490da92ea3d2644f26ca
SSDEEP 3072:+F3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:e3frLQsa3lLNngoqRttA7C
TLSH
T1BD345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomhe.exe

Path C:\Temp\mjecwuomhe.exe
Size 243KB
SHA256 3ce620d60924499d4afe790f64bb554ef4435c1ec25264ca7d936a34fed06955
MD5 b6c4e1f14a977e6630b4e84d60f3b2ea
SHA1 de9a2445772e866252eaaa60a31c92e1b6acf9aa
SHA512 85ffd1aa8190c9e5184eb5b6394e9156d85532c4322f46dfc56c55d609a9e02a674a5fef31640df664b59e06f80dc2b6b78a1e3c3a895806bcd4780a5e491884
SSDEEP 3072:QF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:M3frLQsa3lLNngoqRttA7o
TLSH
T1CB345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqlig.exe

Path C:\Temp\nlgdywqlig.exe
Size 243KB
SHA256 023d5dd4ba29662b2500f7eeeab9f2c26c120133d8adba2c32cebabcf8151165
MD5 c1036b455fa36e5b1dd0db842d6d08c7
SHA1 aa120d590a9ca3072a2d647541ef09732113df56
SHA512 234f54577392c08cb11673024091d17baac8bc17f0f56691a39a8f33b8c68ce67dd94c7918e7fc177c447ad76653718c48f3e490a06cb48f43554a474e8bf75c
SSDEEP 3072:VF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:X3frLQsa3lLNngoqRttA71
TLSH
T11B345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhebwuomg.sys

Path C:\Temp\pmhebwuomg.sys
Size 141KB
SHA256 8baa27a1219d8ab0143eb9a737848d9b78d418c92666be04ecf1b6e682acbb2e
MD5 9fff9d1a65bb2524cdb56a2038f0a545
SHA1 9c995231d3a5b320503124492f76ba33eff1ac07
SHA512 b4580cf268ea1516f8246f36d9da74bcc1705e1e16ece4d729a4049d6c5ef2d2c73d3652c7bd2e9eb7410b0e35fe86276dcdb05e7cab6645eb2c9fa6fbb7cc6d
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T113E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlf.sys

Path C:\Temp\qlidbvtnlf.sys
Size 141KB
SHA256 b8b84aa55cc87f3c3e71502096cbbc8854f300f31e07d801a6083c7e4e3ccdfc
MD5 2b72ada21f79d54d9c227e79d639731c
SHA1 63280c35fecdb13657af5d8350056e83c90551ed
SHA512 13f6e9694c3672e050c75e7dcc2244c02f5f723caf17ddbc831410c76ea4978d54f97935370cb9323d9530927048a95bbf41032a010cbddf013a7dc357c44495
SSDEEP 1536:qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdbvtol.exe

Path C:\Temp\tolgdbvtol.exe
Size 243KB
SHA256 0e6c9a7746d727debbc9f6209c9eeb34739eebd41112b21097a83d68ffb6bf2f
MD5 f71d4f5d2d64dbc01e8eab324927beb4
SHA1 f6d05d713d03a5ea7db0ff315b7c6ce70b0dfc08
SHA512 2926089bdba081f73ea46defead5cdfa8c3841b1470f6e4bebdc7eadac562283351fc018b50905d47fc6c32a05a89fefe71b83ce87523e0d2f0bb11634029470
SSDEEP 3072:xF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:T3frLQsa3lLNngoqRttA7d
TLSH
T1ED345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.sys

Path C:\Temp\trmjecwuom.sys
Size 141KB
SHA256 5d65c3c191b36543e3eba465331fd6d24c754a2d16104f9b6935244d07ffd1d3
MD5 db81096c8598f6e600ab912cb645bfb1
SHA1 ebd53e718c1e35f52af199a6964a0cc745c668a8
SHA512 e99084b335051f73f3787cab0b5c885069e88422894d83684656328daa111c0fe7b761b2e112d8e9232539958e09cdcc55355306860a93c0a79cd71c9202693f
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T151E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhczxup.exe

Path C:\Temp\urpjhczxup.exe
Size 243KB
SHA256 cd33a86c29b9cb1601a954c95a94ab179af2a910e7a3fabe3f5661b5d9447bb7
MD5 51c429f43e26f32855a3eea7076eef41
SHA1 9244f5f114c11d4a8bd8163cc1d19d7ba27f1c00
SHA512 3ef43d69e41b0f1481c1280e2c9732483d0240f14bb5a331f417847beae442c00bbbe0a218d27cdb00f354455d4d149a59f23c67e54b68c8d7fe696c1c6e33f7
SSDEEP 3072:IF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:k3frLQsa3lLNngoqRttA7k
TLSH
T106345A0172818032E7150B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgdbywq.sys

Path C:\Temp\wtomgdbywq.sys
Size 141KB
SHA256 0dac9bb976e973fbf01d758ed8d5331a6a73a7c1401096f0c094c25b3a190f91
MD5 d7220f134b38fde836a2b9af89add71b
SHA1 7033b02a17fc96b27ca9c26a41e07bd0127a04ac
SHA512 1945e2db2b743bef7f6b65a7bfc8dcb15f4f892bba056f973cbeb71823d6791fe3f0bd911a6b5f2b7b1e4a449e551320f02455c48196e2f3f257fd265401369f
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcavsm.exe

Path C:\Temp\xrpkhcavsm.exe
Size 243KB
SHA256 03cae1e4dc7570b98fb99de4e8620d4771eb6e198ad881596a006708a3d694c5
MD5 3cea8da2d8c755b4982bbadd07837b2f
SHA1 2be9f693a7f1729ea7680d350a9fca4af0a28135
SHA512 ec8d2fcd614adfc98730c8618521d82cc4e0a83ffa40cc9cc4947e44f6f13729aa96df3ee6556f11e0b288221b28f85bf683e287fe33a1177e1d14ceb3a083d5
SSDEEP 3072:NF3frLFqJhj7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7V:v3frLQsa3lLNngoqRttA7V
TLSH
T15C345A0172818032E7550B78045AE7A0867E7D384BA6E6CFF7683F795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 14ba2e290b7dd813b184256c2bf10f17a4f3739cec7c852680cc7430505b1adb
MD5 c7ac6c5f33b9d467679261fc1fe69dbe
SHA1 27c195dc1c497204117824e982b0d009042e0055
SHA512 9085e947dce133751c43e1fc250b6488b5e76a49e92868300dee32987fb1c034484fff227963b785d9e5f82729fc5ad04df6547edcdeff12acb387b1b34601c7
TLSH
T188619671536219D1F329A9BF20D2D04B32F5B645553F6E241688AF742F06F3590DC47B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594bc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594bc5.TMP
Size 3KB
SHA256 938f1ee8c4b51f3c1f940ee0c881c33b546d278e69053e6f984ba1d8571ebd08
MD5 9a9f69d8ec7e2961a063714375d62f42
SHA1 9f04297e373f608327974b10d910b4ca1b6e7f12
SHA512 181a25a90bf5d42b119f6025b080a4dc47e0a745191b85ea9cb3d7dc693e83c02e1ec26d2095f134c196b9c01f8591bea3e48fa427d31590a0eed1f47952cc56
TLSH
T137619671532219D0F329A9BF24E2D04B32F5B646553F6E2416889F756F06F3590DC07B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a7c4e349-5769-4705-84a4-ed5473877a74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7c4e349-5769-4705-84a4-ed5473877a74.tmp
Size 2KB
SHA256 a0a4b9e15772db733dc1f3cfd82b3c15e406dfb4899499afa8fdf1d9011f95b1
MD5 fd28f78ddf824cc02a973c81974dd59a
SHA1 2891a2b9715ddea72f004f76438233c7122110ab
SHA512 886031db3f8cab756caefce17ee3b732b747a6f12f4a5ba1be2a79d6cf9fd17845db321d1e265abe62021bf7dc344fa8163d34a97ddc533328bbefb3b20be602
TLSH
T16741DEF3C3E4952E890156F0AA146E1BDF2C0921432C3C5AC9E0AF2BA3F3871E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9cda8b3bf30071c949c029c9ab56e2d25088db7567f719ad8eca7e09970f8602
MD5 7a19d77ff1dee1bb6f6302e4821df1d5
SHA1 3eb44d49281965b601ee76e3f3642d305edff172
SHA512 dee9463a419b8b26bae14050de2728a9b4ad10f01967fb22f3e2a9863175390f2c8d06fc1b94dac2daf5e854524da4afed7867417c691364c62a647a1b1d29f4
SSDEEP 192:sxRrR+CO/fGsaJFGZ84EAzoA8p9M/g6+WNChR/YEz+3MG2KUIgDyGujJ:sxRr/O/fGsyFw84Gq/5q/mWI
TLSH
T1E642D8166D28A93B9CCBD21DFB55BF63D6F95072A0D11E48A6FC8A0C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 04a550558abc300b88fa1e050d471cce064b67d126d77154b0005e704891a74e
MD5 bdbc2f0eafe2d3dc8a2df72ae9e3facb
SHA1 bb616eb9aab0c672dc3a627922000a476c58249e
SHA512 e28c2bd60cb159fc790f23da619e539ff732092bcf161e93245d68d9da0e400b818ccc57be97b64cb698c570b0a280f506702f57ba4aeae7678d6aa1b52a50fd
SSDEEP 192:sxRoR+CO/fGs4JfGZ84EAzoA8p9M/g6+WNChR/YEXg3MG2KUIgVGujJ:sxRo/O/fGs0fw84Gq/5q/AWT
TLSH
T13A42C8166E28A93B4CCBD21DFB55BF63D6F95072A0D02E48A6FC8A1C04E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 48f744f5b459c262d28190483df519a06b62299fec339b33c034a8ffe1b88691
MD5 b1daff3850c0d475a6677e2d3e4ca551
SHA1 4bc8961591c99ce1a160378bd80e9abaeb50dee3
SHA512 26d5b24a0635c40981a702158c1d90a1adf60194ed26f3662bf8ace7eb5513dca096dcbd68bb5d30058bdd5381b76527f3b0e50dad39ebed65a98021fb267ce6
SSDEEP 192:sxRrR+CO/fGsaJfGZ84EAzoA8p9M/g6+WNChR/YEXg3MG2KUIgDgGujJ:sxRr/O/fGsyfw84Gq/5q/AW2
TLSH
T16942D8166E68A93B4CCBD21DFB55BF63D6F95072A0D02E48A6FC8A1C04E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2ab5fe7843a8062370c5a3ff2d1a5e1a7675a0ab9bf3a5d0f472937c4075061a
MD5 403881fe9d0bbc9a6886c9575d9f45e4
SHA1 fd62840016d5b66302b41219b7af449e50996977
SHA512 cd55bb32c0853419e6d07fb5647cc553ad315632318e0f863dadba45e66ed30d37a81895265d47434906cb966ae4e51683a4489748b6d37d03bb1e1bce97cb00
SSDEEP 768:40Dk6DJQD8EW7pLuLzn0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4/:40Dk6DJQD8E2Ezn0DbWgQ6DjfIQDFu12
TLSH
T164D2DA7B640CCA7F4F804ADDAD197A9E6DA802CB96D8C98047FE981C02C77EE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e759.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e759.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8165a368e81d4eccd2ba335b7c2733ca888c12b8155d90613d2cdfca41a394d3
MD5 03a9970e0602711c3b7b180e2d00ff3e
SHA1 0680c7bf9ef513fce18976e08a31059a93a2f684
SHA512 0e209c595b4055f4e2f92e9281b33ab46c656e99b77ff418c3785d9cc335a5f58ee3d5c7939fc3508450fb61e7d7b62f3c7030b272341e4e7bfc83044399d090
SSDEEP 768:Erv+4UNbdG3eWzDTd+Z9eX6+qTko0u229a4vsSFeVH1SdW:EbsbU3UMvVTVKa4nEH1h
TLSH
T12503CF32E8699D334CE69684B24B31577FB820B386880B54D8EDAF0D064769D270FE37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 25e48e2bb7aa9c44306f948f54322250bee55ec2bcfc66582dbaf80b8846ea78
MD5 47d1fd2bf4d53aad884ae58e0d66dbd9
SHA1 d8dd7253d27c0c17fc3532809cd96c6388e704b6
SHA512 7fff28cc80d0facf64042612835e019214635c6b4690e4c6c84b30ad61231049a2048e258248304bee12c69aa542914e1fec61f978cf8b987ad7b564c209c8f2
SSDEEP 768:kq3Jw9LZZDTd+ZPeX6+qTko0u229a4vsTFMMRr8:kq3J1OvVTVKa4oB8
TLSH
T137E2BE71EC659D7388EAE38477173653AEB420B3D5D80A0496EDAA0D01037AD2B0FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e52c8f195a822d3711d162bf800042206aa707ef79b190bc74717736efc19613
MD5 d1b0b6638c318fb5f7d21ec973f735cf
SHA1 254eec042dc3431e67a45e870c9c233b805c1aae
SHA512 29660791be5caf6c81cbbaccae65352021f8ab07a93499c65ede93705ec7e280aabd22b09e5696e41f3504304f2ffaffaf30d99b76ce947181833a8468a19c51
SSDEEP 768:prv+4UNbdG3bgoDTd+ZjeX6+qTko0u229a4vsDmeVH1SdW:pbsbU3civVTVKa43EH1h
TLSH
T14003CF33E8658A778CE79784724B75173EB96163C6D80B80D8ED6F0D069B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5fcd16e5be699d6e8ba568d3ed1860b8c132f80a9b2d88f43efe87d734cdd7d6
MD5 634bcd0b8a01d58e52acd8911aedf698
SHA1 beaba45ae5eab1ecc28e0aae878b88c5a687ef52
SHA512 55838f7365c354a66b8894f3bcd6cccb19caf5a41c6762f07686df974a4ecbd57b0a1b46c95c717f6b69f70ddf0dcfd05c78c02e4d9106ae9a34ef81591fccc4
SSDEEP 768:Trv+4UNbdd34w95ZDTd+ZgeX6+qTko0u229a4vsTFMMRL:TbsbH34dPvVTVKa4ol
TLSH
T1B903CF32F8289D338CF69684B20735537FB820B395C40B54DAEDAA4D05476AD2B0FE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9702b1e088848ad6c9528076285019ad9b18377f6ae01d00bdc690d80951d3a6
MD5 49ccf9eb8384d2e433d4b0a24b92ac3b
SHA1 7cd909c2e4421cd2fa47653073b5367dd26fd965
SHA512 2b87ad12a80698e7edfb532092e81194dc33b768927cb626c0982d51daae1f139b72ad22538a5b8d06b2a0e51ec0f061259cf01326dddc50624ef90b8ffb0151
SSDEEP 768:QFQJ3owgew9L7znZbeX6+qTko0u229a4vsTFMMRr8:DJ3DyKvVTVKa4oB8
TLSH
T1911328F298D78937D8AE8783673D2D469DBCD063B4885980B7D85D0CCC422BFD70A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

834a47c5-4a3a-4ca1-8ab3-dcec1fc45802.tmp

Path C:\Users\Admin\AppData\Local\Temp\834a47c5-4a3a-4ca1-8ab3-dcec1fc45802.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1696_1565641518\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/852-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1692-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1840-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-612-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3348-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-739-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3428-523-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3568-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-540-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-592-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4120-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4560-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4684-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5484-624-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6088-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download