054536b4a51fc9bacda1b7d08aeff9fe46b6771a7f9572391b98c6112885b4fb

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe
Size 243KB
Sample260811-rrzpyavdkd
SHA256 054536b4a51fc9bacda1b7d08aeff9fe46b6771a7f9572391b98c6112885b4fb
MD5 8e174f2fdcb2b3bcdf36a80338fbf2e6
SHA1 26a178b8ff364b6a688fe75e75458e276300f5aa
SHA512 22606892842d401e344af3eede3113f30a75f2d7631a88415e4d94bc1fedc915f5a6e4b2c8b493aef6ceb4d2e986b4b0a52bb5bd3dfb8191906277034eef3481
SSDEEP 3072:IMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:CGii9IL8Xa3lLNngoqRttA7+
TLSH
T13234490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6092	CP.exe
2392	eywqojgbzt.exe
2612	CP.exe
2268	CP.exe
5712	i_eywqojgbzt.exe
1416	tolgdywqoi.sys
2604	CP.exe
5484	dyvqoigayt.exe
884	CP.exe
5008	CP.exe
4328	i_dyvqoigayt.exe
4720	gdyvqolfdy.sys
1624	CP.exe
2688	gaytqligay.exe
5472	CP.exe
2216	CP.exe
5204	i_gaytqligay.exe
1224	dyvpnligay.sys
3184	CP.exe
5796	gaxvpnifda.exe
4312	CP.exe
1416	CP.exe
4644	i_gaxvpnifda.exe
2220	fcxvpnhfdx.sys
4108	CP.exe
2484	xvpnhfzxvp.exe
4796	CP.exe
4776	CP.exe
4328	i_xvpnhfzxvp.exe
1276	cxupnkfcax.sys
4032	CP.exe
3476	upmhecaxsp.exe
1508	CP.exe
3380	CP.exe
4084	i_upmhecaxsp.exe
5380	czxupnhfzx.sys
1804	CP.exe
3004	czxrpnhczx.exe
4948	CP.exe
4208	CP.exe
1660	i_czxrpnhczx.exe
2272	rmkecwuomh.sys
3728	CP.exe
1316	omkecwuomh.exe
5320	CP.exe
5968	CP.exe
1496	i_omkecwuomh.exe
2916	rojheywuom.sys
1276	CP.exe
5060	mjebwuomge.exe
5296	CP.exe
4216	CP.exe
1608	i_mjebwuomge.exe
4428	ztrljdbwto.sys
4748	CP.exe
896	ljdbvtnlgd.exe
1660	CP.exe
5532	CP.exe
5744	i_ljdbvtnlgd.exe
4932	qolgdywqol.sys
2132	CP.exe
4724	trlidbvtnl.exe
3492	CP.exe
4736	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1720026611\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1779593333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1779593333\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5692_1729068807\_locales\ml\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhecaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaxvpnifda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpnhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpnhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxvpnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxvpnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaxvpnifda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhecaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxvp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3580	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5792	ipconfig.exe
5656	ipconfig.exe
1004	ipconfig.exe
4032	ipconfig.exe
5340	ipconfig.exe
4932	ipconfig.exe
4912	ipconfig.exe
4132	ipconfig.exe
960	ipconfig.exe
4184	ipconfig.exe
5188	ipconfig.exe
5712	ipconfig.exe
4296	ipconfig.exe
1212	ipconfig.exe
2128	ipconfig.exe
4648	ipconfig.exe
4128	ipconfig.exe
3148	ipconfig.exe
5784	ipconfig.exe
1872	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309319875078866"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{FD363B8F-C113-4207-A94F-D5959689F436}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe
5692	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5712	i_eywqojgbzt.exe
Token: SeDebugPrivilege	4328	i_dyvqoigayt.exe
Token: SeDebugPrivilege	5204	i_gaytqligay.exe
Token: SeDebugPrivilege	4644	i_gaxvpnifda.exe
Token: SeDebugPrivilege	4328	i_xvpnhfzxvp.exe
Token: SeDebugPrivilege	4084	i_upmhecaxsp.exe
Token: SeDebugPrivilege	1660	i_czxrpnhczx.exe
Token: SeDebugPrivilege	1496	i_omkecwuomh.exe
Token: SeDebugPrivilege	1608	i_mjebwuomge.exe
Token: SeDebugPrivilege	5744	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	420	i_trlidbvtnl.exe
Token: SeDebugPrivilege	4716	i_lfdxvqnigd.exe
Token: SeDebugPrivilege	4496	i_hfdxvpnkic.exe
Token: SeDebugPrivilege	5488	i_mkicauspki.exe
Token: SeDebugPrivilege	4408	i_usmhfzxrpj.exe
Token: SeDebugPrivilege	3268	i_rpjhczurmk.exe
Token: SeDebugPrivilege	3904	i_jebwromgey.exe
Token: SeDebugPrivilege	6024	i_gebwtrljdb.exe
Token: SeDebugPrivilege	3736	i_olgeywqolg.exe
Token: SeDebugPrivilege	5228	i_lidbvtnlfd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4852	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	88
PID 4852 wrote to memory of 5692	4852	iexplore.exe	89
PID 5692 wrote to memory of 4836	5692	msedge.exe	90
PID 5692 wrote to memory of 964	5692	msedge.exe	92
PID 5692 wrote to memory of 3580	5692	msedge.exe	94
PID 5692 wrote to memory of 964	5692	msedge.exe	92
PID 5692 wrote to memory of 964	5692	msedge.exe	92
PID 5692 wrote to memory of 5608	5692	msedge.exe	95
PID 5692 wrote to memory of 5608	5692	msedge.exe	95
PID 5692 wrote to memory of 3652	5692	msedge.exe	96
PID 5692 wrote to memory of 3480	5692	msedge.exe	97
PID 5692 wrote to memory of 3652	5692	msedge.exe	96
PID 5692 wrote to memory of 3652	5692	msedge.exe	96
PID 5692 wrote to memory of 3480	5692	msedge.exe	97
PID 5692 wrote to memory of 3480	5692	msedge.exe	97
PID 5692 wrote to memory of 4652	5692	msedge.exe	98
PID 5692 wrote to memory of 5636	5692	msedge.exe	99
PID 5692 wrote to memory of 4652	5692	msedge.exe	98
PID 5692 wrote to memory of 4652	5692	msedge.exe	98
PID 5692 wrote to memory of 5636	5692	msedge.exe	99
PID 5692 wrote to memory of 5636	5692	msedge.exe	99
PID 5692 wrote to memory of 1316	5692	msedge.exe	100
PID 5692 wrote to memory of 1316	5692	msedge.exe	100
PID 5692 wrote to memory of 1316	5692	msedge.exe	100
PID 5692 wrote to memory of 4316	5692	msedge.exe	102
PID 5692 wrote to memory of 4316	5692	msedge.exe	102
PID 5692 wrote to memory of 5900	5692	msedge.exe	103
PID 5692 wrote to memory of 5900	5692	msedge.exe	103
PID 5692 wrote to memory of 5900	5692	msedge.exe	103
PID 5692 wrote to memory of 420	5692	msedge.exe	105
PID 3000 wrote to memory of 6092	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	108
PID 5692 wrote to memory of 4564	5692	msedge.exe	111
PID 5692 wrote to memory of 2276	5692	msedge.exe	112
PID 5692 wrote to memory of 4564	5692	msedge.exe	111
PID 5692 wrote to memory of 4616	5692	msedge.exe	113
PID 5692 wrote to memory of 2276	5692	msedge.exe	112
PID 5692 wrote to memory of 1196	5692	msedge.exe	114
PID 5692 wrote to memory of 4616	5692	msedge.exe	113
PID 5692 wrote to memory of 1196	5692	msedge.exe	114
PID 2392 wrote to memory of 2612	2392	eywqojgbzt.exe	115
PID 5692 wrote to memory of 3564	5692	msedge.exe	118
PID 5692 wrote to memory of 3564	5692	msedge.exe	118
PID 5692 wrote to memory of 5372	5692	msedge.exe	119
PID 5692 wrote to memory of 5372	5692	msedge.exe	119
PID 3000 wrote to memory of 2268	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	120
PID 5692 wrote to memory of 988	5692	msedge.exe	122
PID 5692 wrote to memory of 988	5692	msedge.exe	122
PID 5692 wrote to memory of 988	5692	msedge.exe	122
PID 3000 wrote to memory of 2604	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	125
PID 5484 wrote to memory of 884	5484	dyvqoigayt.exe	127
PID 3000 wrote to memory of 5008	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	130
PID 3000 wrote to memory of 1624	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	134
PID 2688 wrote to memory of 5472	2688	gaytqligay.exe	136
PID 3000 wrote to memory of 2216	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	139
PID 3000 wrote to memory of 3184	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	143
PID 5796 wrote to memory of 4312	5796	gaxvpnifda.exe	145
PID 3000 wrote to memory of 1416	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	148
PID 5692 wrote to memory of 4676	5692	msedge.exe	151
PID 5692 wrote to memory of 3524	5692	msedge.exe	152
PID 5692 wrote to memory of 3208	5692	msedge.exe	153
PID 3000 wrote to memory of 4108	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	156
PID 2484 wrote to memory of 4796	2484	xvpnhfzxvp.exe	158
PID 3000 wrote to memory of 4776	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	161
PID 3000 wrote to memory of 4032	3000	2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8e174f2fdcb2b3bcdf36a80338fbf2e6_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff89fbbc188,0x7ff89fbbc194,0x7ff89fbbc1a0
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,14455218997569000184,8103636396559743097,262144 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,14959042886890921373,16984575555443552089,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
      4⤵
      System Time Discovery
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,9246029586852476229,338554253950420430,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,10034285248190587054,3103228852771585735,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,1324816368181494174,6635512205346519126,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,4255256163671984545,10277101075868758666,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,7469463203530893706,16611682665656842440,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3580,i,3320874360073999654,15307347109853476118,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1391839708356176552,12753911097548758441,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5256,i,17008331175722930072,8755458878145906579,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17129766524395922148,6881711997250170669,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,17129766524395922148,6881711997250170669,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,346228260422198652,4453723173049644116,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,15626911411681939101,9321913897457716162,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,6555349274316134810,11077370680148289319,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,15345386679220343777,12575844287592108799,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,9954381811336257220,17369538813625575043,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,9963108175591815164,17201953409231084640,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6696,i,11348031615657239106,8497336256221827391,2097152 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,11293861256124144792,11901277911099993765,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,18009753503416450295,4821201901709323714,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,9722194438881859054,1436749526050371563,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,437083049486276633,4973712712920201799,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,9275701189476257873,9434407483617475145,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6784,i,1237986939472592960,2642436140038430262,262144 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,5841275290515120177,17848313344445157821,524288 --field-trial-handle=2320,i,8545979867301138193,822063806107666562,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6092
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2268
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\dyvqoigayt.exe
    C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5008
- - C:\Temp\i_dyvqoigayt.exe
    C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqligay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1624
- - C:\Temp\gaytqligay.exe
    C:\Temp\gaytqligay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqligay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2216
- - C:\Temp\i_gaytqligay.exe
    C:\Temp\i_gaytqligay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaxvpnifda.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3184
- - C:\Temp\gaxvpnifda.exe
    C:\Temp\gaxvpnifda.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaxvpnifda.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1416
- - C:\Temp\i_gaxvpnifda.exe
    C:\Temp\i_gaxvpnifda.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\xvpnhfzxvp.exe
    C:\Temp\xvpnhfzxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4776
- - C:\Temp\i_xvpnhfzxvp.exe
    C:\Temp\i_xvpnhfzxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhecaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4032
- - C:\Temp\upmhecaxsp.exe
    C:\Temp\upmhecaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhecaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3380
- - C:\Temp\i_upmhecaxsp.exe
    C:\Temp\i_upmhecaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxrpnhczx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Temp\czxrpnhczx.exe
    C:\Temp\czxrpnhczx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxrpnhczx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4208
- - C:\Temp\i_czxrpnhczx.exe
    C:\Temp\i_czxrpnhczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omkecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\omkecwuomh.exe
    C:\Temp\omkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omkecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5968
- - C:\Temp\i_omkecwuomh.exe
    C:\Temp\i_omkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5532
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\trlidbvtnl.exe
    C:\Temp\trlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4736
- - C:\Temp\i_trlidbvtnl.exe
    C:\Temp\i_trlidbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqnigd.exe ups_run
  2⤵
  PID:5084
- - C:\Temp\lfdxvqnigd.exe
    C:\Temp\lfdxvqnigd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqnigd.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_lfdxvqnigd.exe
    C:\Temp\i_lfdxvqnigd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdxvpnkic.exe ups_run
  2⤵
  PID:1452
- - C:\Temp\hfdxvpnkic.exe
    C:\Temp\hfdxvpnkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdxvpnkic.exe ups_ins
  2⤵
  PID:2372
- - C:\Temp\i_hfdxvpnkic.exe
    C:\Temp\i_hfdxvpnkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkicauspki.exe ups_run
  2⤵
  PID:5988
- - C:\Temp\mkicauspki.exe
    C:\Temp\mkicauspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkicauspki.exe ups_ins
  2⤵
  PID:1376
- - C:\Temp\i_mkicauspki.exe
    C:\Temp\i_mkicauspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmhfzxrpj.exe ups_run
  2⤵
  PID:3296
- - C:\Temp\usmhfzxrpj.exe
    C:\Temp\usmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmhfzxrpj.exe ups_ins
  2⤵
  PID:4536
- - C:\Temp\i_usmhfzxrpj.exe
    C:\Temp\i_usmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurmk.exe ups_run
  2⤵
  PID:2556
- - C:\Temp\rpjhczurmk.exe
    C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurmk.exe ups_ins
  2⤵
  PID:4336
- - C:\Temp\i_rpjhczurmk.exe
    C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwromgey.exe ups_run
  2⤵
  PID:944
- - C:\Temp\jebwromgey.exe
    C:\Temp\jebwromgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwromgey.exe ups_ins
  2⤵
  PID:2356
- - C:\Temp\i_jebwromgey.exe
    C:\Temp\i_jebwromgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebwtrljdb.exe ups_run
  2⤵
  PID:3680
- - C:\Temp\gebwtrljdb.exe
    C:\Temp\gebwtrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebwtrljdb.exe ups_ins
  2⤵
  PID:3404
- - C:\Temp\i_gebwtrljdb.exe
    C:\Temp\i_gebwtrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqolg.exe ups_run
  2⤵
  PID:4128
- - C:\Temp\olgeywqolg.exe
    C:\Temp\olgeywqolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqolg.exe ups_ins
  2⤵
  PID:2600
- - C:\Temp\i_olgeywqolg.exe
    C:\Temp\i_olgeywqolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run
  2⤵
  PID:3480
- - C:\Temp\lidbvtnlfd.exe
    C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
  2⤵
  PID:2520
- - C:\Temp\i_lidbvtnlfd.exe
    C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5432

C:\Temp\tolgdywqoi.sys
C:\Temp\tolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:1416

C:\Temp\gdyvqolfdy.sys
C:\Temp\gdyvqolfdy.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\dyvpnligay.sys
C:\Temp\dyvpnligay.sys
1⤵
- Executes dropped EXE
PID:1224

C:\Temp\fcxvpnhfdx.sys
C:\Temp\fcxvpnhfdx.sys
1⤵
- Executes dropped EXE
PID:2220

C:\Temp\cxupnkfcax.sys
C:\Temp\cxupnkfcax.sys
1⤵
- Executes dropped EXE
PID:1276

C:\Temp\czxupnhfzx.sys
C:\Temp\czxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:5380

C:\Temp\rmkecwuomh.sys
C:\Temp\rmkecwuomh.sys
1⤵
- Executes dropped EXE
PID:2272

C:\Temp\rojheywuom.sys
C:\Temp\rojheywuom.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\qolgdywqol.sys
C:\Temp\qolgdywqol.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\ifdxvqniga.sys
C:\Temp\ifdxvqniga.sys
1⤵
PID:4136

C:\Temp\kifaxspnlf.sys
C:\Temp\kifaxspnlf.sys
1⤵
PID:4792

C:\Temp\usqkicausn.sys
C:\Temp\usqkicausn.sys
1⤵
PID:4348

C:\Temp\xspkhczxrp.sys
C:\Temp\xspkhczxrp.sys
1⤵
PID:2152

C:\Temp\omkhczurpj.sys
C:\Temp\omkhczurpj.sys
1⤵
PID:6032

C:\Temp\gebwtrmjeb.sys
C:\Temp\gebwtrmjeb.sys
1⤵
PID:6036

C:\Temp\rojhezwqoj.sys
C:\Temp\rojhezwqoj.sys
1⤵
PID:912

C:\Temp\ljdbytrljg.sys
C:\Temp\ljdbytrljg.sys
1⤵
PID:2428

C:\Temp\ligdyvqoig.sys
C:\Temp\ligdyvqoig.sys
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnkfcax.sys

Path C:\Temp\cxupnkfcax.sys
Size 141KB
SHA256 c2a7d4a6a11dee9ab3f4d8790c47a18c74df94f1df8d8c6badd1ef66883a8f72
MD5 4fb7181a1819b2482be52a4fda661072
SHA1 3e9c80a79eb2b7368f8c249902fa73f4bf6130e4
SHA512 e926cc0dd780e746391ef77c4c2c1159e389927b6d580d959db6cba4b05ace7f97b5ed64fbad6a2c316df9f6dc7ed449228a86e4f4e6b78f5930ab44855e23ae
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvpnligay.sys

Path C:\Temp\dyvpnligay.sys
Size 141KB
SHA256 3d03dcdf74f6095bd7f95a82e2480e30994cee8a6b2d1d946b6c3371e713807d
MD5 62bc8ce1227620a576726b441525d696
SHA1 98b2760414e5c0ec39d5d157f05a3e45a81b5238
SHA512 cd5d52807f3499abf61aa3b517b11221a2218f98d65e99197e1ba53c387d85dba69171ba9ad238e839ded63d4a5e47353df10255244d6894aebfc730cc0d6bc8
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigayt.exe

Path C:\Temp\dyvqoigayt.exe
Size 243KB
SHA256 62a9031d8ee6e3a132b61c99cab8789290474ad49a54913ec05357de209fc9ab
MD5 83ef0f3c6e9f3346b0c456192d930aa2
SHA1 76b34f09498840562f69b532be17973ec273764e
SHA512 401e61349da2903b48baebb3a8eee5c3ccb170d1d315d0b31e181975172c5f6d94aa2c76b73b455d264b5cc92cfad5bd70e107f56590ab2afc6f20f987cdc34a
SSDEEP 3072:YMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:yGii9IL8Xa3lLNngoqRttA7y
TLSH
T1ED34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbzt.exe

Path C:\Temp\eywqojgbzt.exe
Size 243KB
SHA256 12c2dd2d6c52e0748686c061f14eb5ba05efbffdd3b539b92744eb41d01cb677
MD5 c1b9dd671af838a30ac24981bccd08cb
SHA1 acf1b568e45c1319e201a8b21fce796bc7c3fe46
SHA512 f23e71c4b1247f6384dd87b2640201fa6d71fc0b5991e9c0351bc70d6c6cdeeb1d3b0076a6445e9d3ce9ef89ec65d53c0094770d0a207af79d92d077e70ee414
SSDEEP 3072:NMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:JGii9IL8Xa3lLNngoqRttA7b
TLSH
T14C34490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfdx.sys

Path C:\Temp\fcxvpnhfdx.sys
Size 141KB
SHA256 47edebc0aa787a68d6de64a4c02e853103087f793091a322fd6e62c4879bef92
MD5 01526a576967c3ba32c8a0576979b572
SHA1 3c800c899356ecf9796690cd4482a176ba9deaa1
SHA512 164a11b4f217eb2921f079403c36cff39238bdc64233f0d68b587971bd8a13fe00b3993f8258f805a4c50e825d352c06cc7e817bf86a158169b66817e93715c4
SSDEEP 1536:Ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaxvpnifda.exe

Path C:\Temp\gaxvpnifda.exe
Size 243KB
SHA256 5b2603cc387dd54af94a1db2cece7803d3a98d98bf1db5614e23f2534fbf9874
MD5 8a5ae7c52f1eea61ca8a0a6fa01cd63b
SHA1 68674c30559133e6e98973eab9323a568af85c55
SHA512 39380796bbe793a6f71092b48e79a389ace758d1c386e233b9a6c33e37ef299be4a6fbe9f63844c1ddc5977d1b190125285f35e68a6aa1997695e86403c17b24
SSDEEP 3072:2MaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:AGii9IL8Xa3lLNngoqRttA7I
TLSH
T1F034490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqligay.exe

Path C:\Temp\gaytqligay.exe
Size 243KB
SHA256 de47cdf472a118dbc2b72650b8f2e82f6401cf6ce212bb11755db96197c27875
MD5 24a93a75910368e609a925d74788db1f
SHA1 042a3c3cfcd5bfcd799c3cf0583a6d0c3ddc98b9
SHA512 c56eb188c73a20d5854ae5f40ac98e1f022d93a97d323d501baa9d35cbc297c22ce51e56aebac7c0cb91011651ea7af3cb96fc1ade0fa6dcadd1778cd14b1b8d
SSDEEP 3072:mMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:QGii9IL8Xa3lLNngoqRttA7o
TLSH
T1B934490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqolfdy.sys

Path C:\Temp\gdyvqolfdy.sys
Size 141KB
SHA256 78e4a51c371ad705f397cc36d654c3af9eaef64ee898312ad093f64c0faae4c2
MD5 6e926206da9e520c69cfcc02dc0b9824
SHA1 b5d08898903f954971933118995b3cd3b818de67
SHA512 d148438b825dfbc8f7ce5179bf2189367506883af42cca4448f37ffff7897ac2226df7f9628c7d44a5e6df37a1342bdd7fc3c25385d9df310274551888dc9984
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13FE37C12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqoigayt.exe

Path C:\Temp\i_dyvqoigayt.exe
Size 243KB
SHA256 4c97439e5b89b9c5864e252f908c75bd096841531b86231bd7ce7659b89ecad4
MD5 f49ef3bd6ecef3e2f7e3160893ab87f2
SHA1 80cb0576c28ecbe70f61b348bc7c1a3e3846a48a
SHA512 29a74eafc2efcbbe59989153e0aa715b058fa1102f78877601040b0eccf8aa143120f9c186d983f4378a83b9b7e4459188523ac29e1efc0188396821865b403d
SSDEEP 3072:qMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:MGii9IL8Xa3lLNngoqRttA7k
TLSH
T17034490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqojgbzt.exe

Path C:\Temp\i_eywqojgbzt.exe
Size 243KB
SHA256 6d63dce2cef889d8ab39a3f0bb1086a5b159ced7c4bd311d2d1fb5e8d74697f4
MD5 ec8d258890af91a2ee3c7ae7e8994cc9
SHA1 c73500fd57785c627a1874201961e0ade005ceaf
SHA512 68c3a9005c799d12911e2ceef00bf5951f0d42034866c8124362fac47f29fbd5a5a85a20431ddbd5e8552ac4e46727219a613813bbb992ae94a2c7758371c4f6
SSDEEP 3072:KMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:sGii9IL8Xa3lLNngoqRttA7I
TLSH
T1CB34490272818031E71A0B74046AE7A146BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaxvpnifda.exe

Path C:\Temp\i_gaxvpnifda.exe
Size 243KB
SHA256 eaa6a2e46c6b3c147f74f82867383741c9c94956d20576562876d7037d5fe268
MD5 db25306ee6eb5e3da3b794714462eb6f
SHA1 55461465882430b7db2fa9e6aa13e61673fdd80b
SHA512 b01a63d664c3e808d53dd2db5aa2b7c90cb4a2635940ae83a8c987a7f0c0fbcc62515b5f12caf0a07dc3f065e3b2a668a72c268ddf31def864ffa0cfe3d2f7ce
SSDEEP 3072:RMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:lGii9IL8Xa3lLNngoqRttA7T
TLSH
T1B834490272818031E75A0B74046AE7A046BE7D344FB5E58FF7A83B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqligay.exe

Path C:\Temp\i_gaytqligay.exe
Size 243KB
SHA256 e85e9b6f6a33a89800d6acbbfaf19cdc4df7238251b43590f2db5426c6030dff
MD5 ee35fb1c6abbde4cde9ac1c594645292
SHA1 fa781122d39700275501dcd3e9f27255d0b588ea
SHA512 4eab694318b6de79b1019bcb3194d6fdc599578e34b2d1e38e0deeacea4b92537c50553dfb20a25a8d4bc87b976f2fd8d43df89762c22dfe8c0df2d3eadd5831
SSDEEP 3072:UMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:2Gii9IL8Xa3lLNngoqRttA7+
TLSH
T11134490272818031E71A0B78046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnhfzxvp.exe

Path C:\Temp\i_xvpnhfzxvp.exe
Size 243KB
SHA256 86f37923f6d19a6eac704d3b5e47e117ec06459ae8db5d4d6cec4075327d5d33
MD5 d9bd37452421bb2eb991db7a2eeaeb09
SHA1 5d35b3de783717ec5daa6e71cae5109d4be2dacc
SHA512 cd8b08d14195caf72466a6659e4d4053f033a22e3a0eeb02fe34a9774ba3baf0669edf76d9d8562a98368c59ee6e2dbc1036e811268d17731855bcd732ba9dc9
SSDEEP 3072:gaMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Gy:gcGii9IL8Xa3lLNngoqRttA7Gy
TLSH
T18D34490272818031E71A0B74046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdywqoi.sys

Path C:\Temp\tolgdywqoi.sys
Size 141KB
SHA256 4e01c7a4429f364e7c03484a843c1eb6e5d1b8f5950c2a7ffb57eda4b8d4cda9
MD5 7eeaaaa603ce5553053d4ef04ad1074b
SHA1 8f2704c62429f08124f51ee1bcd7884b0055d731
SHA512 77f3be998fd7a6b77bd3891d8c1fa9e6518db33dce321909138dee0d43ffcf3bf4ac7019b5faa7bd8acbedf09c1e65f5477297b610cddbb48b8e0de6a00e10e0
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CEE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhecaxsp.exe

Path C:\Temp\upmhecaxsp.exe
Size 243KB
SHA256 702b3b9d2c17953e56d099fa9ba9cd2999dd027367d53bd8377de0dc12179b2c
MD5 b0dc6770ac7a72ef1521dd0fde13578a
SHA1 ee4c0907094ed28f55c9fe8c6c94161719620602
SHA512 255f9d8515fe733b5d80a14ff12c35b335ba0fcd1d93c8813d73fd1ec0427d343872348caf2f1e0dabfb030f11ed6407d6481670d39a0be6c147df0788130cea
SSDEEP 3072:hMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:VGii9IL8Xa3lLNngoqRttA7j
TLSH
T15734490272818031E71A0B74046AE7A146BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxvp.exe

Path C:\Temp\xvpnhfzxvp.exe
Size 243KB
SHA256 6a0bd5929cc68aa243d683032ccccd237ed920cd1ecf1a2aa0b9aa1d09a084ef
MD5 3f46b3bdf5310e1471dff95d50b1b3a0
SHA1 c1b6961a96d6701159864848cd3136cd79178582
SHA512 e51d957c73796120dcbea530008f1d1ad37bb5fbb5aeead7843b420b4d4286688180635262a1e31e110e8d22ecd23ed40c2bcd2d957b5609fd969755830f081e
SSDEEP 3072:xMaGii9ILTQJh/7yga3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7H:FGii9IL8Xa3lLNngoqRttA7H
TLSH
T1F034490272818031E71A0B78046AE7A046BE7D344FB5E58FF7683B795A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b23aea2623988317031e578be7821ad17f3a9ba3fcb3deff7e98fb9bdf66c56e
MD5 58e84357d9fd445d308cb7b271a4f3e0
SHA1 f1cd2de6dec5d6fe04a5724d4d63ff233d5ca35c
SHA512 daf57c3e89f66af0ee74cd187bf3dd9d316d2242251047b9643e6a066031ee2f8f793ce9fee1057f0a04e35116a83173d546557e8597907029a57393e5c5fa36
TLSH
T1BF6150D5231A6B92EF204EB1DDE2764D35F3CB55090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59acd0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59acd0.TMP
Size 3KB
SHA256 7d92120f7f7ff71c9aa991ea67d3276989d35ec1b91048fcb49ad9eb0f16ba40
MD5 ccb6112c3442e378c6b028fec29ab282
SHA1 700efa84fd65b5df2922651248e1d7c793e0b4f8
SHA512 086b628138b9371e1a0eafb38caf7273eb1d653b5dee9b8ae1431febc6212b1125ce592c2394ac9e12c296be204ea4a302f5c7c76fad42514ad131c6b8642a18
TLSH
T1406150D5271A2BD2EF204EB1DDE2764D35F3CB54090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

050d87d7-483f-4baf-b1a7-fe5ccebfca61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\050d87d7-483f-4baf-b1a7-fe5ccebfca61.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7cded3ef-ad6c-4ddc-a0c1-b9d45461c074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7cded3ef-ad6c-4ddc-a0c1-b9d45461c074.tmp
Size 2KB
SHA256 8f0ccea2aa7f0610b1a12ab1b93e4e7b759d7b26cb65632fc9de462d42fc9ba1
MD5 c3f3db23542a9552214e8ae4fa9a42e1
SHA1 973a261ac7f461e1d0e6acafb760c48a1c0f96ab
SHA512 a43db383080d2360e46dc65131e159d989533836ebca94b30373aec9d7a99fc814e09843c4fd8329df8f06a55640f32d4c5208d894b99413b6ed5b2f1917f4e8
TLSH
T13241A0F7C3F4856D890196F0AA186E2BCF1C0915432C7D5AC9E4AE1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae68984bce5d5cec1e65d198a83e54999fe70602a01a31daa9ef51ad71f23a94
MD5 e0d0474ec2ee0ffd27cf1a29418d26b8
SHA1 b4d751974b6b9c689129bfdda993e62cf25c2092
SHA512 7ef044fc648d149efe77b5c9525de3e00fa949fd29ad374bf3550ed968dc3e48d9778273002051c7edfa1789b6d0d68b556cc7b28439752eb33090afb3277370
SSDEEP 192:sxRNbR7TpCRP/fz1so3tZRYPJMzoA8p95/g6+WNCzI/YD9ph6SeGHfIgVP74J:sxRxa9/fRso3D0z/59/7SlK
TLSH
T19142C7166A28A93B8CC7D21DBB257F53E2F95032A1901E58F6FC9A1C14E76CD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7eeb5c68f9932e10d67295bcfc1ccec2edd59cedb9381b4f0bf80c81ef3a001e
MD5 3e0972e9a0d384ee1672d3441be6c430
SHA1 0211a91d8f0c909385f5dcff96e5d82e96dc87a7
SHA512 6aea184ed46d9e9025f268fce04cf62c6c3d0a776256fb8ffe70b172248e7ff07f5cea8daeb18487d6236ac47db0dee3b3dd83b8d65265f8275de690fe1d5618
SSDEEP 192:sxR2bR7TpCRP/fz1sWgtZRYPJMzoA8p95/g6+WNCzI/YD9flZ6SeGHfIgDzP74J:sxR2a9/fRsWgD0z/59/I6Sl4
TLSH
T11D42C6166A24693B9CC7E21DBB657F53E2F99032A0901E58F7FC9A1C14E76CD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d2005455a811a2bd42d4437daf7c0c96eb0fdb985fcccaba5602fc994111876
MD5 2fc03238f77c782b03ac43b3495d6aa7
SHA1 020109c0e9ad6d3962a1247e032276310fc928aa
SHA512 f8a8228f4e00244089fdd4e38377db16e53cade81fb4b94913765636367a054e6a963b110ade3b071b0905fbdf5572eb80c56e99ffba6fec75069ba7f5d9dd2f
SSDEEP 192:sxR2bR7TpCRP/fz1sW3tZRYPJMzoA8p95/g6+WNCzI/YD9ph6SeGHfIgDZP74J:sxR2a9/fRsW3D0z/59/7Sla
TLSH
T1BF42D7166A24693B8CC7D21DBB657F53E2F99032A1901E58F6FC9A1C14E76CD6207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 a85a7c3fe53aa8b6fe13df36b64dc898ab77c0fb59e430a1198f5fcd564074ea
MD5 c77c93a5bb331527caed49920e9badf1
SHA1 a288b549e9903214ef2fd34641a05a5915d3769b
SHA512 50bed7c52912c75bcc921e81df79cb493c18f9f7acaf6fdd690e11f997cdb0d0ac8051b65b69c788be1a7bc5d0a6d1bedb0a0d0ca542f77412225efaa5d4dbad
SSDEEP 768:azfWRZ7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVB/Yc16propk/9w:azfWRvEf30Wg/XfHfu1jaS/Yy6Cpkq
TLSH
T1D3D2EA7B640CCA7F4F800ADDAD197EDB6DA802CB9698CD5047FE941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4def27922eae0091b1fca51d6591774374b7b6d7ce4bb90917c5b583cd7d58ee
MD5 361021c1a1a942464e5be2c7c9b69dbc
SHA1 0780a10b741bf7e1a06a2a16298190317b477579
SHA512 8bda08cb264bb19d03aab28716f058dd565739fbee30b0fc66d9cc6c2d35dad954d721a3b47499e424c2715969f44cfcf3eccf15abbe851d16666d3e25115cc9
SSDEEP 96:KRE/iE/nE/OE/iE/UE/0E/kE/iWE/sE/5E/RgE/SE/iK4E/HgE/IE/icE/yE/6EH:CE/iE/nE/OE/iE/UE/0E/kE/dE/sE/55
TLSH
T14091F081757A02403D7F6A0CCEB9892B62817472301DA9AB7FAA51750B6BE134CFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1d5f242-445c-408c-9a34-4d58ec00ed38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c1d5f242-445c-408c-9a34-4d58ec00ed38.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 81fda31efbe25c5fb18e8c29b580193e523d0875d3a5e87612ec6707bc22f2a2
MD5 e87f99595b80371ad3d546decffb9d8d
SHA1 753147a3cba4afe8a5b1d85380f3ff31c810b3d3
SHA512 3e846e3949a5b18a495d520085786d64a73e53783f4ed09a8d75387cf34f8830d8a166f0a8dd3829ce82a57d9762fc8593454620cb52533c9ec018e10ba4a2ef
SSDEEP 384:n9ZcIL38NNkFI6ypWZlf8hyEG6f77h7F+Gy2rEoajo4cdR8eHhVODjYPNDUMRPOC:lL3g+i0QW+rEnjN3Gac1FRPi9P/te
TLSH
T1CFF2BF7068A49DB39CEBE785B6433743BEF0466394C40BA8D6D9E60C15936AC130BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 5f002b9d09ea9b757c25ea71bab8c87343a48db5dbdbcffc075ac2f3df0cdc49
MD5 c027516bef8504d8086a726e86f85112
SHA1 86e916f4383ebc72a3dc9cc629388fee0e6f429f
SHA512 c9e46bd383ed767c05cc7737c8cb8293ca8f3a9f3c0ef00ef7872656293e5407c40a7d7e9565261b75399a85723ce44a0d58a42929e650de1a8bc619a456f1e2
SSDEEP 768:fFQLu30wgUNsQWXrEnjN3Gac1FRPi9P/te:iLu3MXXQnjMa2P4te
TLSH
T1021327F198E78976D8EE9787677E2E429DBCC153B4884994B7C49D0CDC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b19c6ad66a2af7a53762bc62adb85102ff2547bc4ce19cfe4e9b0b6efd4aa215
MD5 56433d9e5ada8f576dabcc12bed6162f
SHA1 5a1d76223bb13bc4c403c71db8f70a56869b8256
SHA512 c419789ce74e86879cb63f0cc022f15349cc58f9beb8eda609326a222e0cbe183fd886f2fc67a579168afd12ba84241e61aaf7cc63f2ae74c9f1251b260b7d2b
SSDEEP 768:prv+4UNbdA3T+i0QW4rEnjN3Gac1FRR3n:pbsby3YX4QnjMa2h
TLSH
T1B903BF3069789E738CFBE685B1477A437EF016A344C50BA4DAC9BA0C159B5EC270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 78e357c3cc5a40e5655d520bc198b32037cacd584c0a1afea4ac1a053b89d07a
MD5 0a758ae6669bb81f5fe6b163d902f3fa
SHA1 4772698c603c71ead39058421bc641f2c4d337da
SHA512 18b4ede234d9316c538be75d00931bda179fde249b12c26077c37678e8d94764587b41251d84ecb235db535df92c7a944c0121e6e4bc866d98e90d5f8d6d55de
SSDEEP 768:rrv+4UNbdS3Emi0QyrEnjN3Gac1ZweVH1SCz:rbsbg3D7QnjMaDEH1V
TLSH
T1A503CF3269A89AB38CE7E38575877A037EF4525385D40BE0C6DD6B0D02DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 df3526dca7cc5ab8a1011ddadffe440bccc2047589d48b8666f68cc4f7be6386
MD5 78a5e53a0f5d78af603a5dd33a51497f
SHA1 2b5674379bc33bb51efb485a3d73d55deb9d1801
SHA512 db6b3efd208726f3fb8ff6b0fc754d1c7f379ada118d375cd783ee1f510a4815a66047f3bffe6981fb90dfa36b4c7f249f42ff70c5f895d4b48a6f75de2ff06d
SSDEEP 768:Zrv+4UNbdS310i0QW/rEnjN3Gac1oReVH1SCz:Zbsbg3sX/QnjMaREH1V
TLSH
T18503BF3168B89E738CEBE385B1877A437EF4526384C40BA4D9D9AB0D45975EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb043e2d-2390-4b45-b6f5-decd351320fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb043e2d-2390-4b45-b6f5-decd351320fb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59840b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59840b.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

425a52b5-bb06-4492-ba39-074be376802d.tmp

Path C:\Users\Admin\AppData\Local\Temp\425a52b5-bb06-4492-ba39-074be376802d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5692_165058373\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/912-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1224-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1224-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-523-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1416-412-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2152-639-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2220-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2428-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2980-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4348-619-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4792-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-586-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5380-537-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6036-648-0x0000000000010000-0x0000000000083000-memory.dmp

Download