8019370ef5bc6962feec396a42336521f440de6cd946e0b381440749138e929b

Analysis

max time kernel
148s
max time network
127s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/06/2026, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260608-s7p14sf19m
SHA256 8019370ef5bc6962feec396a42336521f440de6cd946e0b381440749138e929b
MD5 9ca50820813f9829667f73ae37ad493e
SHA1 bc2fcdb12f4dfa8934a29d7b8828bd7c2b573c98
SHA512 52e7e71ac5640218a7448cc305a13b0190bb86035aa57c6893eb22047b4f4bcb8dd6310c74817d77ac1f1decf4c7aab7a391160b6bfa73a4ae72a4ace8514b37
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T13C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2180	CP.exe
4704	zurmkecwrp.exe
4644	CP.exe
3424	CP.exe
4852	i_zurmkecwrp.exe
4300	bztrmjecwu.sys
3320	CP.exe
2168	trmjecwuom.exe
3908	CP.exe
1592	CP.exe
2780	i_trmjecwuom.exe
2564	hbztrojgbz.sys
444	CP.exe
3312	trljdbwtom.exe
2924	CP.exe
2024	CP.exe
1064	i_trljdbwtom.exe
872	gdywqoigby.sys
1860	CP.exe
5040	ytqljdbvto.exe
1748	CP.exe
4920	CP.exe
3888	i_ytqljdbvto.exe
3636	bvtnlidbvt.sys
932	CP.exe
3336	tnlfdyvqoi.exe
3932	CP.exe
2388	CP.exe
4716	i_tnlfdyvqoi.exe
8	sqkidavtnl.sys
5096	CP.exe
5008	kidavpnifa.exe
1176	CP.exe
2304	CP.exe
872	i_kidavpnifa.exe
3624	sqkicausnk.sys
3744	CP.exe
4768	zxspkicaus.exe
3760	CP.exe
2364	CP.exe
1040	i_zxspkicaus.exe
3240	pkhcausmke.sys
1496	CP.exe
572	hcausmkecx.exe
4276	CP.exe
228	CP.exe
1744	i_hcausmkecx.exe
2452	pkhczusmke.sys
2536	CP.exe
4508	ecwupmkfzx.exe
5016	CP.exe
812	CP.exe
3120	i_ecwupmkfzx.exe
3356	bzwrpjhbzt.sys
4800	CP.exe
3428	urmgezwrpj.exe
4812	CP.exe
3732	CP.exe
1812	i_urmgezwrpj.exe
3896	bztrljebwu.sys
2464	CP.exe
2812	ljebwuomge.exe
2880	CP.exe
1052	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmgezwrpj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3964	ipconfig.exe
2892	ipconfig.exe
3140	ipconfig.exe
3608	ipconfig.exe
3732	ipconfig.exe
2496	ipconfig.exe
1660	ipconfig.exe
4300	ipconfig.exe
2720	ipconfig.exe
3208	ipconfig.exe
2052	ipconfig.exe
8	ipconfig.exe
956	ipconfig.exe
2400	ipconfig.exe
4852	ipconfig.exe
2128	ipconfig.exe
1812	ipconfig.exe
4628	ipconfig.exe
2500	ipconfig.exe
4880	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1045668931"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31258467"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134254071792603707"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{7E78C3D6-E5AE-42E4-9590-F940472FD5D6}	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	i_zurmkecwrp.exe
Token: SeDebugPrivilege	2780	i_trmjecwuom.exe
Token: SeDebugPrivilege	1064	i_trljdbwtom.exe
Token: SeDebugPrivilege	3888	i_ytqljdbvto.exe
Token: SeDebugPrivilege	4716	i_tnlfdyvqoi.exe
Token: SeDebugPrivilege	872	i_kidavpnifa.exe
Token: SeDebugPrivilege	1040	i_zxspkicaus.exe
Token: SeDebugPrivilege	1744	i_hcausmkecx.exe
Token: SeDebugPrivilege	3120	i_ecwupmkfzx.exe
Token: SeDebugPrivilege	1812	i_urmgezwrpj.exe
Token: SeDebugPrivilege	4480	i_ljebwuomge.exe
Token: SeDebugPrivilege	3980	i_rljdbvtrlj.exe
Token: SeDebugPrivilege	4880	i_oigdywqoid.exe
Token: SeDebugPrivilege	1680	i_qkicavsnlf.exe
Token: SeDebugPrivilege	1676	i_ausnkfcxvp.exe
Token: SeDebugPrivilege	3200	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	1512	i_usmkecwupm.exe
Token: SeDebugPrivilege	2044	i_jhbzurmjhb.exe
Token: SeDebugPrivilege	1020	i_dbwtomgeyw.exe
Token: SeDebugPrivilege	3148	i_geywqljdbw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2532	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 2532 wrote to memory of 3416	2532	iexplore.exe	82
PID 3416 wrote to memory of 3332	3416	msedge.exe	83
PID 3416 wrote to memory of 3288	3416	msedge.exe	84
PID 3416 wrote to memory of 2792	3416	msedge.exe	85
PID 3416 wrote to memory of 3288	3416	msedge.exe	84
PID 3416 wrote to memory of 3288	3416	msedge.exe	84
PID 3416 wrote to memory of 1056	3416	msedge.exe	86
PID 3416 wrote to memory of 1056	3416	msedge.exe	86
PID 3416 wrote to memory of 4900	3416	msedge.exe	87
PID 3416 wrote to memory of 4900	3416	msedge.exe	87
PID 3416 wrote to memory of 4900	3416	msedge.exe	87
PID 3416 wrote to memory of 812	3416	msedge.exe	88
PID 3416 wrote to memory of 812	3416	msedge.exe	88
PID 3416 wrote to memory of 812	3416	msedge.exe	88
PID 3416 wrote to memory of 3276	3416	msedge.exe	90
PID 3416 wrote to memory of 2404	3416	msedge.exe	91
PID 3416 wrote to memory of 3276	3416	msedge.exe	90
PID 3416 wrote to memory of 3276	3416	msedge.exe	90
PID 3416 wrote to memory of 2404	3416	msedge.exe	91
PID 3416 wrote to memory of 2404	3416	msedge.exe	91
PID 3416 wrote to memory of 3744	3416	msedge.exe	92
PID 3416 wrote to memory of 3932	3416	msedge.exe	93
PID 3416 wrote to memory of 3744	3416	msedge.exe	92
PID 3416 wrote to memory of 3744	3416	msedge.exe	92
PID 3416 wrote to memory of 3932	3416	msedge.exe	93
PID 3416 wrote to memory of 3932	3416	msedge.exe	93
PID 3416 wrote to memory of 868	3416	msedge.exe	95
PID 3416 wrote to memory of 868	3416	msedge.exe	95
PID 3416 wrote to memory of 868	3416	msedge.exe	95
PID 3416 wrote to memory of 2324	3416	msedge.exe	96
PID 3416 wrote to memory of 2324	3416	msedge.exe	96
PID 3416 wrote to memory of 1868	3416	msedge.exe	98
PID 3416 wrote to memory of 1868	3416	msedge.exe	98
PID 3416 wrote to memory of 3892	3416	msedge.exe	99
PID 3416 wrote to memory of 3892	3416	msedge.exe	99
PID 3416 wrote to memory of 3892	3416	msedge.exe	99
PID 1140 wrote to memory of 2180	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 4704 wrote to memory of 4644	4704	zurmkecwrp.exe	103
PID 3416 wrote to memory of 4132	3416	msedge.exe	106
PID 3416 wrote to memory of 3992	3416	msedge.exe	107
PID 3416 wrote to memory of 4132	3416	msedge.exe	106
PID 3416 wrote to memory of 3992	3416	msedge.exe	107
PID 3416 wrote to memory of 4900	3416	msedge.exe	108
PID 3416 wrote to memory of 752	3416	msedge.exe	110
PID 4900 wrote to memory of 4764	4900	msedge.exe	111
PID 3416 wrote to memory of 4076	3416	msedge.exe	112
PID 3416 wrote to memory of 4076	3416	msedge.exe	112
PID 3416 wrote to memory of 1908	3416	msedge.exe	113
PID 3416 wrote to memory of 1908	3416	msedge.exe	113
PID 3416 wrote to memory of 4508	3416	msedge.exe	114
PID 3416 wrote to memory of 4508	3416	msedge.exe	114
PID 3416 wrote to memory of 3968	3416	msedge.exe	115
PID 3416 wrote to memory of 3968	3416	msedge.exe	115
PID 3416 wrote to memory of 4480	3416	msedge.exe	116
PID 3416 wrote to memory of 4480	3416	msedge.exe	116
PID 1140 wrote to memory of 3424	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 1140 wrote to memory of 3320	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2168 wrote to memory of 3908	2168	trmjecwuom.exe	123
PID 1140 wrote to memory of 1592	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 1140 wrote to memory of 444	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 3312 wrote to memory of 2924	3312	trljdbwtom.exe	132
PID 1140 wrote to memory of 2024	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1140 wrote to memory of 1860	1140	2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe	139

C:\Users\Admin\AppData\Local\Temp\2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-08_9ca50820813f9829667f73ae37ad493e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8e5b8c188,0x7ff8e5b8c194,0x7ff8e5b8c1a0
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,558047874599275205,4314676646405946862,262144 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,4600265995215009681,4571882360148336434,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
      4⤵
      System Time Discovery
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,18387385655158082924,17231951995985221881,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,5359534070093086137,1832729777420147308,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,9544319000161388164,10662134613303706659,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,3005390283381654273,9729568270416630661,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13889354131742721959,10253421797581669255,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4256,i,8140206780550284339,7340739563329252114,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4280,i,851157134138818408,14445699003392278531,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3696,i,9653821888180022692,3899130495250313162,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,17970180538378552477,7493387279417172692,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,14061541417822569520,10738215771969903393,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5584,i,1226314563841645736,9222291030296777623,2097152 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:1
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,3350669849507196750,22485361717063922,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4020,i,5788332818135310835,1448872102402062117,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:3992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,16779718740648773815,1943756642275946462,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1148
        5⤵
        
        PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,15401827483238162477,17798367084048001164,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,15401827483238162477,17798367084048001164,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,17386268758609335234,17490271855233990307,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,6073250787475757890,7066868500577159879,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,4230551927439205844,2815593034329098148,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,11995550421109331574,4253039949273960448,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,15530652899635508221,2750843365522740190,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,9917360461128123521,11308107961586866012,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:14
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,7621158662939951707,15565866176632430389,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,15570683841448959309,337015611560007253,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7660378376046799359,10570147968765083654,524288 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,5365265056624258561,2781437714140533547,262144 --field-trial-handle=2228,i,11750068227536530665,6102172546465416386,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:10
      4⤵
      PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2180
- - C:\Temp\zurmkecwrp.exe
    C:\Temp\zurmkecwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3424
- - C:\Temp\i_zurmkecwrp.exe
    C:\Temp\i_zurmkecwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3320
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1592
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:444
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2024
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\ytqljdbvto.exe
    C:\Temp\ytqljdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4920
- - C:\Temp\i_ytqljdbvto.exe
    C:\Temp\i_ytqljdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:932
- - C:\Temp\tnlfdyvqoi.exe
    C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\i_tnlfdyvqoi.exe
    C:\Temp\i_tnlfdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Temp\kidavpnifa.exe
    C:\Temp\kidavpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\i_kidavpnifa.exe
    C:\Temp\i_kidavpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3744
- - C:\Temp\zxspkicaus.exe
    C:\Temp\zxspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2364
- - C:\Temp\i_zxspkicaus.exe
    C:\Temp\i_zxspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:228
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmkfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\ecwupmkfzx.exe
    C:\Temp\ecwupmkfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmkfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:812
- - C:\Temp\i_ecwupmkfzx.exe
    C:\Temp\i_ecwupmkfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmgezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\urmgezwrpj.exe
    C:\Temp\urmgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmgezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3732
- - C:\Temp\i_urmgezwrpj.exe
    C:\Temp\i_urmgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2464
- - C:\Temp\ljebwuomge.exe
    C:\Temp\ljebwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1052
- - C:\Temp\i_ljebwuomge.exe
    C:\Temp\i_ljebwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtrlj.exe ups_run
  2⤵
  PID:3920
- - C:\Temp\rljdbvtrlj.exe
    C:\Temp\rljdbvtrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtrlj.exe ups_ins
  2⤵
  PID:4780
- - C:\Temp\i_rljdbvtrlj.exe
    C:\Temp\i_rljdbvtrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdywqoid.exe ups_run
  2⤵
  PID:1580
- - C:\Temp\oigdywqoid.exe
    C:\Temp\oigdywqoid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdywqoid.exe ups_ins
  2⤵
  PID:1620
- - C:\Temp\i_oigdywqoid.exe
    C:\Temp\i_oigdywqoid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnlf.exe ups_run
  2⤵
  PID:4824
- - C:\Temp\qkicavsnlf.exe
    C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnlf.exe ups_ins
  2⤵
  PID:4188
- - C:\Temp\i_qkicavsnlf.exe
    C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfcxvp.exe ups_run
  2⤵
  PID:2984
- - C:\Temp\ausnkfcxvp.exe
    C:\Temp\ausnkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfcxvp.exe ups_ins
  2⤵
  PID:2952
- - C:\Temp\i_ausnkfcxvp.exe
    C:\Temp\i_ausnkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  PID:3624
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  PID:1812
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  PID:1600
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  PID:1724
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjhb.exe ups_run
  2⤵
  PID:4904
- - C:\Temp\jhbzurmjhb.exe
    C:\Temp\jhbzurmjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjhb.exe ups_ins
  2⤵
  PID:2112
- - C:\Temp\i_jhbzurmjhb.exe
    C:\Temp\i_jhbzurmjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtomgeyw.exe ups_run
  2⤵
  PID:1476
- - C:\Temp\dbwtomgeyw.exe
    C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
  2⤵
  PID:196
- - C:\Temp\i_dbwtomgeyw.exe
    C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqljdbw.exe ups_run
  2⤵
  PID:4092
- - C:\Temp\geywqljdbw.exe
    C:\Temp\geywqljdbw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqljdbw.exe ups_ins
  2⤵
  PID:724
- - C:\Temp\i_geywqljdbw.exe
    C:\Temp\i_geywqljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\hbztrojgbz.sys
C:\Temp\hbztrojgbz.sys
1⤵
- Executes dropped EXE
PID:2564

C:\Temp\gdywqoigby.sys
C:\Temp\gdywqoigby.sys
1⤵
- Executes dropped EXE
PID:872

C:\Temp\bvtnlidbvt.sys
C:\Temp\bvtnlidbvt.sys
1⤵
- Executes dropped EXE
PID:3636

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:8

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:3624

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:3240

C:\Temp\pkhczusmke.sys
C:\Temp\pkhczusmke.sys
1⤵
- Executes dropped EXE
PID:2452

C:\Temp\bzwrpjhbzt.sys
C:\Temp\bzwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:3356

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\bwqojgbytr.sys
C:\Temp\bwqojgbytr.sys
1⤵
PID:2008

C:\Temp\sqlidbvtql.sys
C:\Temp\sqlidbvtql.sys
1⤵
PID:3796

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
PID:2760

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
PID:724

C:\Temp\hfzxspkica.sys
C:\Temp\hfzxspkica.sys
1⤵
PID:2044

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
PID:2604

C:\Temp\rpjhbzxrpj.sys
C:\Temp\rpjhbzxrpj.sys
1⤵
PID:1704

C:\Temp\ztrmjebwuo.sys
C:\Temp\ztrmjebwuo.sys
1⤵
PID:4208

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlidbvt.sys

Path C:\Temp\bvtnlidbvt.sys
Size 141KB
SHA256 63e9688fbc8a6ad5610d35c05b19f5e189564881982230dd60785b1494a6761a
MD5 b4e8bbe43092240f6648d1b8ee810ebe
SHA1 4d922df4cf281eee116525764f5950c58d43844f
SHA512 2a4f47a90de8f6dacbaad5d33dab10da855323ff0438fc7a56a1c153c712fc1b0b9086c7b80141e8fd0c1fa90ef0ec815eedbf90ab99c8ce6f1823df95a2226b
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BEE37C12B292D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E643D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.sys

Path C:\Temp\bztrmjecwu.sys
Size 141KB
SHA256 c2bf65c1474ea14993771f10f25535879439259e0e48a0dbe2a5fb44dbefb3f7
MD5 ddd3b0440e092ad9a7af33df25f09891
SHA1 df2b425e0ed96bb13ae3920f7c4e22376c86cfad
SHA512 02445aeedbb670657f3d8eaa804b6f5ae840e49bf84bbd74836695ab46964893626168f282026d810b39e9bd38192387fa867f5ab9d595933924b795e1b90377
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigby.sys

Path C:\Temp\gdywqoigby.sys
Size 141KB
SHA256 761634737fe32d62630b5947f37c538ac78816e099b1d47dbb4195c6f1e28dff
MD5 f32f0e6fb8c614bb70aa06af99ba451d
SHA1 69363232f5e9ef1cd39143df48dc947bb3f413d0
SHA512 f30ee67e3a0381d271907d5ba0ae40f1f710092a0b80298c18c9b9f92b944dfb387fb1087aca78b99086fcb9462b064709da5dd90cd8c46bfd1f679b80d60d4c
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T107E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrojgbz.sys

Path C:\Temp\hbztrojgbz.sys
Size 141KB
SHA256 b5ae8e08248bf581ec72246bd464e133b2c1b06b5e8ec7b6e2155b629303cd2f
MD5 2bff360d9b08cd6ad1dd47dde76fa9ab
SHA1 a6cf2a2e23363dd15e7698c5fa26b6a60288c2f8
SHA512 8d8d902f1b46b6d9e416370f4b09787c2185851dc2f784a67909dbb44097cd8236ceb77e77cb56ccdb86a205580d45427dd11e0525b33760f536a844c5fbfdd6
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvqoi.exe

Path C:\Temp\i_tnlfdyvqoi.exe
Size 226KB
SHA256 35b97c681827cb76cbda2487dbcb43612e19d3b7ba50e740d34fd9e0aa048eb0
MD5 2dda780ec25b39ba13d974b18909d14a
SHA1 e10d060830ed6c283faeb78b76fb7cfb9d2fbac5
SHA512 a9cb0d3d8148e708dbb8576f0805d826db0b8d28091abd9a373a93e3393b7fa11b1626bc3c611aa64bee58e92d278cf593a1e98af0196d5c59aae53c2f7d3abc
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtom.exe

Path C:\Temp\i_trljdbwtom.exe
Size 226KB
SHA256 42d46413195a6309253011c20a71317d9bcf2c6476eb8009bcbadec2d4ba86c1
MD5 f30ffeda06dd9aa9ce2e6a1816ad7b38
SHA1 a3869466345eab3b7e3d74f39f9cb69967f4ce3d
SHA512 72039172b400acabac0cb4c8f3d33ebbf4a7c1805fb8c8a10afeaa6e706bf57ed9c5f623ee3a1160096e16a91aefa5eb11d1d20918362c8ab2a6f671a8cd166e
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1DD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecwuom.exe

Path C:\Temp\i_trmjecwuom.exe
Size 226KB
SHA256 1ba75d78ecb236689b064c8a77c297cc6240d9ff082044351abb34c8549220b9
MD5 00f44c6a324eb17d378ca0d7cc14bcb5
SHA1 c8a663e43751939024fa94ddabfd33a5e0493eb2
SHA512 d1e89403ea1c4a353a8624c3c2df6641537fe663fc460f39eb01e537cf0215cc1a22a6b99f731eb7e2955e927b768dcd008d4d4aa785e1d47c74e125b8d47976
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1F534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqljdbvto.exe

Path C:\Temp\i_ytqljdbvto.exe
Size 226KB
SHA256 25bb21e6678d3d9255f3f0d7e4383b135a7d5e9cf67e190e3df9adb4bbbf3daa
MD5 db1577d6d90bac9c9803c2f6ae5c4339
SHA1 d2f7471a4bc74e6ffc096a3af63d0dd21d1a10d8
SHA512 afc410f8b1090d31672201d1dd039c00bb8236b0de332af71d1564473d02b17625b4bc6718f7c4a98061a284bbeb1809253421c45a437340a7b2ac59fb2223dd
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwrp.exe

Path C:\Temp\i_zurmkecwrp.exe
Size 226KB
SHA256 62e7cd1af6803935e0542573b1b498f6dfd93ce81b9069b26654ee8bb9ddb197
MD5 68242ba4d21c5b544d80528db25b8ef4
SHA1 ba35e9f716a6880e06e7578f4fa31b9d0bf559a8
SHA512 f3446a0c4a7799ec01d63cd4b5181993ef521ff1613d4b9566d2c43d59504084a33c9bee324ef24f989e21a283d0aac54adac55097cb803b54cdb28414e9b76f
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T18934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavpnifa.exe

Path C:\Temp\kidavpnifa.exe
Size 226KB
SHA256 c08eeeb25e9386246715f12939d257912b3b09ddf5b1e3eac63e5e239cca9b37
MD5 7a35d4ca606313f2704802e05f4bdb12
SHA1 136f369db0a99eeb6e1c45c154b7738943a51f11
SHA512 5dbb2a5a3acefcbf05ad3e92d909cce2046b6aee0246a4835b8fe5d86994177443cb7a6f0bb797fb8d2548322d6a0fc7903a2fb684feac7f2188d1ca3f09785e
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.sys

Path C:\Temp\sqkidavtnl.sys
Size 141KB
SHA256 cefa0a542c49d61132ae1967eb3f622bafb178e32e5a6244458c208ae54d9c7d
MD5 5b349a90cb81083b7bd8d63515a53c49
SHA1 ad72330f4c014a6ed074cd1af4f2c643e5534571
SHA512 b8f748f26a4d9e158633ff3e204ceb512c82f4e858f856c75b9bf25cd796ad22a0a489f0a681d54fe3a15916b2de046dd01ff4724b15ecf3895f4759ae3c2d1c
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T148E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.exe

Path C:\Temp\tnlfdyvqoi.exe
Size 226KB
SHA256 46cd480bc4f03f9c629e6e0ab4181101331c64cdfcdf8916a69f29c0ee2fc74f
MD5 3160ada8c14f58c3a1229cab8d3342e0
SHA1 0dd32a6da9d7370e1829189f8d09f63c7c966ed0
SHA512 62f24d3b478b26afdf57daa69bdfbdcfc4643a8b07bbf08d5b260d73275a2dacbce8b76eae9f6f6995419e5b669f0e8da5c25a10f5b226000207698195d22e82
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1CB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.exe

Path C:\Temp\trljdbwtom.exe
Size 226KB
SHA256 3339e49855da6f7e22e1e69427ad70bd176d8b91921a29c2ae1f7d5856770170
MD5 c96fff6e7f11715eea36f5ff66f0e9dd
SHA1 efdcbcef9e88b2d1ec81e51277a95eda967c6695
SHA512 d99583f62ff28e47c07ae872ea3b4af2816e3255a9304e6c1a2b5423d45d6c1e7550aa2b72f3bb1570f2a9211096042c270482078340d704ae396100d503d828
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T17834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.exe

Path C:\Temp\trmjecwuom.exe
Size 226KB
SHA256 9e2d2c0aa5926385a760ae85690ab3dac896f3346b8456f087bc9cec6e89e3d6
MD5 dc6dec48a89c862b0c84929c37f5ba58
SHA1 145f318c88950f84f73a914d8ed1a9eb9bffe7bf
SHA512 36e58108ed70b5345acbd667eb8fbd05faea04c70202db6446462070fc5281e97cb4a62a44e0b934cde35119f20c4946dafa8baf1d8e70a8d7667f0759a2025d
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvto.exe

Path C:\Temp\ytqljdbvto.exe
Size 226KB
SHA256 da8abe3421119bf48d5355612cc9a41ed2e2db0367028a89bbce71239d80264e
MD5 602122831363ceae6cd0639daf8a0d0a
SHA1 e5aa5f8bcd73510702c727b1aadcbfc3b37ec656
SHA512 3ed86e80fa720a9f081d0f40292285c090931723ef95924c25f575c385552b8e2779fd25de9aaa3138bac1b2d31053a5502262db3ce3ba360d7964d068386a2c
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwrp.exe

Path C:\Temp\zurmkecwrp.exe
Size 226KB
SHA256 c30a7b46e6d29f879e2b044bf98312438e5570af4739511efd594811172dfa68
MD5 960fee454c642e2e99b0700f4dfd6195
SHA1 3ab6133e27389cb20b9bd9aa0d0a499a0538fb72
SHA512 90abd7199177aac94d136b5ff09cd93dc19db511dc4fc96e9287216f1294df6be035f942f4b2315e093be5b8a4f3fcc8afb0664d1ffb1e167c38b943e0167fdc
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83b97b6923ce1c25ca4f0975afffa4a8a035d906f9fb1b2a17963eea6d46deac
MD5 ab62d540f48a6e64dbe62b6d5e0f66b9
SHA1 282ce872991d2b2872c0eebeba33666b3d3147e3
SHA512 3480d10d4a55f985a4ef7c9cbf908d16cbafa49de7ff2e7f067aeee1a477d42f56e5174a74cdfedbc6726f6bb0df5a0165a160fc6244237cc20d827ab2b58600
TLSH
T1B2D08C333F1E7410EB5A9335A843C71A2EA610662A975703E351C89CEDF40E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 750aae5f6fcd1c84f47c22740f9a6faaeacfecd059d469b43a524a58c641f1af
MD5 49d9e916d358c355ce9f2e6c57e683cf
SHA1 7485fcd5b56447b9a576f2d6606e067a135b5373
SHA512 739db6810477a47b0daa04a82b7d4acda665822df2df0d6dd8a6c535f7bd50a13a8f403ce87570016057ab37d314070a0b527099fe628152f6332150c060059a
TLSH
T1CFD08C333F5E7810EF5A9335A843C71A2EA610662A979703E351C89CEDF50E893C31E2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a60a2663ac0dd65971ab10e29724e4d8782f69979f6efbd42918d4b2c5c5c560
MD5 20c87842452d00a6b736ac3e28203548
SHA1 7a180720ab8ee6d83764683381d8358a23273688
SHA512 a4ab9861660fabed443ed812f947e7a83b277f0cf11f40f26b62f778294b496c379d7782000a63087b3795359911e7e9796ca78233c7a02f0c887092d2a883e6
TLSH
T13671804316B64C43EF6A06FD94E2B2EF3C71168E4E470D2222D47AB2DB02721E51D858
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ff9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587ff9.TMP
Size 3KB
SHA256 2baaf33589623508ecd39561c5154bd79f28ee677c676fe03cd06657a69646b5
MD5 e471ecd29074c0aaae4a897af6a19b23
SHA1 c4ed0113d9e0b5e50b93eddd72677475f88742d6
SHA512 81af94fd6fdc888c32e8cb0c1d1b3544447a16d1f681e4e8e2c12ce3ed92e1e13942c7baee4880cc2d844f5f0ea8edf81e5177966cc34abd5283c1cd3dd9b696
TLSH
T19371804316B60C43EF6A16FD94E2B2EF3C71168E4E470D2232D479B2DB02721F51D858
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0e2f4ce969ca53e77dd1418e27c8992ff0ea09dbff05961da5eeef394d17329e
MD5 88f04ec0eee62f3e66b15e71855d0d70
SHA1 dffc332e82172224afbc36c4bb9ac2cc206cecaf
SHA512 24daf1c0b80cb6362cd0143c43412a18e8a848f14c6b4620b66b61f8f00a5c01a56ce3846d5e388a04cf6b855d86da46b870948b74519955761fdcf56cc39057
TLSH
T126318AF3C3E8866EC90196F0BA286E2BCE1D0954932C3D5AC5E4EF5B93E2471E14154F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6d371ec934a8be4748128971ff6a380ae0cdb66617f56969d04db0372acf8323
MD5 d5b1f47978259e575ae6c1a5093b766a
SHA1 0392ad3193f686bdba57de46fce946cde7affaa1
SHA512 0bfd7e592c9dcbcf2acbe62a588b07a44c40047318fa3d11f459be4e6ac0493db7b860905cfc4ecc9ecc7242a7958413c4467aa27ba6b18e8135ca932a91f404
SSDEEP 192:sxZUR1yM/jK1Ml8Mcr/fbs3+WQ9SIdp/7/W6+WNsF6/Y0aQ8+GIg4J:sxZUf0r/fbs3+WUz/b1/5mtc
TLSH
T11552F706AA345977CCDBD309F945BB53D7F8447292810D48AAFCDA0C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31d8ffb8c82c2d7acdcc59ccf4372c3e1d3b66e914672d28c1fd02649f537a7f
MD5 3b6980b60ec0d4f3725dc6177cfe8efb
SHA1 95460bd60b326fd9c627e742664e0e1635f3c0c3
SHA512 5245dd9debefad54ed885f4542eb7fa9460bbec6d8be893f0a20bf190dc38c9e9adfde7dedeaf46bc91bb1b8fa1e21ef7e1e7abd395e57d926b13c525207aea1
SSDEEP 192:sxZUR1yM/jK1Ml8UQmcr/fbsr+4Q9SIdpZ7/W6+WNsF6/Y0aJw88+GIg5QJ:sxZUfqFr/fbsr+4Ud/b1/5GwVtG
TLSH
T13062F816AA345D77CCDBD209F945BB53D7F8447292910E48AAFCDA0C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0f029092cd0e76f72e8e94a9fefe79a19a11ad81d581566847417abe1fa7ff60
MD5 45c3bd4e57a9796ecc9bd8d09d2cc869
SHA1 d7c870981c8fbe4acfe3d1fb899c3a32e21080b8
SHA512 a95493cf695577e341eb8de76f284fe90d8528643ad62b1af91c1981c2572489008992e66d20d47f78028a612db3e7976c02488caa050f8eab21c1e995bcf749
SSDEEP 768:sb/zh8dF2K+7pLuLXEkWRmEcQXw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3eoO3Jjz:sb/zh8dF2K+EXEkWRmEcQXwu1jaKeB3F
TLSH
T1AD031C3F280CCBBE4F844E9CEC2A7E9B6EE8018B5698895447FA444C03C66DF56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d0f3faea9236cb4fba429461cd5ecd8ec882d1e459c568c761316ba4aed91783
MD5 a4a25bf3bcb91cfbce66b2ab3d6db8f4
SHA1 43da2328705deea1de5b5958bc9eac97e3690dde
SHA512 6714f3aa46987b04885f743701dc140dcce0ffcabd7857ba9370e8c775d0502fde74b5327a08e520a31a1f73cc7c05790ce8fb40e11c9f026757d99995a5f5c5
SSDEEP 48:KEWIHKvvtIFK+oQHyRAI3K9eMTy5CIfKjqwY:KEWgKvvtqK+oSiAAK9eS6CsKjqL
TLSH
T113B1599331B603C23C7E361CA695CB2B4A4172673255B52B7BE905B20D6BE205DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 456c8c5c6dc0eb48ac8d3716cb9f68fcb1356a09ac493f8d860ba0abb0ff3621
MD5 2edae27415f0baf45a1e79bd90f084eb
SHA1 ab02fa75ffa1301f08892dc511a353d18c1336a8
SHA512 2e76f816dee8cba916225ddffc97e313e286356402fce18549f5ee1e7b1090522614fee6f8e05aee5d4ed31c5a8da436aba360178b572e110bdb99cc4a0e1731
SSDEEP 192:uuQY8NpU2fQaD+r2U7FeQmiU1XjvY4nv0e+Fdms6wGzYuq86WZ0uXib25:nV8NpU2fFu0h7nnsRdmSxk0uXs25
TLSH
T1BC522A316C795C7749A7A505F48737579FB820B79AC62F88E2D8DF0D018B69C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5cdbba49dda516013157ce528a8ed77b26e1d3bcd3accdc2ef9a713174d3a273
MD5 c788ea52c8430cbb1c40b35dd22d4527
SHA1 28d6f0ee0ab2894b9c882d2fafaa39c1db8439e1
SHA512 cdd2111bed7360754739e588eab1cb7dd45ddccf976f72386e7750fb9c79c0f17692dd503f1363e5535358b5acd6d9bd5f4fef0307f08c6dd95eb35eb751c440
SSDEEP 384:n7BtNn/s3n9SS8NpUwFuMC7nKMHfaq9sRdmbxzVpG3d8tj8bx9q:lj+9vAGdyq9sR6xJ+yl8bvq
TLSH
T1B6C2F8F198D75832C9AE4343A37F7E465EBCD09374851A48B7C9AA0DCD4767FD206806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c9c7ca4dd5a2ac588966a2e337426259fcedfea48fc5e1dc89032e04ed33fc64
MD5 a8907d62cef24f597d9d57402e883fe0
SHA1 4e5a5231317894bfa55da426eb4d8b03f6e9af59
SHA512 7fcdb5e64bdab810a5e22b8ae9c704495826bc24785ccf681b4f17a5c7109791db7b8bb0b4570b21f0723eaa73e08c9b5abbf75d67e5ffb1394d1b6f777b75c3
SSDEEP 384:n9tNn/s3n9S88NpU3FuWh7nnsRdmDxzVpG3d8tj8bx9q:9j+9fflnsRExJ+yl8bvq
TLSH
T18E926C3558299C7249A79541F4877A4B5FB810F7C9C62F88E5D9EF0E00CEBAC131B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cfe6d785cfe185ca7c2005f471f65a004a25af26651d1122fc38882e7319a6d8
MD5 3f2f9bb494f4c6fd0edfc5c492c80fd7
SHA1 8ecb9d9732125ee99401d5608058707f04209d5c
SHA512 cb2c654249b249991e1b9195678def2ea3f303425116aaff105ee51cc90b837d9288dbe14778c3b81f8878ef5468eeea47ae2eefefd386907adecbe6a9cf4e9a
SSDEEP 384:n7xtNn/s3n9S1X8NYUwFuHC7nKMHfaqUsRdmOxzVpG3d8tj8bx9q:tj+9cXLBdyqUsRpxJ+yl8bvq
TLSH
T1C5D2F7F198D75832C8AE4343A37F7E465EBCD09374861A48B7C9AA0DCD4767FD20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33928a35dc2692f704ca795e377859b8889feacb9386c59f185e52c6245d786b
MD5 6ac55c509d76a2579ff4560108a94bc4
SHA1 cd045b435cc0ccb347900dee66918d90c2759304
SHA512 d62244f7224f84d7ce7f55e34c0f063b214933a4b55df79d3079a56aff4b3aec8153d769aa291da19e5823a24b1de684236ef61239db7b009e061c35b3edcddd
SSDEEP 192:BGN06P2UOcQmiUy4IU/qGv0e+FdmsRwSC4U6:BGN06eXsXIkqGsRdmWHU6
TLSH
T1A802D939AC782CBB8FA2AD45F48777175FE8106BEA962B84D5D81F0D00D765C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f5fafd43cf249353fddfefe68f9d47ce196fa4c22f033fb91dfc2ae0ff88c1f1
MD5 3b9e283c24d6de0fe0509a624dd5db35
SHA1 ef1bb5a6c0d7d8f8939adf10b58fe17c73b68962
SHA512 30c372b7621d7b45bbd0c227bb2eb5d200d6351521ca41c98dcfcdeb9f1a72c6e99ade319144998e2a4f44435dafac91320ab8b4556150859a54a0f726b60454
SSDEEP 384:nftNn/s3n9SR8NpUwFuMh7nnsRdmIxzVpG3d8tj8bx9q:fj+96AfnsRXxJ+yl8bvq
TLSH
T1D6927C3558299C7249A79541F4877A4B5FB810F7C9CA2F88E5D9EF0E00CEBAC131B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9d3de0b09d0087ef5198fc0299781108fb29c21d494e676a799326ae92e9fe7
MD5 d94e86338590a3107038aa94b2117b26
SHA1 4a26d83270d8ca90a45290b5d2dc29087d03572e
SHA512 9974585d02283a097cb8e94efe4fad0483f26076f395ef31b2736703ebab8c8049c9667575be7f98a6f3645517cad81efd3776c605c5e2f621968cc3ef68d35c
SSDEEP 192:BGNr6P2UPQmiUykE/VGv0e+Fdms6wX0Buq86U6:BGNr6eChUVGsRdmHxU6
TLSH
T16B1208356868AC770E96A501F4C737578FE810B7DE8A6F84E1D49F0D009BA9C370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92a3eaf4ab31913302ade0780f16b2dbe6cf46977d36c64f77aad3b253b1eac0
MD5 9496aecaf4015eb3f078a3d923deabf8
SHA1 a2b922b2f09c183b7ab8c912c60991815e556a8a
SHA512 ee955e2d067ef64410fd7369f7bf26f2a2126385e8507462f8704c003480fd9e82adf7aa7e7a4e0c81e91f7082eb597e78349b5f077069577de7ab380805e695
SSDEEP 384:ngCtNn/s3n9SA8NpUwFu7h7nnsRdmDxzVpG3d8tj8bx9q:gCj+9HAAnsRExJ+yl8bvq
TLSH
T147927C3558299C7209A79541F4877A4B5FB810F7C9CA2F98E5D9EF0E00CEBAC131B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8567c84bee1312881902baa7c57440109501d96639e4412bd74c9a179532da41
MD5 ffe7e0d4332a317cd1ae8664a508b8fa
SHA1 447c49dbc17a069045e270a34d888b24ad6c9358
SHA512 1be4093c0e6d2c0192252ac136915545e21331943d8c197a3639ffdd9d8ec6f8a1e7b6ccf0f2e8cb17f85e84eb8846951467b387b07e754b013222aab217092c
SSDEEP 384:n7StNn/s3n9SG8NYUwFupC7nKMHfaq9sRdmExzVpG3d8tj8bx9q:uj+9rLbdyq9sRLxJ+yl8bvq
TLSH
T13BC208F198D75832C8AE4383A37F7E465EBCD09374851A48B7C9AA0DCD4767FD20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ce30a5df74bb43b4a3c0133367dcdb78e689e8cb84699d21aede347e7e73a312
MD5 1916ffcd9bfdd8b4364a00f2e844cfec
SHA1 1a66b1f91d95952d171f7cfffee567bebbf98f22
SHA512 b41ac89c02e805ea27cd79cfdb8b6e780644876b3c5e9b27e39338eec4f847dfffa1481f317b00620718c180dd7b79c0eebf7fe7895f308952254d4c313bd2e7
SSDEEP 384:n7ttNn/s3n9S2X8NYUwFupC7nKMHfaqUsRdmExzVpG3d8tj8bx9q:Zj+9DXLbdyqUsRLxJ+yl8bvq
TLSH
T1D4D2F7F198D75932C8AE4343A37F7E465EBCD09374861A48B7C9AA0DCD4767FD20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cd6ba86cd47612c728b7eae1f68fe18e48cbdb7d203b71530cd1bc8b2cbd211b
MD5 444afdd896ed19fb89caf27c0905d540
SHA1 962a1c92ee636c3f121392468ee76cfeabc02105
SHA512 c8f06cb667caacba01dc035fccc1c13c2652ee53449376eb014f8528c3c2b158608a5282502d33bbb2accd6290c9d6c8435ee98b50557cf7af3281ea3c34105c
SSDEEP 384:n7StNn/s3n9SJ8NYUwFumC7nKMHfaqUsRdmVxzVpG3d8tj8bx9q:uj+98LcdyqUsRixJ+yl8bvq
TLSH
T186D2F8F198D75932C8AE4343A37E7E465EBCD09374861A48B7C9AE0DCD4767FD20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bb78b13-ee85-45f3-bfd8-5e4e9d7a7cb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2bb78b13-ee85-45f3-bfd8-5e4e9d7a7cb5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

496b699a-aa54-46a7-b571-e1c44602113c.tmp

Path C:\Users\Admin\AppData\Local\Temp\496b699a-aa54-46a7-b571-e1c44602113c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

fa157ebe-cbf9-4229-80a2-0a1c88586779.tmp

Path C:\Users\Admin\AppData\Local\Temp\fa157ebe-cbf9-4229-80a2-0a1c88586779.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb3e75df-3725-476a-9cc3-5e4c48e8eb36.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3416_1347470523\fb3e75df-3725-476a-9cc3-5e4c48e8eb36.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3416_315350696\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/724-689-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/872-531-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1704-717-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2452-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2564-495-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-713-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3240-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3356-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3356-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3624-579-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-757-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-657-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-639-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4208-737-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads