057b65c3ad15f77f91be12cd9e55e81c022451f43927fd37988ef61adff4f3d3

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe
Size 243KB
Sample260727-rnfsnavbkf
SHA256 057b65c3ad15f77f91be12cd9e55e81c022451f43927fd37988ef61adff4f3d3
MD5 af3b5811f28eef1172e60e153938cfce
SHA1 fc48d6ba31585ab7f3ffcbe273ea12da5e2cf144
SHA512 ed3d20af133d5f9777801ca223fcb201dc01c3146a0fe488ce24c3c832a0444ce529a893654365c0889503e03391d58eaff6dd53c25d5e5dc770709d904bec6d
SSDEEP 3072:xCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7j:MvMsLaOa3lLNngoqRttA7j
TLSH
T15A345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5040	CP.exe
2540	wrlgeywroj.exe
4292	CP.exe
6348	CP.exe
2868	i_wrlgeywroj.exe
6272	omgeywqojd.sys
2916	CP.exe
2964	tolgeywqoi.exe
4988	CP.exe
1696	CP.exe
3272	i_tolgeywqoi.exe
4724	bvtnljdbvt.sys
3328	CP.exe
5972	yvqnlgdbsq.exe
1096	CP.exe
6380	CP.exe
5800	i_yvqnlgdbsq.exe
2036	nlidavtnlf.sys
1844	CP.exe
2920	qnlicaysqn.exe
5744	CP.exe
5628	CP.exe
6852	i_qnlicaysqn.exe
5044	xvpnlidxvt.sys
2276	CP.exe
5344	kfcausnkfa.exe
3092	CP.exe
3236	CP.exe
5156	i_kfcausnkfa.exe
6288	ifzxusmkhf.sys
3336	CP.exe
6248	kicxvpnhfz.exe
4188	CP.exe
5768	CP.exe
5800	i_kicxvpnhfz.exe
6136	cxusmkecwu.sys
5852	CP.exe
5616	zxusmkecwu.exe
4860	CP.exe
4828	CP.exe
4520	i_zxusmkecwu.exe
4652	tromhecwuo.sys
7000	CP.exe
6852	trmjhezxrp.exe
5636	CP.exe
2396	CP.exe
3728	i_trmjhezxrp.exe
5900	hbztrpjhec.sys
4496	CP.exe
1872	zuomjebwtr.exe
4924	CP.exe
1912	CP.exe
4308	i_zuomjebwtr.exe
5460	rljebwuolg.sys
900	CP.exe
3740	rljgbytrlg.exe
3504	CP.exe
5684	CP.exe
4908	i_rljgbytrlg.exe
3700	vtnlgdbvtn.sys
3180	CP.exe
3344	qolgeywqoi.exe
6768	CP.exe
2024	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\auto_open_controller.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5792_178177876\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_631528685\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_384661657\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlgdbsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlicaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbytrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrlgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlgdbsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlicaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbytrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrlgeywroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnhfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlidbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3948	ipconfig.exe
5936	ipconfig.exe
1244	ipconfig.exe
3420	ipconfig.exe
1712	ipconfig.exe
2072	ipconfig.exe
4544	ipconfig.exe
5784	ipconfig.exe
2864	ipconfig.exe
3856	ipconfig.exe
2664	ipconfig.exe
6404	ipconfig.exe
1016	ipconfig.exe
4472	ipconfig.exe
6280	ipconfig.exe
4960	ipconfig.exe
432	ipconfig.exe
5512	ipconfig.exe
5452	ipconfig.exe
2984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296356209799179"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{2FF12A73-F3A9-4DFB-B94F-E687EE666792}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5716	msedge.exe
5716	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe
5792	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	i_wrlgeywroj.exe
Token: SeDebugPrivilege	3272	i_tolgeywqoi.exe
Token: SeDebugPrivilege	5800	i_yvqnlgdbsq.exe
Token: SeDebugPrivilege	6852	i_qnlicaysqn.exe
Token: SeDebugPrivilege	5156	i_kfcausnkfa.exe
Token: SeDebugPrivilege	5800	i_kicxvpnhfz.exe
Token: SeDebugPrivilege	4520	i_zxusmkecwu.exe
Token: SeDebugPrivilege	3728	i_trmjhezxrp.exe
Token: SeDebugPrivilege	4308	i_zuomjebwtr.exe
Token: SeDebugPrivilege	4908	i_rljgbytrlg.exe
Token: SeDebugPrivilege	6324	i_qolgeywqoi.exe
Token: SeDebugPrivilege	4676	i_nigaysqlig.exe
Token: SeDebugPrivilege	1604	i_faxvpnkfdx.exe
Token: SeDebugPrivilege	3788	i_qnhfcaxspn.exe
Token: SeDebugPrivilege	5452	i_xrpnhfcxvp.exe
Token: SeDebugPrivilege	2576	i_smkhecwuom.exe
Token: SeDebugPrivilege	6440	i_jebzuomgey.exe
Token: SeDebugPrivilege	3852	i_jgbwtomgey.exe
Token: SeDebugPrivilege	2336	i_gdbwtoljdb.exe
Token: SeDebugPrivilege	2036	i_avtnlidbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 264	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	89
PID 264 wrote to memory of 5792	264	iexplore.exe	90
PID 5792 wrote to memory of 1204	5792	msedge.exe	91
PID 5792 wrote to memory of 1292	5792	msedge.exe	93
PID 5792 wrote to memory of 5152	5792	msedge.exe	92
PID 5792 wrote to memory of 5152	5792	msedge.exe	92
PID 5792 wrote to memory of 5152	5792	msedge.exe	92
PID 5792 wrote to memory of 1188	5792	msedge.exe	94
PID 5792 wrote to memory of 1188	5792	msedge.exe	94
PID 5792 wrote to memory of 1428	5792	msedge.exe	95
PID 5792 wrote to memory of 4944	5792	msedge.exe	96
PID 5792 wrote to memory of 1428	5792	msedge.exe	95
PID 5792 wrote to memory of 1428	5792	msedge.exe	95
PID 5792 wrote to memory of 4944	5792	msedge.exe	96
PID 5792 wrote to memory of 4944	5792	msedge.exe	96
PID 5792 wrote to memory of 1812	5792	msedge.exe	98
PID 5792 wrote to memory of 1812	5792	msedge.exe	98
PID 5792 wrote to memory of 1812	5792	msedge.exe	98
PID 1140 wrote to memory of 5040	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	99
PID 2540 wrote to memory of 4292	2540	wrlgeywroj.exe	102
PID 5792 wrote to memory of 4608	5792	msedge.exe	105
PID 5792 wrote to memory of 4608	5792	msedge.exe	105
PID 5792 wrote to memory of 4608	5792	msedge.exe	105
PID 1140 wrote to memory of 6348	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	106
PID 5792 wrote to memory of 3832	5792	msedge.exe	108
PID 5792 wrote to memory of 3832	5792	msedge.exe	108
PID 5792 wrote to memory of 2780	5792	msedge.exe	109
PID 5792 wrote to memory of 2780	5792	msedge.exe	109
PID 5792 wrote to memory of 5780	5792	msedge.exe	111
PID 1140 wrote to memory of 2916	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	116
PID 2964 wrote to memory of 4988	2964	tolgeywqoi.exe	118
PID 1140 wrote to memory of 1696	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	121
PID 1140 wrote to memory of 3328	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	125
PID 5972 wrote to memory of 1096	5972	yvqnlgdbsq.exe	127
PID 1140 wrote to memory of 6380	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	130
PID 1140 wrote to memory of 1844	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	134
PID 2920 wrote to memory of 5744	2920	qnlicaysqn.exe	136
PID 1140 wrote to memory of 5628	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	139
PID 5792 wrote to memory of 956	5792	msedge.exe	142
PID 5792 wrote to memory of 4664	5792	msedge.exe	143
PID 5792 wrote to memory of 3404	5792	msedge.exe	144
PID 5792 wrote to memory of 4444	5792	msedge.exe	145
PID 5792 wrote to memory of 4444	5792	msedge.exe	145
PID 5792 wrote to memory of 692	5792	msedge.exe	148
PID 5792 wrote to memory of 692	5792	msedge.exe	148
PID 1140 wrote to memory of 2276	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	149
PID 5344 wrote to memory of 3092	5344	kfcausnkfa.exe	151
PID 1140 wrote to memory of 3236	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	154
PID 1140 wrote to memory of 3336	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	158
PID 6248 wrote to memory of 4188	6248	kicxvpnhfz.exe	160
PID 1140 wrote to memory of 5768	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	163
PID 1140 wrote to memory of 5852	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	167
PID 5616 wrote to memory of 4860	5616	zxusmkecwu.exe	169
PID 1140 wrote to memory of 4828	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	172
PID 1140 wrote to memory of 7000	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	176
PID 6852 wrote to memory of 5636	6852	trmjhezxrp.exe	178
PID 1140 wrote to memory of 2396	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	181
PID 5792 wrote to memory of 6444	5792	msedge.exe	183
PID 5792 wrote to memory of 6444	5792	msedge.exe	183
PID 1140 wrote to memory of 4496	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	188
PID 1872 wrote to memory of 4924	1872	zuomjebwtr.exe	190
PID 1140 wrote to memory of 1912	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	193
PID 1140 wrote to memory of 900	1140	2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe	197
PID 3740 wrote to memory of 3504	3740	rljgbytrlg.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_af3b5811f28eef1172e60e153938cfce_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff85322c188,0x7ff85322c194,0x7ff85322c1a0
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9054237565729753591,7843631086412640341,262144 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,18146679574652721081,17028300805539810708,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:11
      4⤵
      System Time Discovery
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,16028000880376960962,3527231630083546277,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,18208472166412329503,13622577046246330611,2097152 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,11273027505851740218,6317435141681738842,2097152 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3524,i,71576741257361434,3061305282753025442,2097152 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:1812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5176,i,17198527196536847534,1415166373179989227,2097152 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,11151881179646459423,17495749147630208412,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,2688270747912452870,18311896466679839133,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7899457547315206505,8180288996147380401,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7899457547315206505,8180288996147380401,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,12474975184090887536,14961581297339429691,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,5251950281572257926,17925321785262438742,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,11411291123622516597,1183002283750533030,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,16157481922377861837,6793760648885296409,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,14115423897294316893,1239480185791428974,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,16881759622097211064,18071154074900309052,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,12552013748065808119,3467468378722272498,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:14
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7688198238449938616,11711090523017808809,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5996,i,1486714396397000340,9414604703219357739,262144 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1196,i,16581261891995516254,3925056511047839380,524288 --field-trial-handle=2664,i,13401929046804702055,2059611309280036911,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrlgeywroj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5040
- - C:\Temp\wrlgeywroj.exe
    C:\Temp\wrlgeywroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrlgeywroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6348
- - C:\Temp\i_wrlgeywroj.exe
    C:\Temp\i_wrlgeywroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\tolgeywqoi.exe
    C:\Temp\tolgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_tolgeywqoi.exe
    C:\Temp\i_tolgeywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlgdbsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\yvqnlgdbsq.exe
    C:\Temp\yvqnlgdbsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlgdbsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6380
- - C:\Temp\i_yvqnlgdbsq.exe
    C:\Temp\i_yvqnlgdbsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlicaysqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\qnlicaysqn.exe
    C:\Temp\qnlicaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlicaysqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5628
- - C:\Temp\i_qnlicaysqn.exe
    C:\Temp\i_qnlicaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausnkfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\kfcausnkfa.exe
    C:\Temp\kfcausnkfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausnkfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3236
- - C:\Temp\i_kfcausnkfa.exe
    C:\Temp\i_kfcausnkfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicxvpnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Temp\kicxvpnhfz.exe
    C:\Temp\kicxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicxvpnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5768
- - C:\Temp\i_kicxvpnhfz.exe
    C:\Temp\i_kicxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxusmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\zxusmkecwu.exe
    C:\Temp\zxusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxusmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\i_zxusmkecwu.exe
    C:\Temp\i_zxusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjhezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:7000
- - C:\Temp\trmjhezxrp.exe
    C:\Temp\trmjhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjhezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_trmjhezxrp.exe
    C:\Temp\i_trmjhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomjebwtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\zuomjebwtr.exe
    C:\Temp\zuomjebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomjebwtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\Temp\i_zuomjebwtr.exe
    C:\Temp\i_zuomjebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljgbytrlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:900
- - C:\Temp\rljgbytrlg.exe
    C:\Temp\rljgbytrlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljgbytrlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5684
- - C:\Temp\i_rljgbytrlg.exe
    C:\Temp\i_rljgbytrlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qolgeywqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3180
- - C:\Temp\qolgeywqoi.exe
    C:\Temp\qolgeywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qolgeywqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2024
- - C:\Temp\i_qolgeywqoi.exe
    C:\Temp\i_qolgeywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqlig.exe ups_run
  2⤵
  PID:4804
- - C:\Temp\nigaysqlig.exe
    C:\Temp\nigaysqlig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqlig.exe ups_ins
  2⤵
  PID:6052
- - C:\Temp\i_nigaysqlig.exe
    C:\Temp\i_nigaysqlig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxvpnkfdx.exe ups_run
  2⤵
  PID:6064
- - C:\Temp\faxvpnkfdx.exe
    C:\Temp\faxvpnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxvpnkfdx.exe ups_ins
  2⤵
  PID:4768
- - C:\Temp\i_faxvpnkfdx.exe
    C:\Temp\i_faxvpnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnhfcaxspn.exe ups_run
  2⤵
  PID:5740
- - C:\Temp\qnhfcaxspn.exe
    C:\Temp\qnhfcaxspn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnhfcaxspn.exe ups_ins
  2⤵
  PID:6040
- - C:\Temp\i_qnhfcaxspn.exe
    C:\Temp\i_qnhfcaxspn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpnhfcxvp.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\xrpnhfcxvp.exe
    C:\Temp\xrpnhfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpnhfcxvp.exe ups_ins
  2⤵
  PID:6540
- - C:\Temp\i_xrpnhfcxvp.exe
    C:\Temp\i_xrpnhfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhecwuom.exe ups_run
  2⤵
  PID:6588
- - C:\Temp\smkhecwuom.exe
    C:\Temp\smkhecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhecwuom.exe ups_ins
  2⤵
  PID:4308
- - C:\Temp\i_smkhecwuom.exe
    C:\Temp\i_smkhecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebzuomgey.exe ups_run
  2⤵
  PID:804
- - C:\Temp\jebzuomgey.exe
    C:\Temp\jebzuomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebzuomgey.exe ups_ins
  2⤵
  PID:5696
- - C:\Temp\i_jebzuomgey.exe
    C:\Temp\i_jebzuomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbwtomgey.exe ups_run
  2⤵
  PID:4064
- - C:\Temp\jgbwtomgey.exe
    C:\Temp\jgbwtomgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbwtomgey.exe ups_ins
  2⤵
  PID:3468
- - C:\Temp\i_jgbwtomgey.exe
    C:\Temp\i_jgbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbwtoljdb.exe ups_run
  2⤵
  PID:6288
- - C:\Temp\gdbwtoljdb.exe
    C:\Temp\gdbwtoljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbwtoljdb.exe ups_ins
  2⤵
  PID:1084
- - C:\Temp\i_gdbwtoljdb.exe
    C:\Temp\i_gdbwtoljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlidbvt.exe ups_run
  2⤵
  PID:6516
- - C:\Temp\avtnlidbvt.exe
    C:\Temp\avtnlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlidbvt.exe ups_ins
  2⤵
  PID:5416
- - C:\Temp\i_avtnlidbvt.exe
    C:\Temp\i_avtnlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:880

C:\Temp\omgeywqojd.sys
C:\Temp\omgeywqojd.sys
1⤵
- Executes dropped EXE
PID:6272

C:\Temp\bvtnljdbvt.sys
C:\Temp\bvtnljdbvt.sys
1⤵
- Executes dropped EXE
PID:4724

C:\Temp\nlidavtnlf.sys
C:\Temp\nlidavtnlf.sys
1⤵
- Executes dropped EXE
PID:2036

C:\Temp\xvpnlidxvt.sys
C:\Temp\xvpnlidxvt.sys
1⤵
- Executes dropped EXE
PID:5044

C:\Temp\ifzxusmkhf.sys
C:\Temp\ifzxusmkhf.sys
1⤵
- Executes dropped EXE
PID:6288

C:\Temp\cxusmkecwu.sys
C:\Temp\cxusmkecwu.sys
1⤵
- Executes dropped EXE
PID:6136

C:\Temp\tromhecwuo.sys
C:\Temp\tromhecwuo.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\hbztrpjhec.sys
C:\Temp\hbztrpjhec.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\rljebwuolg.sys
C:\Temp\rljebwuolg.sys
1⤵
- Executes dropped EXE
PID:5460

C:\Temp\vtnlgdbvtn.sys
C:\Temp\vtnlgdbvtn.sys
1⤵
- Executes dropped EXE
PID:3700

C:\Temp\lfdavtnlig.sys
C:\Temp\lfdavtnlig.sys
1⤵
PID:3492

C:\Temp\nigayvqnif.sys
C:\Temp\nigayvqnif.sys
1⤵
PID:6076

C:\Temp\nlfcxvpnkf.sys
C:\Temp\nlfcxvpnkf.sys
1⤵
PID:5980

C:\Temp\xusmkfcaus.sys
C:\Temp\xusmkfcaus.sys
1⤵
PID:4224

C:\Temp\upmkecwupm.sys
C:\Temp\upmkecwupm.sys
1⤵
PID:6804

C:\Temp\uomkecwuom.sys
C:\Temp\uomkecwuom.sys
1⤵
PID:6164

C:\Temp\jgbztrljeb.sys
C:\Temp\jgbztrljeb.sys
1⤵
PID:2692

C:\Temp\igbywqojdb.sys
C:\Temp\igbywqojdb.sys
1⤵
PID:5680

C:\Temp\bvtnlidbyt.sys
C:\Temp\bvtnlidbyt.sys
1⤵
PID:6864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnljdbvt.sys

Path C:\Temp\bvtnljdbvt.sys
Size 141KB
SHA256 4f00894c12269cfcfad2e1e13aeab7d104caafd192578135d17ffbe44afd2e55
MD5 91b7ce9e557a3ecfaa708f7bbe97dd9c
SHA1 60b67746d9edeec643d1e438af9a1d2d21cf8dd3
SHA512 720e3e357b00dc06c2d734d397d6e8e1ca52bcfead25391f2be0191528227b93ce8a4960536078754a264abc4ae063feb4987f50f1f55655f0df2e160db15381
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxusmkecwu.sys

Path C:\Temp\cxusmkecwu.sys
Size 141KB
SHA256 cb1d2d1cd021692047485438a12db1b284e0656941b31eebf4f59c15f2611f6f
MD5 8ed2708c42e1aa43a6b530cdc9391955
SHA1 c1305839b01ab2ac653e29efb99df8b093482d01
SHA512 4cf81ce41728a153050a51c7e31e215d2a240274380d17fee9788f460a2102c17433aa9416b43748a191da917fd1296619ad196e6afd460da9398a9166ea92c5
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T18EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcausnkfa.exe

Path C:\Temp\i_kfcausnkfa.exe
Size 243KB
SHA256 c464dd9017be548d8ea3761d37d9e0a376011288a79c2e0c963cf5de6c584aeb
MD5 189d0d8c4b884b7685b60c027648f73b
SHA1 4c33d07ed3914fa3ae334e14b2f7f615937bde57
SHA512 91d0f316accefc60f7d97e27b70afee6dcae577916e5c749082ce62184ed9a79cd8fec70842efdf353601c1b72358fc2b8036bfe7a92f4e7cd48fd4512aed071
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:uvMsLaOa3lLNngoqRttA7F
TLSH
T167345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicxvpnhfz.exe

Path C:\Temp\i_kicxvpnhfz.exe
Size 243KB
SHA256 346ba13239d74b49e88382df5beae725900cef0aec137ed1844e15e384ab641e
MD5 1b463afd7c01e360138a0c254e1f8257
SHA1 c1b219f6063f7ba153b7fbe703d044eb40a85ff9
SHA512 483a672c166553346648c572320b8c178797165c3053142bba068518557861d3b51fb33e3388858b1cd600da89eb8891428d22525d0db698efb15d16f50bef22
SSDEEP 3072:/CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:KvMsLaOa3lLNngoqRttA71
TLSH
T1DD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlicaysqn.exe

Path C:\Temp\i_qnlicaysqn.exe
Size 243KB
SHA256 bd16777e91fa7014d0bd44bb19a1e260974da3d9a1ba2fe42c4304313988c5af
MD5 9b57cee37e44b4838e4a0c254afbbf12
SHA1 a1303bb797f8b54db9caf7f45f64777c9dfdc16b
SHA512 0c0a8e1affa2fda6b9ba281181fb7923b410945d0a953bd7ba1484907853ba73f09239efea078352ee1e63c7c8ccb027a19f81df738f862a6875d1c32f4fd58b
SSDEEP 3072:tCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:gvMsLaOa3lLNngoqRttA7/
TLSH
T1CA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqoi.exe

Path C:\Temp\i_tolgeywqoi.exe
Size 243KB
SHA256 4a511cf759e9df3b409bfeca341013ab80f76d5f2c6f5378c2d0fb4d61c5561e
MD5 93a59ea2be9c6b5bec4edee4ae438b3e
SHA1 fc4b3e27648b13e8e3013e02838ca474d535c88f
SHA512 00dc33848031c69a1203e5ce2f43b5a3f4067853e088812a2bf3503990b65f6101b7da2a28517c02073f42efde799458e9950a8d8f3a5ebfcea3fcd3f43f1bc7
SSDEEP 3072:3CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:SvMsLaOa3lLNngoqRttA7d
TLSH
T1C0345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrlgeywroj.exe

Path C:\Temp\i_wrlgeywroj.exe
Size 243KB
SHA256 bf3ff6e851b0d0c0f16892fdd571a53e45eefef78cc18a6f123717d54e626f7a
MD5 e65b3ee54616194a046ef40527d46202
SHA1 2ebb653731f70d890e0e13055d4c014c94506d23
SHA512 fa041af7d747ad09f7bbab2e52151e3ed41f3b3219142f1ed3fd6e8ed9196472c2ebd78988f2af9edb07ba6f44b5c4a488bb0d410483255834744dc89974c4bf
SSDEEP 3072:RCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:svMsLaOa3lLNngoqRttA7b
TLSH
T1AA345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnlgdbsq.exe

Path C:\Temp\i_yvqnlgdbsq.exe
Size 243KB
SHA256 052524a09f44e5758b7b760ff08a9191e0ee83ade201e8fa06fe404a01bc2983
MD5 b87e80409b727385a44474665cdd9663
SHA1 2dc34b8294c8ef476822eacf1f5c566d78905d66
SHA512 1fa2ae81a5d1e2b19aa70faa23ebbd9c2fc69eeb0da43237c27fb316cd7c20d7855dc30da546576def5a00498170c1e532a20b57eb950330ffd9d698e1fd955f
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:8vMsLaOa3lLNngoqRttA7/
TLSH
T120345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifzxusmkhf.sys

Path C:\Temp\ifzxusmkhf.sys
Size 141KB
SHA256 ed0495f03748fe694cbbd305416df98cb264362f1bdeec3c63422297c7dc0825
MD5 574810d3641163a595413e03274cb75d
SHA1 b4ca7f315dab35219cd8343334b1702281a0dc0a
SHA512 0d89cf90466f7804e09c7f95f19cb2ec303c5b08b94857359d3d09db32418d4bbd4005a98b2dce8344d344931447fb786c8ede363ab04efb474616d4aa3ff55f
SSDEEP 1536:za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10CE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcausnkfa.exe

Path C:\Temp\kfcausnkfa.exe
Size 243KB
SHA256 54d748f206bbbea1a674e03c5d241af73af4ae82561b137bcd185758afa1662c
MD5 5dadca966f32b8f11f538e05d363218d
SHA1 ccc65cc5da0ffc1f69461d47fca7a8acf5f961fc
SHA512 34eed5a87a39696fad8728e73393113075b125cf54ab0948303a5a0e4e6e9b617b6a161722abf290f3199b129e8939d3b69c13618a657404525c0d8b06ec4ac0
SSDEEP 3072:7CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:uvMsLaOa3lLNngoqRttA75
TLSH
T136345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicxvpnhfz.exe

Path C:\Temp\kicxvpnhfz.exe
Size 243KB
SHA256 099d805e354ff28930df6426069efd410d303f0f920d286b806ba29367f192f7
MD5 9813e03618317bee4cd05366b9ae6f7e
SHA1 46aeb29b8309a9ff5abd56f33aa777fd6e32109f
SHA512 c3225c6af1f15e388274c04903acfb35a39f14bb81fc72d1749f76826e92ce93ba986d934dbed8be9dc16e471b142b776db50c9cf862b55e9cda1f675f223617
SSDEEP 3072:gCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:bvMsLaOa3lLNngoqRttA7K
TLSH
T197345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidavtnlf.sys

Path C:\Temp\nlidavtnlf.sys
Size 141KB
SHA256 a0773ff13aa845501216047c898b82d22e3c377587f45821f58a7ba8392c4899
MD5 531928c93b735e721c9063b3c7e17e7f
SHA1 d2f449a7dda0eeed4b7060d42b4bf417e7938037
SHA512 23b16894718593f59dd00317a0923fab880c626d99f55c90ab640c6ab8b0a38706f4adb4ce45aa2189f19daa3d47009a0e68a34af1de73fb6adfb6cdc76ed698
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F6E37C12B292D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojd.sys

Path C:\Temp\omgeywqojd.sys
Size 141KB
SHA256 3e96444e651e62ed003f1f4e0182d93ff351a30163c703dc6113dcf0f9f22bf6
MD5 ef0e93ec8e0502fc7d0c787310aec579
SHA1 4d81c14a7922dfbbaeb19732be630a6a1699b3ca
SHA512 f06d1df370a080a029e495f29bdf2ea8e04ef629dcc3024db5649f360faf1d394d95322b5ebb0ccca062f0a20882cb3d4b8a62fe8f6ee1485b3bd51c930deafa
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlicaysqn.exe

Path C:\Temp\qnlicaysqn.exe
Size 243KB
SHA256 82e4c9743dbe449cf7eeb3da61d83c3fcfb038da6f5db5871586e225dee0b675
MD5 c901c4a2b8a9e949f7459991ffa03257
SHA1 4d87966613c2675d15ddd5ff717f4a03345e3994
SHA512 873b4915d1720d08329959d7c901a388b8c763ea5ad7520f61cefd8f4384c74e76efb94b332c04d08de63a94f17049e5f08458ade88926019a9a93f31ed4ec77
SSDEEP 3072:kCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7O:3vMsLaOa3lLNngoqRttA7O
TLSH
T1D9345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoi.exe

Path C:\Temp\tolgeywqoi.exe
Size 243KB
SHA256 37dd80b38423d701aec6a55d4417b09ccca4d5b8d0d29a458e3177f9fb607f74
MD5 2de4624bb498e9a9b44a973a6a837c51
SHA1 9a4229bd5861b3bb3e1d83f3d459c7904697ff84
SHA512 512ec2d2804e7f2696246bef9f7c44e773e2d5f75b0d16245a8543db9d9f95f710e99729dcd36996efd20a16f4aa6e17a8f9ae91727d0d66a003bd3793700ee2
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7d:mvMsLaOa3lLNngoqRttA7d
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrlgeywroj.exe

Path C:\Temp\wrlgeywroj.exe
Size 243KB
SHA256 1876eae608fdec9fd9b17e7bc6ccc020ddda6348bd6ac251088fc43b689234b4
MD5 90da3416cf18e9864537e5d37a786cb7
SHA1 fb421fcfd80d97f475e786aec5cc3aae02878953
SHA512 1994bc75f82e2b49a17b356866bbd653b20ec988066714dbb9bd2ab6bf3d7e5c88260ebcbfd18681b808151a317ee8a8831c167bd4648892d1f61844884facdd
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:1vMsLaOa3lLNngoqRttA7k
TLSH
T194345A017281C031E7160B78045AE7A1467EBC384BA9E5CFF7683B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnlidxvt.sys

Path C:\Temp\xvpnlidxvt.sys
Size 141KB
SHA256 6a9622aaa101c66a57ebfa62697acda37a594c8e9a6a2007381541718f54d291
MD5 fe4e18acbb5f2afd48f5d1e41b60f5d4
SHA1 94708dfc2275a75d24966e52a58254205ac06af3
SHA512 7eb1a4732bed71164bca5f5349f03c857035adb7239ccbe374c1d8d280c358d8e234d1a862f2565e3041b4c9a520941ebddd97bde619dd546f239b9f8c59be20
SSDEEP 1536:oa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:oa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnlgdbsq.exe

Path C:\Temp\yvqnlgdbsq.exe
Size 243KB
SHA256 5333034c08687760876ccc56dd231844c9ccec0d309b264fad3ccd001b34d01a
MD5 066ec6ee8579fd37c921d06868a738e8
SHA1 5b991c475454a4fe07d4097fed11c81773895ad9
SHA512 515f8439a866bee435cf5ba077bb1fbeda46f142c06975b1ff3b23c0c35dd6fd5497ea6f51f3e65377b0fb2d718ea908bf493d9bb154eebe5a764b706a928aa7
SSDEEP 3072:OCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:BvMsLaOa3lLNngoqRttA7c
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 274e494cf30ce5517e7a86e343a70b2c4a6c2ae6cd7723c411cfde2fad44bc15
MD5 2d9504d51b83648ae8008f5c5b10fb26
SHA1 80a3416eee2b0c828d41b208891ee0c23a451bb8
SHA512 10f7d6f35da944e86244a230daa9a03534f48cee89144b179cd63e5328b01a53968d35d3e1976cfb41c050c1a4eb18d636cdd5531138a92bd2fd4d0b3bcff93c
TLSH
T19AF02DA6D861FC3719FC1B1870A44B47FB50136B3B41989B3B3C821C4FB063B464691C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 973ba965b652f934283de4ad4c00b30b286799e0998e22f7543fb94f87d597d5
MD5 bf7c4e1b3e05ef0869cc4c9d193dc2af
SHA1 1a4bfabad93b8578a3d5801817ed8018f2807dee
SHA512 3e698273694349261e7005032e44d98620299655351f10d43361f54a968a511902a962b9d646773ed0b702b95e912f6d75be561b02aabecb7c7ee9a68d24fe34
TLSH
T11C519EF7C3E8856D891195F0AB18BE1BCE2D0954832C3D9AC9E4EE1B93E3471D181A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1fd57732ad274fc7c58c0418fa97950ca91ce37699c9b6515cc97392b73c671f
MD5 106c2e4ffa6d7dba5937b2d6dca1e852
SHA1 d7d3b318e5bf3cf145cf2a811b6eb70cac5b7d5d
SHA512 14596781083326008e42d1b4911d959623db3d384ef3600c7c5dc311739c2538c0025231c120e668f1792ea36d2ffe822ed3d28f1b4a3f0e27cf265015f6db76
SSDEEP 384:sxRlp8I/fCsb4N/RIrC1/5a/WJ4sGQgbjp:sxmI/fZiWY/5gWJ4sGQg5
TLSH
T1E272E919AA248D7B8CDBD219FA957F53D6F8117391905E44AAFCCB0C14D67DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2e8c414256a9c3f9bc503255f71c2811200f7b1c1efcc8a1d44f9cf2a48b4537
MD5 84642955ef347bacbc21fca717f8f6b4
SHA1 0eb46994ae0f84fa5cd6bb42d9639894a2189423
SHA512 3c38b33d9975122b9a5891514e0b268c37375431c351d32242ebef9e2dfc483efb8a604c3e798f6231e1e6b9fc6c14fc143b1ee045fa5dc533c76cd6d215649d
SSDEEP 384:sxRlpqFI/fCsY5N/RIrC1/5a/WJ/sGQgbVRi:sxwFI/fKbWY/5gWJ/sGQgxI
TLSH
T16D72E91AAA288D7B8CDBD219FA957F53D6F8113391505E44AAFCCB0C14E67DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ea9f290a1135c9ec1a979a33ae182b21ee12c0eb907e77c4ce112a94e309afda
MD5 fd9c65853d1aac6556af2c49296021d9
SHA1 e134c9f4c99fd8e5fd4da5304f62f188b85aa0fa
SHA512 64e46aab7215456c1d79d1f3fcf480bae99b24c5ed497b4cf3168bd5d1e458d8817158204e7e8818e73b58209621750923cab0b78a4d265dbd63fd573a62e98c
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZobbDwzrol4F:Ob4YZnE7yTWg1NfwBu1jaCobHwAaF
TLSH
T1CCE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 969da30f9f32fa1937420848d04b100befc62e43fca2ab1a6238f066ffbb04cc
MD5 412ef89200e21304b4c9f2da7f06678a
SHA1 2c08380dcffbc74e20e18f348d344524ea62e52d
SHA512 1128576a2c9bf02ed96018acbf514c8ccba96b29385f531c733e78cdc803271b82beb2e03b02234516db48b1219cae94c7edd27b4d2e3b6958bbf23def20f92b
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9PLf:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRq
TLSH
T1E4B25C51753F4680383EB90C91B8D82F86C2B4637519E52F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 53bc47a68b6db74d2e3a457d31dfe9b0953d4ee8aa1254f5a18818bed770cade
MD5 dff8d83da1b363006d277c9c8a94b935
SHA1 af1adb17a2b35ead4b747ba9c39dcb0f69b50c0d
SHA512 d21dfcf8c24f9e4e6ab8fdd346f09f6a79c2073f7c07350884d44e156d80bb3b59d490170ffa1bc702c0228c947838d3b38a69e7a86badab3ae5ff73cc7c1c61
SSDEEP 384:nyiFiZcI38NLW8TUNTUlIRnPvuTNYWEqfbzGYrUCzVwp+F2Q0OObjI9G6w708LES:5FQ3QWwgJu2kGoFzV8et029MT
TLSH
T106D25C32DC54CAB7ECEA8F94B74A7646EEE05167C59C8AC8E6D89E0C00D759D070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1c140e34e8c540cb6a6cf65e386c7bd9a93c4ae3b311313d89e6ea779efd6dba
MD5 5c6ace3f3d3be2d970a007ee25e364bc
SHA1 9abfb4add492059462008343dd2333cbd3e40886
SHA512 4459d1da88004a64e7e6099dbb98f41791f13bff01a074ca3d09421ec2da8001d6efb9c8414d556c21f4e35664402df68c0d2e5c9d242d3b4f668f5dbee58954
SSDEEP 384:n3iF1tNn/s3n9Sn8Ngo8TUNTUlIRiPvuTujREqfbzGYrUCzVSxLdOObjI9G6w70S:yF1j+9SXowgUu8XGoFzVStd29M0S
TLSH
T116C25B32DC55CEB7EDEA4FD8B74A3A56EEE0126785DC5AC4DAC85E4C00C719D430781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6134ba37c2352689bf48ea44436fe502c4ba9ba881ffe2c4b342a2097a3d4d42
MD5 b3543d2c73c9f51f8faf43376c7fbc93
SHA1 284f777e3760cc81b6fc0dc4dc3fd698d66fdaba
SHA512 fae581c2dfdbfbcc51d4279cc546081059b37bfbc54226d6b7833b1948fe3822d7d9f825c4e611c89f9680ff7822d6fcbadd7cb4655fd04bf430ded16b3d308f
SSDEEP 384:nOiFiZcIz8NLW8TUNTUlIRnPvuTSYWEqfbzGYrUCzVwp+F2Q0OObjI9G6w708LES:lFQzQWwgJuLkGoFzV8et029MT
TLSH
T184D25D32DC54CEB7ECEA8F94B74A7646EEE05163C5DC4AC8E6D89E0C008719D070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 9f0711be532b2b42fbe5f05f4b177aad165b99c4be00da64d0298a58f5328858
MD5 ea922ef8bad1bbbdb5245b796479962c
SHA1 3df27c6cc6cc150c00d5c9775a83c445dd4b1d59
SHA512 c0813d3c396a98acbe8ec5b14084f4cded17c228ab0ca792cc6a231ab78816bd3e3af76cf9f9f9b78e6163648f8afbc76f2b0bf5c3ae65db4c50afd8f2a7b689
SSDEEP 384:n2iFiZcIk8NLW8TUNTUlIRnPvuTN9WEqfbzGYrUCzVwp+FxY0OObjI9G6w708LES:dFQkQWwgJuLkGoFzV8ee029MT
TLSH
T111F2C2F198D78972D8AE4B97677D2D459EFCD123B5884A84B7C85E0CCC821BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a364feb7db7367a83c9f19d9cf76bbdf828aba432a0125634e66ab5cef463abc
MD5 a5f3ed58cdb1c0771af540572a6c9f62
SHA1 441c96dfaab6d79b5cf3f5ad109d1039c6258792
SHA512 7f780e812093b170b3029fe8c3b5a9568371cca003ce32d1c9da9a195ddc05648597484cf41864391d3060014f5b2f5fdcc033793a0c1cd68c91a87dc659fb24
TLSH
T1C45122E08C381AD1D4FD1A7E748B34EC95E8C726F490343D6858DA885A7A75D618083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bd77b3791b0afb302322bb6b3d45be357a1dc77013739ed317510224b6f892dd
MD5 fe3d4c3de478ac1a35e3c9c781c60823
SHA1 c2d4a1cf4c0e3fb87aadfa2476bb4e2611c8837f
SHA512 fb0bd25d25eb47d93e7aefff3a52a92fff53012dad8645e8071ba2898db1ef8b9f5350584058ce3d401e3dab78f60498f7d6ba7e0bc9a644cad8dd91e5b7982c
TLSH
T1BF5132E18C381AD1D4BD1A7FB48B34EC95E8C726F590343E7858DA885A7A75D618083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3bfc1b674a1437f1b45ccf4e3f169ed610b348a0b3cea8edb7c7d3f7d6e6394
MD5 2eefcf1a4944e5dada5693f247684a1c
SHA1 95356de99e075658306cc15d8dca555f524de3df
SHA512 d4fc36dd153a0e9ce32c258b9fb8d55df01436a05ab751d030ae089429f103e3043e68cbf960dd9fbda60d5b555c99889a165cfecf80c7cbeb064204e4fc7852
TLSH
T1DB511EE09C381AD1D4BD0E7EB48B38EC96E8C725F49034396858EA985A7A75D258083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5792_969979957\edge_checkout_page_validator.js
Size 1016KB
SHA256 86208bb3500717034023380e5d9e9c3c0ebfe3cd5adfad3963b9796f3765efc6
MD5 b9f59640dff40afd5a815660d7547e3b
SHA1 0e47c4972840a7ca2aaec3bf75bccde7b206ed6c
SHA512 421cdc2761dd29c581e8676f075123352c09eb0781a28943d09c653580ba69a207cae674a6e300d6a1ddc26c6f52c55d972b669248f902276557f89429acf639
SSDEEP 24576:c14wmRAbskvG7kVKApnuQ+N4aETI/VMXK4/0YMtQZ8O9vaRS/vzHEiJsfamM1A9n:c14wmRAgkvG7kVKApnuQ+N4aETI/VMXM
TLSH
T19F252B84E1E2253466D748B960B7D2C4B5DC04583399F1E8FA6C68CADB0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2036-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2692-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2692-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-567-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3700-535-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4652-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4652-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4724-175-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5044-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5044-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-518-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-536-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6076-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6136-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6164-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6272-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6288-462-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6804-585-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6864-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download