778976110d59bc415adeb014c448c552f7ca78c604649a73981b11f50d4d9908

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260530-ssamwagy6w
SHA256 778976110d59bc415adeb014c448c552f7ca78c604649a73981b11f50d4d9908
MD5 d30196dde83f09c75ac406dfddcb9887
SHA1 06ab63d28f98e1458951b530da6caaac11911a2f
SHA512 3cb5a92daecd42f96e882f06b21beefd1f7b7028938af73a21967448d811ffc7dc1fb74285d574f252933ddaa92b68c64521ca378f9b3c190d624d2c518aedd0
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T16034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3952	CP.exe
4476	ywqoigaytq.exe
3848	CP.exe
5116	CP.exe
4624	i_ywqoigaytq.exe
3228	gdyvqoigay.sys
3036	CP.exe
4468	ytnlfdyvqo.exe
2056	CP.exe
3228	CP.exe
4632	i_ytnlfdyvqo.exe
4180	snlfavtnkf.sys
4576	CP.exe
1580	ifavsnkida.exe
5056	CP.exe
4236	CP.exe
4964	i_ifavsnkida.exe
3484	icavsnifdx.sys
1732	CP.exe
3612	snkfdxvpnh.exe
3844	CP.exe
4696	CP.exe
4940	i_snkfdxvpnh.exe
3004	nhfzxspkic.sys
1680	CP.exe
2284	cxvpnhcxus.exe
1768	CP.exe
4308	CP.exe
3768	i_cxvpnhcxus.exe
1168	jhczupmhez.sys
4548	CP.exe
4056	zxrpjhczus.exe
1720	CP.exe
4108	CP.exe
4520	i_zxrpjhczus.exe
2368	rpjhbzurmj.sys
4764	CP.exe
1980	jezwrojhbz.exe
2452	CP.exe
2428	CP.exe
4440	i_jezwrojhbz.exe
1180	mgbztrljet.sys
1676	CP.exe
4668	rljdbwtomg.exe
616	CP.exe
868	CP.exe
788	i_rljdbwtomg.exe
4940	trljdbvtol.sys
3028	CP.exe
1504	igbytjdbvt.exe
3432	CP.exe
4364	CP.exe
3884	i_igbytjdbvt.exe
3616	wqlidbvtni.sys
2576	CP.exe
772	lgdywqoiga.exe
4232	CP.exe
2520	CP.exe
4672	i_lgdywqoiga.exe
3136	avsnlfdysq.sys
4780	CP.exe
4020	nifaysqkic.exe
1180	CP.exe
4984	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1906473519\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1572457514\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1577722910\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1906473519\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_174136938\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_174136938\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1577722910\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1906473519\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupkhcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytjdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupkhcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jezwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifavsnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytjdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifavsnkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jezwrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1920	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4668	ipconfig.exe
3452	ipconfig.exe
2376	ipconfig.exe
392	ipconfig.exe
4564	ipconfig.exe
4896	ipconfig.exe
4948	ipconfig.exe
5108	ipconfig.exe
4864	ipconfig.exe
1272	ipconfig.exe
4552	ipconfig.exe
488	ipconfig.exe
2900	ipconfig.exe
2288	ipconfig.exe
4984	ipconfig.exe
2540	ipconfig.exe
1996	ipconfig.exe
4448	ipconfig.exe
4716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3195379930"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134246282037678486"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{0C9EBE92-D609-4CCE-A536-690232C28204}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	i_ywqoigaytq.exe
Token: SeDebugPrivilege	4632	i_ytnlfdyvqo.exe
Token: SeDebugPrivilege	4964	i_ifavsnkida.exe
Token: SeDebugPrivilege	4940	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	3768	i_cxvpnhcxus.exe
Token: SeDebugPrivilege	4520	i_zxrpjhczus.exe
Token: SeDebugPrivilege	4440	i_jezwrojhbz.exe
Token: SeDebugPrivilege	788	i_rljdbwtomg.exe
Token: SeDebugPrivilege	3884	i_igbytjdbvt.exe
Token: SeDebugPrivilege	4672	i_lgdywqoiga.exe
Token: SeDebugPrivilege	3188	i_nifaysqkic.exe
Token: SeDebugPrivilege	5016	i_xspkicausm.exe
Token: SeDebugPrivilege	4884	i_fzxupkhcwu.exe
Token: SeDebugPrivilege	2448	i_usmkecxupn.exe
Token: SeDebugPrivilege	4760	i_ztrmjecwuo.exe
Token: SeDebugPrivilege	488	i_jhbztrljeb.exe
Token: SeDebugPrivilege	392	i_toigdywqoi.exe
Token: SeDebugPrivilege	5072	i_igaywqoiga.exe
Token: SeDebugPrivilege	1900	i_qkidavsnli.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3676	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	82
PID 3676 wrote to memory of 2296	3676	iexplore.exe	83
PID 2296 wrote to memory of 3096	2296	msedge.exe	84
PID 2296 wrote to memory of 1920	2296	msedge.exe	85
PID 2296 wrote to memory of 1924	2296	msedge.exe	86
PID 2296 wrote to memory of 1924	2296	msedge.exe	86
PID 2296 wrote to memory of 1924	2296	msedge.exe	86
PID 2296 wrote to memory of 4484	2296	msedge.exe	87
PID 2296 wrote to memory of 4484	2296	msedge.exe	87
PID 2296 wrote to memory of 4048	2296	msedge.exe	89
PID 2296 wrote to memory of 4048	2296	msedge.exe	89
PID 2296 wrote to memory of 4048	2296	msedge.exe	89
PID 2296 wrote to memory of 2204	2296	msedge.exe	90
PID 2296 wrote to memory of 2204	2296	msedge.exe	90
PID 2296 wrote to memory of 2204	2296	msedge.exe	90
PID 2296 wrote to memory of 1948	2296	msedge.exe	92
PID 2296 wrote to memory of 1948	2296	msedge.exe	92
PID 2296 wrote to memory of 1948	2296	msedge.exe	92
PID 2296 wrote to memory of 2200	2296	msedge.exe	93
PID 2296 wrote to memory of 4544	2296	msedge.exe	94
PID 2296 wrote to memory of 3280	2296	msedge.exe	95
PID 2296 wrote to memory of 2200	2296	msedge.exe	93
PID 2296 wrote to memory of 2200	2296	msedge.exe	93
PID 2296 wrote to memory of 4544	2296	msedge.exe	94
PID 2296 wrote to memory of 4544	2296	msedge.exe	94
PID 2296 wrote to memory of 3280	2296	msedge.exe	95
PID 2296 wrote to memory of 3280	2296	msedge.exe	95
PID 2296 wrote to memory of 3160	2296	msedge.exe	96
PID 2296 wrote to memory of 3160	2296	msedge.exe	96
PID 2296 wrote to memory of 3912	2296	msedge.exe	99
PID 2296 wrote to memory of 3912	2296	msedge.exe	99
PID 2296 wrote to memory of 4400	2296	msedge.exe	100
PID 2296 wrote to memory of 4364	2296	msedge.exe	101
PID 2296 wrote to memory of 4400	2296	msedge.exe	100
PID 2296 wrote to memory of 4364	2296	msedge.exe	101
PID 2296 wrote to memory of 4896	2296	msedge.exe	103
PID 4404 wrote to memory of 3952	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 2296 wrote to memory of 2548	2296	msedge.exe	106
PID 2548 wrote to memory of 3844	2548	msedge.exe	107
PID 4476 wrote to memory of 3848	4476	ywqoigaytq.exe	109
PID 2296 wrote to memory of 4044	2296	msedge.exe	112
PID 2296 wrote to memory of 4044	2296	msedge.exe	112
PID 2296 wrote to memory of 236	2296	msedge.exe	113
PID 2296 wrote to memory of 236	2296	msedge.exe	113
PID 2296 wrote to memory of 2508	2296	msedge.exe	114
PID 2296 wrote to memory of 2508	2296	msedge.exe	114
PID 2296 wrote to memory of 4564	2296	msedge.exe	115
PID 2296 wrote to memory of 4564	2296	msedge.exe	115
PID 2296 wrote to memory of 4864	2296	msedge.exe	116
PID 2296 wrote to memory of 4864	2296	msedge.exe	116
PID 4404 wrote to memory of 5116	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4404 wrote to memory of 3036	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4468 wrote to memory of 2056	4468	ytnlfdyvqo.exe	123
PID 4404 wrote to memory of 3228	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4404 wrote to memory of 4576	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 1580 wrote to memory of 5056	1580	ifavsnkida.exe	132
PID 4404 wrote to memory of 4236	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4404 wrote to memory of 1732	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 3612 wrote to memory of 3844	3612	snkfdxvpnh.exe	141
PID 4404 wrote to memory of 4696	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 2296 wrote to memory of 3280	2296	msedge.exe	146
PID 2296 wrote to memory of 1832	2296	msedge.exe	147
PID 2296 wrote to memory of 2544	2296	msedge.exe	148
PID 4404 wrote to memory of 1680	4404	2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe	151

C:\Users\Admin\AppData\Local\Temp\2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_d30196dde83f09c75ac406dfddcb9887_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9f2dbc188,0x7ff9f2dbc194,0x7ff9f2dbc1a0
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1664,i,17142752194156321596,15374616708082989460,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
      4⤵
      System Time Discovery
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,11130305297357055680,15961721910640969410,262144 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,967179587534636668,6582036218031808249,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,7737315233491156547,10580504763002092684,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,15916549445970632192,18021490225203160973,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,11212854239360814490,13420489319235061895,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,16173053639110526561,10271952483657916420,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,18133495626626778978,11516083949249260108,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4340,i,17933517251717046621,4000801761260170205,2097152 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2500713499228179358,16940536343319670638,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,6993684012939253072,440648534408870630,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,5873008831306624814,17351628898008555207,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17455343868083125502,17872863584036881928,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14933577429579359533,14726693212495787614,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,14933577429579359533,14726693212495787614,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,10249850164892562485,4670393879277805576,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2107862958910264588,10264464245212499863,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,8833298126714206088,17586168585861744699,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,15696751659249905229,17400038264251693746,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,3581473246649833377,6036006690616665343,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,14787442478052737231,8802567166778758553,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,15212001953531257035,16694863477160036370,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,10092402003454786362,1309272782961071997,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,8493262259838418149,6159272463974221376,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,11097603878657413225,17444008659969707762,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,1557306510131138049,669090589392965685,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,2727813846804248383,5831593269902489416,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:14
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,18025861568720659075,3172883352348278117,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,8980907302725432729,25093446460575603,262144 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,10175914515749475541,5276543458187865320,524288 --field-trial-handle=2160,i,17254870263543727580,15966744705610568533,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:5060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3952
- - C:\Temp\ywqoigaytq.exe
    C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\i_ywqoigaytq.exe
    C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlfdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Temp\ytnlfdyvqo.exe
    C:\Temp\ytnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytnlfdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3228
- - C:\Temp\i_ytnlfdyvqo.exe
    C:\Temp\i_ytnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifavsnkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\ifavsnkida.exe
    C:\Temp\ifavsnkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifavsnkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4236
- - C:\Temp\i_ifavsnkida.exe
    C:\Temp\i_ifavsnkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1732
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxvpnhcxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\cxvpnhcxus.exe
    C:\Temp\cxvpnhcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxvpnhcxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\i_cxvpnhcxus.exe
    C:\Temp\i_cxvpnhcxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jezwrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4764
- - C:\Temp\jezwrojhbz.exe
    C:\Temp\jezwrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jezwrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Temp\i_jezwrojhbz.exe
    C:\Temp\i_jezwrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1676
- - C:\Temp\rljdbwtomg.exe
    C:\Temp\rljdbwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\i_rljdbwtomg.exe
    C:\Temp\i_rljdbwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytjdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Temp\igbytjdbvt.exe
    C:\Temp\igbytjdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytjdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4364
- - C:\Temp\i_igbytjdbvt.exe
    C:\Temp\i_igbytjdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2576
- - C:\Temp\lgdywqoiga.exe
    C:\Temp\lgdywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2520
- - C:\Temp\i_lgdywqoiga.exe
    C:\Temp\i_lgdywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nifaysqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Temp\nifaysqkic.exe
    C:\Temp\nifaysqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nifaysqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4984
- - C:\Temp\i_nifaysqkic.exe
    C:\Temp\i_nifaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicausm.exe ups_run
  2⤵
  PID:3980
- - C:\Temp\xspkicausm.exe
    C:\Temp\xspkicausm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicausm.exe ups_ins
  2⤵
  PID:3316
- - C:\Temp\i_xspkicausm.exe
    C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxupkhcwu.exe ups_run
  2⤵
  PID:2508
- - C:\Temp\fzxupkhcwu.exe
    C:\Temp\fzxupkhcwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxupkhcwu.exe ups_ins
  2⤵
  PID:1312
- - C:\Temp\i_fzxupkhcwu.exe
    C:\Temp\i_fzxupkhcwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  PID:804
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins
  2⤵
  PID:4004
- - C:\Temp\i_usmkecxupn.exe
    C:\Temp\i_usmkecxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjecwuo.exe ups_run
  2⤵
  PID:2884
- - C:\Temp\ztrmjecwuo.exe
    C:\Temp\ztrmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjecwuo.exe ups_ins
  2⤵
  PID:4704
- - C:\Temp\i_ztrmjecwuo.exe
    C:\Temp\i_ztrmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrljeb.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\jhbztrljeb.exe
    C:\Temp\jhbztrljeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrljeb.exe ups_ins
  2⤵
  PID:4716
- - C:\Temp\i_jhbztrljeb.exe
    C:\Temp\i_jhbztrljeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toigdywqoi.exe ups_run
  2⤵
  PID:2264
- - C:\Temp\toigdywqoi.exe
    C:\Temp\toigdywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toigdywqoi.exe ups_ins
  2⤵
  PID:3456
- - C:\Temp\i_toigdywqoi.exe
    C:\Temp\i_toigdywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqoiga.exe ups_run
  2⤵
  PID:1232
- - C:\Temp\igaywqoiga.exe
    C:\Temp\igaywqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqoiga.exe ups_ins
  2⤵
  PID:3440
- - C:\Temp\i_igaywqoiga.exe
    C:\Temp\i_igaywqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsnli.exe ups_run
  2⤵
  PID:2024
- - C:\Temp\qkidavsnli.exe
    C:\Temp\qkidavsnli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsnli.exe ups_ins
  2⤵
  PID:4488
- - C:\Temp\i_qkidavsnli.exe
    C:\Temp\i_qkidavsnli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1980

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:3228

C:\Temp\snlfavtnkf.sys
C:\Temp\snlfavtnkf.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\icavsnifdx.sys
C:\Temp\icavsnifdx.sys
1⤵
- Executes dropped EXE
PID:3484

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
- Executes dropped EXE
PID:3004

C:\Temp\jhczupmhez.sys
C:\Temp\jhczupmhez.sys
1⤵
- Executes dropped EXE
PID:1168

C:\Temp\rpjhbzurmj.sys
C:\Temp\rpjhbzurmj.sys
1⤵
- Executes dropped EXE
PID:2368

C:\Temp\mgbztrljet.sys
C:\Temp\mgbztrljet.sys
1⤵
- Executes dropped EXE
PID:1180

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4940

C:\Temp\wqlidbvtni.sys
C:\Temp\wqlidbvtni.sys
1⤵
- Executes dropped EXE
PID:3616

C:\Temp\avsnlfdysq.sys
C:\Temp\avsnlfdysq.sys
1⤵
- Executes dropped EXE
PID:3136

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:1892

C:\Temp\xsqkhcausm.sys
C:\Temp\xsqkhcausm.sys
1⤵
PID:3616

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:1052

C:\Temp\kecwuomhbz.sys
C:\Temp\kecwuomhbz.sys
1⤵
PID:4080

C:\Temp\rljhbztrlj.sys
C:\Temp\rljhbztrlj.sys
1⤵
PID:3572

C:\Temp\jdbwtomgey.sys
C:\Temp\jdbwtomgey.sys
1⤵
PID:1792

C:\Temp\wqljdbvtol.sys
C:\Temp\wqljdbvtol.sys
1⤵
PID:700

C:\Temp\bvtnlfdyvq.sys
C:\Temp\bvtnlfdyvq.sys
1⤵
PID:3088

C:\Temp\nifausqkfc.sys
C:\Temp\nifausqkfc.sys
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhcxus.exe

Path C:\Temp\cxvpnhcxus.exe
Size 226KB
SHA256 b5f41b78634e6b4dba25b7382bf74482fcf716f3c778b3b03ebd419bab520289
MD5 f40cfd9931da22100b09229bb23f5e3d
SHA1 cb9a4f1001f4bc2c19e3291938126e729f5ff038
SHA512 ff2dfdf7596fdf35df71b9c4fc8cd385ece25886a47f607bf6573f33288d55558adbc77316fc6b169619eca4845c1cc0603d45c084abe43520be57ec956a074e
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.sys

Path C:\Temp\gdyvqoigay.sys
Size 141KB
SHA256 2764764e1eceba9b0872ef95171e4d421d9aa1a9249552730e3b2a6099146f2f
MD5 5e8b82873af5ed33e44454641e376229
SHA1 b18804025e9c3ed0e72ae52124131c7c51b3b4b1
SHA512 78c0f2fae0300c6e8a9dc06f0226ef99ec85e461758668ca03e4b66f049e9410e4ae077eeffc8dd66719040e3fcc4a30429627db0bbed92a18aed801f61e513d
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhcxus.exe

Path C:\Temp\i_cxvpnhcxus.exe
Size 226KB
SHA256 bd965f60b69952e4b346c73e4979492ff9d9bef36fbc2d745ace13846ee16e90
MD5 f73ce0dea4a0a41260eedab4b5b3b2bd
SHA1 bc3d191a3cd3478b97a2ac8c869bf392662eeddf
SHA512 90ee6c56c99267cb6aa56bbdce4ed50e54b2a81f6e229de5a0a9919b25d2167fbb7a36f9fded34ab1e423cabf1394d43132c5365cb42d157d8e35668a96628c3
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T12C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifavsnkida.exe

Path C:\Temp\i_ifavsnkida.exe
Size 226KB
SHA256 823122b9c3cf161266dde5fb861561fa6ef2848c0474b6c2afb77a70905f2bbe
MD5 9e9ed303dcdd11e13de2962526565acf
SHA1 d9459c558fe0eb4c000aea26b14de35dccc02fbe
SHA512 bf73d0c3cf56bd059b3c8378327dcfd7d26314afff650000136f2e91104831242074bd79853bf919de667b1011affcb2fc477d5a8fbd225582ce48b15b3f41f7
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1C534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpnh.exe

Path C:\Temp\i_snkfdxvpnh.exe
Size 226KB
SHA256 24cb8ffcc6ef377a45d3b3af490050fffb3d737bb16fde251faa8f0f7ecf46b4
MD5 6a5960db115ab426a8bcf2fad218f78c
SHA1 6323c269f492b4e51c32920c0aa888170d266042
SHA512 cfa58cdc9d0b403ce042c4c9b7862c8896ed00c5f71ca7f29c5fbb003d53c786386dd8e88f4710bed4f1d8a401a50f2ca399a113da29f1f21e081eed950eb4de
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytnlfdyvqo.exe

Path C:\Temp\i_ytnlfdyvqo.exe
Size 226KB
SHA256 a3c4075c78c240ecc810fda7e24a5a451513eadf9048f16d6ca5c481ebc41bfd
MD5 1ba91d6764f807717273fba83b7012ab
SHA1 f86ddc31e7a16f28b6eeb274634cc4d312551dfd
SHA512 a2f88e01232b46f888e87a04de51f2f7078bc9babed7f2cd8553a34d5bc15081011d2ba7efd3b7bbaec37a4b0a04655b020bbf95881067181759cb643bf3eefe
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigaytq.exe

Path C:\Temp\i_ywqoigaytq.exe
Size 226KB
SHA256 aad34633ff091f708b21762ea8a8c3c1d20c66f287e40e7242bebfb9fd4814e6
MD5 980ac357f3ce3d68fc30fe840c5b0fea
SHA1 d6dc5263be9b1cef05fa5b870fdb90f97679c6ae
SHA512 5e8994c0f5a5efbcc8851623fc5be778cacd6be0a92973e563f697c94bdd7813a5543b5262b658b6fb2f008ef86c51dcfdf98bed9688761a2d96020ccd745bfe
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T12E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnifdx.sys

Path C:\Temp\icavsnifdx.sys
Size 141KB
SHA256 f9aaf9526d3d3974c97bbf833506d9354f76d42162d1f6dac740f6b845f40bee
MD5 339e354e25391c764bb800e43019e614
SHA1 8dce380fc96bab5ede013fd8b8b7f5202e502543
SHA512 7f4c51ea97c9ad852eed46a516e42b5e9814d972d0356593109a03c347b525e4050f32616844d8dacb84cf97f57f6e69f9fb2f926525a47841df94f381c1eb41
SSDEEP 1536:ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F4E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifavsnkida.exe

Path C:\Temp\ifavsnkida.exe
Size 226KB
SHA256 67061e722f41ba52eb7558ec7aa312bc076fc5f610064722cbdceb879975e4b5
MD5 1a02e9adb5981e1ad6d47011d7590680
SHA1 ac203d1975a8d57b05e3d6c5b11c78da52a212c7
SHA512 92929c6137d7db55c23750b4dd899304b23fe7afaf8ef641ac32274578fbaf030b92c096350573a01fb050c9a53adf40823de7911d05111e59aa3aa344242858
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T1E634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczupmhez.sys

Path C:\Temp\jhczupmhez.sys
Size 141KB
SHA256 d8d7e3d5dbb522f32065df8f889aa3818f6af8792b1568c8464afc11713d0276
MD5 fe2d506c13d8a8c41cc63f82aac65bc5
SHA1 cdcc5c6bf42c78e586d22b6bdd5247a9e947b579
SHA512 452b2e2febe1a68b28158e74d1a1710b950f921b8051686f56b564a11fdcbebbe9165bbfa73a9fe2801a007f3ce09642fb8008c76670c29db85dea1802bc52d8
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspkic.sys

Path C:\Temp\nhfzxspkic.sys
Size 141KB
SHA256 ea540419f63235d50a3783b8ba1f0a8b723cd874d44ff09cb298a6ce2f1a8712
MD5 03a3e15ecdbba02f8addce86609667b1
SHA1 318d3afb1ca917a9d7d129a431c66b0ef748c7ac
SHA512 4f28c4ea3b1446f232f2eb6b932f8abe9f47eed521b82867fec27212d489c4fde86858a21383f01dd2c1488c4ac46dee00bc9b7706b97d9906e1936c7103d5aa
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.exe

Path C:\Temp\snkfdxvpnh.exe
Size 226KB
SHA256 67b8571083efc21696b07a10c22d47d8f079686a318d55b8d6f7bba58ebdffc3
MD5 76905363c210990f3ba201c8f8c16fb5
SHA1 68d38cde046787dcee9351c469844f081cee285c
SHA512 7cbc25e2ace4e0617cbda6a9bac48f1d5feb18aba1ccaf8c9b631002292cc03d04eb4a38fcdd35aa144b71b376483a04876beb7fefbc14d03df3f03cdd751c7c
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfavtnkf.sys

Path C:\Temp\snlfavtnkf.sys
Size 141KB
SHA256 1d8c6574de2efb50ad9e0c7a4a7b53fcd9285691a4e8484336c69682b1f56b30
MD5 5b3ae9180cd41ebe72a92a7d43b4046a
SHA1 2d57828aa6f6cddfd2247626e0af1f5d6a53a2e8
SHA512 3bf02caddfac186ca455b740b3f58374ca1ca1efef47090abc7a2cfe02f6630612bf846ec7559d25d1b890ed2898d10be6ac5945a887f9065157786b7e576366
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T113E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytnlfdyvqo.exe

Path C:\Temp\ytnlfdyvqo.exe
Size 226KB
SHA256 21b7cee3b479be9dbe4440f1bd9cd4f6db4457067dbf82883166cacd5bb39aef
MD5 278e34282c0ef72f852bc68751016238
SHA1 e01dd49f715c7ebb10c6600881090024fc9253e0
SHA512 6c62eaff4d2e9314afbaf5a95b342b79ec8744fcc9d25f3f4fecc261cb4a598552a2d8e6ad2bc22ee399eba363738827f5ed4eb938306ff629548d6565a907f1
SSDEEP 3072:VyGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:/XY4LK+a3lLNngoqRttA7
TLSH
T10534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaytq.exe

Path C:\Temp\ywqoigaytq.exe
Size 226KB
SHA256 2d3e06690a278d960185278546c1b3a97d503f62273541fde21e0f7be3802208
MD5 7caecb77f6bc77a5bc09ac488d668513
SHA1 2f9904a1c77bfb726fb1839aca90519077a0808f
SHA512 055fa6ce475fd9db24291dc713f807a94a01e827180786b81f05d65dc2c52b2bf6503dd999490a1ba9cd36cdce3b9b58686646986eb6ed00ea474d38ee67e7ee
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T10A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fce317f-7462-4a8e-900b-b16d75589ccf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fce317f-7462-4a8e-900b-b16d75589ccf.tmp
Size 8KB
SHA256 739778eccaac10ee9a4e3677f66fea7421419c3479f2b7ee84daa91bf1510751
MD5 7a1b3b609fa0f20ba924951ebc1099e5
SHA1 58ddaf7c5d1e48895f79b614272aa645e79ce961
SHA512 88ea04a160915967833adf2b67c2e07a651734a73f1a0cbd5cf8e6bbe1e374a1166477dbcee70cfa6b47bca49e375aa1d311fd0146bc6c6f3abb0c24761ea477
SSDEEP 192:6GNX6i5fQmiUyDdhO7X5zPr2PjzormU8opylajwY22U6:6GNX62hInO7X532X8mUHB9DU6
TLSH
T11C02D935B9786C778EA39E56B58637135FE4112BDA952F84DAF81B1C00CB68C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 948702b2e976e9024d8565fb91cc0860edec763ebd3aa3816481da51371c5e73
MD5 2c000f6701c2e28449a18c350bf707fb
SHA1 7f62dc91daf4e5669346308c3bb517849db121ff
SHA512 f9e2e2f66b04d4e42b6dc19047a6fa24c8b29d16764c8cf1d844327e85164c27b420a2425d9a81718374bd9f1152cefd0c49a4dc69924e7931a38b46c31e8fac
TLSH
T1CF61395440C340B2FBA706BDCCE162887072CC9D499E6EF5497C5B7D3ACAB3D8926D58
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fe67d22f2e8504258861820b9b0106ba6c8ae76defcedad253b2a9dfbf34fc89
MD5 ff3a6b042480a268b623a81e87ee03a5
SHA1 777c9c72f7fd495963b9782ec6c56ef10a6d68fa
SHA512 c5ac7039ebcdf467a6705d4c847ce9514c7c195f6788b4e615336ec96176b972633e407cb87fc00bc3fda67f83f5fc94db33e140c6c3dbf00638a20ba36e7248
TLSH
T1EE41C1F7C3E8856E8A1196F0BB187E2BCE2D0910432C3D5A89E4EF1B97E2470E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 082d4d049c59bcdc58792bf9733f267554b4a5ba4fd7481d5088567a25d88a2b
MD5 2c65b346a926caca18a3274dc6bccddc
SHA1 54c6c7341de363817e5b60fb46aba188a7fcb09b
SHA512 98974c4fc58bf995890c37cdf68c653627298d4333a0a702d2036d1854edcd6575785841dc2befb8e3d36ae62d6f607c43453b3214bcaf112f81c3e0f3430b56
SSDEEP 192:sxZhRKyM/jK1Ml8Mc//fGsKQNAANIdp/e/W6+WNs/Y/Y0YNwt5Ig4J:sxZhk0//fGsKQNym/bZ/5iEc
TLSH
T1B8520906AA345977CCDBD208FD51BB53D6F9157392900E58AAFCCB0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 de24213b88503fbe6e0ab5c4d473f6c7ecfdb4b16ce6bf4c9d7f71c8f7b30000
MD5 ea9298ea9b0cc94fb6eb5a592be393df
SHA1 52b8d9a305070ee5c3167ee36037033ff01164b5
SHA512 65f31f49da149a37f863de402fcedfd24b0ed75ecf10ef484b7eff7fcdce51704aea74699b8471eff16bf24b9d22e74bea5b2d1b0a53dfb714808160b5137230
SSDEEP 192:sxZhRKyM/jK1Ml8UQfc//fGsvQtAANIdpZe/W6+WNs/Y/Y0YNjt5Ig5xJ:sxZhkq0//fGsvQtyg/bZ/5izB
TLSH
T1BE62E706AA345977CCDBD209FD51BB53D6F9157392900E58AAFCCB0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 525f364125d790c80491c51cef0a7cd509b9eee8129e9f8bb4832b7e93612d2b
MD5 e76536afa97524912778227a9ea92576
SHA1 eeebc7eeade219e979d291d666147b051432ecab
SHA512 a986ed968fe83b6ffda66b0eb8144255579ce1f56cb2e58d0f9de1ab96c5fae943ea629366af8309cef2592ec1dc8a7c4b6d571fb59ffbabdf97187992e04743
SSDEEP 768:qPl1j83r2+W7pLuLXemWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mpwALlu:qPl1j83r2+2EXemWRmeKQBCu1jaKmpwN
TLSH
T157031D3B780CCB7A4F844E9CEC267F8A6DE8018B9A98895447F9844C03C67EF551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 6213f1cc82f457d8377961d2655b182fe258397dbe10cf12eb8bae31c3654e8d
MD5 7e7b21fc3484a91e1f318776db57d34e
SHA1 867da4fc972ba54a1d24fbd7791fb6182f822b6e
SHA512 4479280166d0c1bb1e57d5b9cfe0bd0c648b31be6ebe39dd59e292d93d73b0977106ca60f583ca6107fb1d9a8f31e44455e7be3d0858508898573f86fc0f6e70
SSDEEP 96:KkUgKtem4Ap62AKqxrWbsRuxK54RgxdYwTuqS2hKKSoieBuKSIBEx2KW:6v4Ap62AKqdWb6uc4RgDYwTuqS1BFEEO
TLSH
T1C2C1B50771BB02763C3D250DA395873A4B4276A33058E86B3BA984B64E67E351CFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a4e4f52-2eb2-410d-9300-2ede5e2e8d6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2a4e4f52-2eb2-410d-9300-2ede5e2e8d6e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d2c732795455fcc2ca6adbcc059e603f6ae382ed0bdc78defc46879a3fabde1c
MD5 928e93185a507305c54077d88a88e56d
SHA1 bb0111131a3a726df95db45cb99161bb2011e81f
SHA512 670dbbcf2098ec6933522c46fa1383630bc15199e4c5d32587d34bfe98893f8356b02e6e934ae6c3db8319cf16738bf12bafcbbc6be22b03cd5cb9039e25f97e
SSDEEP 384:ym8NoNSR8p9dugX532X8mUHtX55JrDhKUSbQmXEG/:HoY9nVd55hDhKUSbQAEG/
TLSH
T1BC725C3168749C375AE7E54AB59A32935FBC11BB89C82F54D6ED8F0D00CA69C170A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 558226a03d685c38b5465a17a61ae8a8798dc50fd98183a4fe371f425308aabd
MD5 c6d0af67ced9787b63bcfa36c4064285
SHA1 01ee0e4da7b96bae33291ec2f8a49dba63ded81b
SHA512 d153330ed2cbb6b0fde2f345930900066a51be3f0b4fdd2f9c57099dcb9768215619c3c2a6919d57f46c1711d3de2541b7770aa1e7669bcf8f8aa784ebd433c3
SSDEEP 384:yu8NoxSRjp9dugX532X8mUHtX55JrGhKUSbQmXEG/:DcP9nVd55hGhKUSbQAEG/
TLSH
T1BF725C316874AC3759E7E54AB5AA32935FFC10AB49C82F54D7ED8F0D00CA69C170AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 2eb42e26220760f2ca39aa2e41bd23a431b4add0bcfcdb913931092561e45b65
MD5 44b162d30bc100919d2f9ce2396278f1
SHA1 4e0eab4565a7ba7c3afee369c67f98fca3041656
SHA512 8381fcc74cffaff67fbc1edc9f095a49995c35e7eb3f34fd08d1bae4100e094f00078e0a0672437ce5e3026ee86206cf31f6f31171da465f937f465495d60c86
SSDEEP 384:y/8NoISRjp9dugX532X8mUHtX55JrGhKUSbQmXEG/:odP9nVd55hGhKUSbQAEG/
TLSH
T11D725C3168749C3759E7E54AB5AA32935FFC10AB89C82F54D7ED8F0D00CA69C170A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7e0e52b336091251c50bceee2418915355d922409798d9b0e600e55b707c7b50
MD5 7d9443874c954b0ebd6f517c0fce03d8
SHA1 499e8574ff4bd96cccae2a930b00a46c107b7860
SHA512 f238f769edfd7f6b5a7f47dcdc88322b4e69d35315c231a28a912ce962038bdf371d04bd36f6d363e263debdd589bb62537b1d5b6edf4d38bc9a64ae244c737d
SSDEEP 384:ySiFi8Nv8TUNTUlIlISR0j9dudifhQX532X8mUHtX55Jr1hKUSbQmXEG/:kFiAwg7q9tgVd55h1hKUSbQAEG/
TLSH
T1A8C293F194E78937D9AE5787A73E2D429EBCC15374885994F7D84E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e9a5710b1c546d801e821a32447d6d6258eb54156bd08dc7d64b0bf5c898fe64
MD5 ebb1a2ec3b7a0c6a11f5ed32c2f2c1fe
SHA1 ded9b8ceed859efdb2178c8516a1d2af3daddf5f
SHA512 6336d2748ca60add41f3062f3865f8af634a18bc55e12af7f86e400a36d6005d42eeac5a15dce7f6d723326bb925603a3e62fe007dd6c36269afcf3528bbd3ab
SSDEEP 384:yq8NoISRip9dugX532X8mUHtX55JrJhKUSbQmXEG/:Jdi9nVd55hJhKUSbQAEG/
TLSH
T195725C3168789C3759E7E54AB5AA32935FFC10AB89C82F54D7ED8F0D00CA69C170A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f9b6ae0e8e8e513fcda57e739f5fa73f1e5ca062b09ec077462d728bd2d8fae9
MD5 ac934429eedcf3a4a714426ae73e8022
SHA1 2ae00cea9cfb38d56f158d11e501c2ed92773160
SHA512 3162afe183e623f4bd87309176c8da5e54e229b23fccd0394dfc06fd00f77abc41a93a9af72b7ad1a75d2b41b8302a2fffe4e817fbb200c8460fe75edee16c1a
SSDEEP 384:ySiFe8Nv8TUNTUlIlISRij9dudifhQX532X8mUHtX55Jr6hKUSbQmXEG/:kFeAwg7A9tgVd55h6hKUSbQAEG/
TLSH
T180C293F198E78937D9AE5787A73E2D429EBCC15375885990F7D84E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cb92f41378832c640627da7aa38bc24277d242aa01d11cdc949109252d5ae31f
MD5 16e901423ee5804f2e08db7ace896e2e
SHA1 760baaf6d589dd34ba8a2a1266b48ec573a8161a
SHA512 4ed066e18078e3c442577e59172c0228623d5ef3d9176c92a9f5253eafc7e5b189b399abe72ac6707d0a28ac6717bff361a951cfe0ff20834686d2187c6fdb87
SSDEEP 384:ySiF38Nv8TUNTUlIlISRQZ9dudxfEQX532X8mUHtX55JrShKUSbQmXEG/:kF3Awg7S93gVd55hShKUSbQAEG/
TLSH
T1E7C2A3F194E78937E9AE5787A73E2D429ABCC15374885994F7D84D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c64eecb89e00ff427050cb5c089852bae781dbbbfa1689916b1aaab3cb452d51
MD5 ac026016e90d0907da473e18c05819c7
SHA1 5cf6e8f26af3e8864eed19720b5fcc1928ed37cb
SHA512 0ec08093b5ff908735b1098480f10630c754b92abe5dcef82a7dd6de3cb210e1b5f47ae35cfe6b6326a4b19695dd38822dd0a10734c9aa0be65a512a5a52bfea
SSDEEP 384:ySiF18Nv8TUNTUlIlISRwj9dudxfhQX532X8mUHtX55JrFhKUSbQmXEG/:kF1Awg7i9GgVd55hFhKUSbQAEG/
TLSH
T116C292F198E78937D9AE5787A73E2D428EBCC15374885994F7D84E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fadd72032354e25ab7e55205935020178d92f7da766321804515b5aa1db5331a
MD5 4e6afdfdf9c19c97278d16c3eeca9daa
SHA1 5e6be7d1a8d4345c647762cf06edda5859c0631e
SHA512 45cfe7d54c28925878eb64da4f8105bde224c7aec0f252464d59681c1b3fea492efc97e32258d0d8d50a0dac5cdcb1f2c10be7c27ca4af6005f7923a2fbe2f13
SSDEEP 384:ySiFe8NY8TUNTUlIlISRij9dudDf4QX532X8mUHtX55JrYhKUSbQmXEG/:kFeRwg7A9TgVd55hYhKUSbQAEG/
TLSH
T1A2C293F198E38937D9AE5787A73E2D429EBCC15375885994F7D84E0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3093c32e2ca1794b4ff49ea66c5c5c73bcc17973f2a326d8c8fb20bd92c5e7bf
MD5 abb92cabc068d6456098d61941693c29
SHA1 02baeadaa2dc20c9778be1f402a22e01c4635983
SHA512 86a141b86024bf16e30370ce53073858a6f99d13145673d8d3c687a79464a5aad0bc440f6cd8f5d3a671f6f81f980aa10bd6df8bc728671a4c10020ff95e8fed
SSDEEP 192:6GNB6i58QmiUydhC7X5zPr2PjzormU8opyEX5s3SJrGGQhWqzSU6:6GNB62MyC7X532X8mUHtX55JrohKU6
TLSH
T172120735A468EC271ED3A585B0D632A39FE81077DD896F94E6F85B1C00CBA8C170EC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7957b0542a748a9a196d470d786b3edcb07769870886c0c88b6039e26f6acfa3
MD5 2c28d5332f3637b284ad9891d3ad2e42
SHA1 b965210df621fe6d8b1c3b6a4e6c44da88ef8dc0
SHA512 9e9001a2c8517dca08344a97169927be0116bda9e121d0eeafd041d0464faefd1de1cdd50a8391e15bc6c70f996830aedfd1a2e8a0dec8ca79935e66314e0e3e
SSDEEP 384:ySiFV8Nv8TUNTUlIlISRIj9dudxfhQX532X8mUHtX55JrFhKUSbQmXEG/:kFVAwg7q9GgVd55hFhKUSbQAEG/
TLSH
T110C292F198E78937D9AE5787A73E2D429ABCC15374885994F7D84E0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

23bfd7fe-acb5-4f1e-9ae1-58f9da4adcb4.tmp

Path C:\Users\Admin\AppData\Local\Temp\23bfd7fe-acb5-4f1e-9ae1-58f9da4adcb4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35c38939-a009-4eeb-adc2-b90037e3efde.tmp

Path C:\Users\Admin\AppData\Local\Temp\35c38939-a009-4eeb-adc2-b90037e3efde.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

d5088aec-3dcf-4816-8fd6-c27b5882e162.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2296_1244535323\d5088aec-3dcf-4816-8fd6-c27b5882e162.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2296_816427560\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1572457514\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1577722910\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_174136938\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1906473519\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-775-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1180-575-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1792-763-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1892-663-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-571-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3004-536-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-801-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3136-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3484-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-732-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3616-686-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3616-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-821-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4080-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-487-0x0000014BAE800000-0x0000014BAEA21000-memory.dmp

Download

memory/4940-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download