95a55508d4c9fde9271725ef7022dd95c575c1fc48bff7e076ac362842f21d30

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260629-dpdg2abz31
SHA256 95a55508d4c9fde9271725ef7022dd95c575c1fc48bff7e076ac362842f21d30
MD5 c39d51354ecd382d92c7a30673eaf3d6
SHA1 512e2d4fca82d3385843d196458c971a1e5fe866
SHA512 05b37f7cd182150906917fa3e1e36c60eb30a0a86e4ad8cf470e8e9026b936a33b57822aae4a9818654d98a8b60137ce6a9aae1f68ec52ac1fa517216550660c
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T16534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3852	CP.exe
5436	tqljdbvtnl.exe
4828	CP.exe
2240	CP.exe
1276	i_tqljdbvtnl.exe
5428	yvtnlfdyvt.sys
2576	CP.exe
7100	vqnigaysqk.exe
2864	CP.exe
6748	CP.exe
6528	i_vqnigaysqk.exe
6244	fdavtnliga.sys
6440	CP.exe
2884	xvqnigaxsq.exe
6732	CP.exe
6952	CP.exe
3900	i_xvqnigaxsq.exe
5776	ifdxvpnhfa.sys
800	CP.exe
2052	lfdxvpnhfa.exe
3192	CP.exe
1588	CP.exe
6508	i_lfdxvpnhfa.exe
2748	xvpnhfzxsp.sys
2316	CP.exe
5704	smkecausmk.exe
5936	CP.exe
4276	CP.exe
6336	i_smkecausmk.exe
4728	xrpmhfzxrp.sys
4788	CP.exe
2816	usmkeczxrp.exe
6972	CP.exe
1432	CP.exe
1168	i_usmkeczxrp.exe
2876	hbzusmkhbz.sys
1764	CP.exe
2584	ztrpjhbztr.exe
2716	CP.exe
812	CP.exe
3716	i_ztrpjhbztr.exe
6880	wrojhbztrl.sys
1932	CP.exe
6820	omgebzuomj.exe
6712	CP.exe
1420	CP.exe
1396	i_omgebzuomj.exe
824	bztrljgbyt.sys
2608	CP.exe
4400	bwtolgeywq.exe
2244	CP.exe
4960	CP.exe
7020	i_bwtolgeywq.exe
2812	dbvtqljdby.sys
3728	CP.exe
3124	aywqoigays.exe
2404	CP.exe
6988	CP.exe
2792	i_aywqoigays.exe
5788	qoigdywqoi.sys
5932	CP.exe
2664	qlxvtnlfdx.exe
5992	CP.exe
7124	CP.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1846397872\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1043373194\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1846397872\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1043373194\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Social	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjezwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebzuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	licavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trlgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebzuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlxvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjezwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlxvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvtnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_licavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trlgeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvtnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3248	ipconfig.exe
2156	ipconfig.exe
5988	ipconfig.exe
6432	ipconfig.exe
3972	ipconfig.exe
2384	ipconfig.exe
6736	ipconfig.exe
6872	ipconfig.exe
5656	ipconfig.exe
6724	ipconfig.exe
2300	ipconfig.exe
3232	ipconfig.exe
2124	ipconfig.exe
1808	ipconfig.exe
6796	ipconfig.exe
2284	ipconfig.exe
2300	ipconfig.exe
2284	ipconfig.exe
3884	ipconfig.exe
1180	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271762486632595"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-958335860-2021930596-4099878453-1000\{ADCD8AA5-18B2-4158-921D-03070993161A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5196	msedge.exe
5196	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6332	msedge.exe
6332	msedge.exe
6332	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	6528	i_vqnigaysqk.exe
Token: SeDebugPrivilege	3900	i_xvqnigaxsq.exe
Token: SeDebugPrivilege	6508	i_lfdxvpnhfa.exe
Token: SeDebugPrivilege	6336	i_smkecausmk.exe
Token: SeDebugPrivilege	1168	i_usmkeczxrp.exe
Token: SeDebugPrivilege	3716	i_ztrpjhbztr.exe
Token: SeDebugPrivilege	1396	i_omgebzuomj.exe
Token: SeDebugPrivilege	7020	i_bwtolgeywq.exe
Token: SeDebugPrivilege	2792	i_aywqoigays.exe
Token: SeDebugPrivilege	2692	i_qlxvtnlfdx.exe
Token: SeDebugPrivilege	6568	i_licavpnifa.exe
Token: SeDebugPrivilege	912	i_spkicausnk.exe
Token: SeDebugPrivilege	4992	i_ausmkecwup.exe
Token: SeDebugPrivilege	1192	i_upmkeczxrp.exe
Token: SeDebugPrivilege	3448	i_mjezwrpjhe.exe
Token: SeDebugPrivilege	3268	i_trlgeywqom.exe
Token: SeDebugPrivilege	2928	i_bytqljdbvt.exe
Token: SeDebugPrivilege	5792	i_ljdbvtolge.exe
Token: SeDebugPrivilege	2324	i_ifdxvtnlid.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 6312	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 6312 wrote to memory of 6332	6312	iexplore.exe	91
PID 6332 wrote to memory of 7164	6332	msedge.exe	92
PID 6332 wrote to memory of 1480	6332	msedge.exe	93
PID 6332 wrote to memory of 1900	6332	msedge.exe	95
PID 6332 wrote to memory of 1480	6332	msedge.exe	93
PID 6332 wrote to memory of 1480	6332	msedge.exe	93
PID 6332 wrote to memory of 2528	6332	msedge.exe	96
PID 6332 wrote to memory of 2528	6332	msedge.exe	96
PID 6332 wrote to memory of 1672	6332	msedge.exe	97
PID 6332 wrote to memory of 1672	6332	msedge.exe	97
PID 6332 wrote to memory of 1672	6332	msedge.exe	97
PID 6332 wrote to memory of 5496	6332	msedge.exe	98
PID 6332 wrote to memory of 5496	6332	msedge.exe	98
PID 6332 wrote to memory of 5496	6332	msedge.exe	98
PID 4840 wrote to memory of 3852	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 5436 wrote to memory of 4828	5436	tqljdbvtnl.exe	102
PID 6332 wrote to memory of 5744	6332	msedge.exe	105
PID 6332 wrote to memory of 2804	6332	msedge.exe	106
PID 6332 wrote to memory of 5744	6332	msedge.exe	105
PID 6332 wrote to memory of 2804	6332	msedge.exe	106
PID 6332 wrote to memory of 1068	6332	msedge.exe	108
PID 4840 wrote to memory of 2240	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4840 wrote to memory of 2576	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 7100 wrote to memory of 2864	7100	vqnigaysqk.exe	117
PID 4840 wrote to memory of 6748	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4840 wrote to memory of 6440	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2884 wrote to memory of 6732	2884	xvqnigaxsq.exe	126
PID 4840 wrote to memory of 6952	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4840 wrote to memory of 800	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2052 wrote to memory of 3192	2052	lfdxvpnhfa.exe	135
PID 4840 wrote to memory of 1588	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 6332 wrote to memory of 4252	6332	msedge.exe	141
PID 6332 wrote to memory of 4656	6332	msedge.exe	142
PID 6332 wrote to memory of 6316	6332	msedge.exe	143
PID 4840 wrote to memory of 2316	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5704 wrote to memory of 5936	5704	smkecausmk.exe	148
PID 4840 wrote to memory of 4276	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4840 wrote to memory of 4788	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 2816 wrote to memory of 6972	2816	usmkeczxrp.exe	157
PID 4840 wrote to memory of 1432	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4840 wrote to memory of 1764	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 2584 wrote to memory of 2716	2584	ztrpjhbztr.exe	166
PID 4840 wrote to memory of 812	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4840 wrote to memory of 1932	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 6820 wrote to memory of 6712	6820	omgebzuomj.exe	175
PID 4840 wrote to memory of 1420	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 6332 wrote to memory of 108	6332	msedge.exe	182
PID 6332 wrote to memory of 108	6332	msedge.exe	182
PID 4840 wrote to memory of 2608	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 4400 wrote to memory of 2244	4400	bwtolgeywq.exe	187
PID 4840 wrote to memory of 4960	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 4840 wrote to memory of 3728	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 3124 wrote to memory of 2404	3124	aywqoigays.exe	196
PID 4840 wrote to memory of 6988	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 4840 wrote to memory of 5932	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 2664 wrote to memory of 5992	2664	qlxvtnlfdx.exe	205
PID 4840 wrote to memory of 7124	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 6332 wrote to memory of 6276	6332	msedge.exe	212
PID 6332 wrote to memory of 6276	6332	msedge.exe	212
PID 4840 wrote to memory of 1200	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	213
PID 796 wrote to memory of 1168	796	licavpnifa.exe	215
PID 4840 wrote to memory of 2784	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	218
PID 4840 wrote to memory of 4092	4840	2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe	222

C:\Users\Admin\AppData\Local\Temp\2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_c39d51354ecd382d92c7a30673eaf3d6_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcf365c188,0x7ffcf365c194,0x7ffcf365c1a0
      4⤵
      PID:7164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,14865525147961617584,15674721440143284046,262144 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,10732485267853974600,5172545407371795865,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
      4⤵
      System Time Discovery
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,1173417874820904070,7741839723806513546,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:2528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2359214501087981417,5691364554222795512,2097152 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,15065262478198317654,13451390210847412064,2097152 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,7580670908686615215,7601188877858397737,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2368852265368132809,9986536517146927940,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3336138644480256762,14750065846293347810,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3336138644480256762,14750065846293347810,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11543830848969419083,11146546318851249545,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,16114988604049851867,9804601652339451100,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,8207815842927869171,17186187669173496591,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7599282683423644100,4847611367678421216,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,16163981149829482467,6571206907039172829,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:6276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,8900607519887958314,162675808581501340,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:14
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6000,i,16805132136066436772,7210796292679256549,262144 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7239393731902791930,7666349216970632779,524288 --field-trial-handle=2628,i,11073452058250557412,13214508326901293308,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
      4⤵
      PID:3232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2240
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2576
- - C:\Temp\vqnigaysqk.exe
    C:\Temp\vqnigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6748
- - C:\Temp\i_vqnigaysqk.exe
    C:\Temp\i_vqnigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnigaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6440
- - C:\Temp\xvqnigaxsq.exe
    C:\Temp\xvqnigaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnigaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6952
- - C:\Temp\i_xvqnigaxsq.exe
    C:\Temp\i_xvqnigaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Temp\lfdxvpnhfa.exe
    C:\Temp\lfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\i_lfdxvpnhfa.exe
    C:\Temp\i_lfdxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2316
- - C:\Temp\smkecausmk.exe
    C:\Temp\smkecausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Temp\i_smkecausmk.exe
    C:\Temp\i_smkecausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkeczxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\usmkeczxrp.exe
    C:\Temp\usmkeczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkeczxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\i_usmkeczxrp.exe
    C:\Temp\i_usmkeczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrpjhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1764
- - C:\Temp\ztrpjhbztr.exe
    C:\Temp\ztrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrpjhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:812
- - C:\Temp\i_ztrpjhbztr.exe
    C:\Temp\i_ztrpjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgebzuomj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Temp\omgebzuomj.exe
    C:\Temp\omgebzuomj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgebzuomj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\i_omgebzuomj.exe
    C:\Temp\i_omgebzuomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtolgeywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\bwtolgeywq.exe
    C:\Temp\bwtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtolgeywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_bwtolgeywq.exe
    C:\Temp\i_bwtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aywqoigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\aywqoigays.exe
    C:\Temp\aywqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aywqoigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6988
- - C:\Temp\i_aywqoigays.exe
    C:\Temp\i_aywqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlxvtnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\qlxvtnlfdx.exe
    C:\Temp\qlxvtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlxvtnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7124
- - C:\Temp\i_qlxvtnlfdx.exe
    C:\Temp\i_qlxvtnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\licavpnifa.exe ups_run
  2⤵
  PID:1200
- - C:\Temp\licavpnifa.exe
    C:\Temp\licavpnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_licavpnifa.exe ups_ins
  2⤵
  PID:2784
- - C:\Temp\i_licavpnifa.exe
    C:\Temp\i_licavpnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausnk.exe ups_run
  2⤵
  PID:4092
- - C:\Temp\spkicausnk.exe
    C:\Temp\spkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausnk.exe ups_ins
  2⤵
  PID:6868
- - C:\Temp\i_spkicausnk.exe
    C:\Temp\i_spkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecwup.exe ups_run
  2⤵
  PID:2088
- - C:\Temp\ausmkecwup.exe
    C:\Temp\ausmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecwup.exe ups_ins
  2⤵
  PID:1296
- - C:\Temp\i_ausmkecwup.exe
    C:\Temp\i_ausmkecwup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmkeczxrp.exe ups_run
  2⤵
  PID:6412
- - C:\Temp\upmkeczxrp.exe
    C:\Temp\upmkeczxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmkeczxrp.exe ups_ins
  2⤵
  PID:5316
- - C:\Temp\i_upmkeczxrp.exe
    C:\Temp\i_upmkeczxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjezwrpjhe.exe ups_run
  2⤵
  PID:2792
- - C:\Temp\mjezwrpjhe.exe
    C:\Temp\mjezwrpjhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjezwrpjhe.exe ups_ins
  2⤵
  PID:6872
- - C:\Temp\i_mjezwrpjhe.exe
    C:\Temp\i_mjezwrpjhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trlgeywqom.exe ups_run
  2⤵
  PID:4292
- - C:\Temp\trlgeywqom.exe
    C:\Temp\trlgeywqom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trlgeywqom.exe ups_ins
  2⤵
  PID:616
- - C:\Temp\i_trlgeywqom.exe
    C:\Temp\i_trlgeywqom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  PID:1724
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  PID:7032
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  PID:7148
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  PID:5800
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxvtnlid.exe ups_run
  2⤵
  PID:1892
- - C:\Temp\ifdxvtnlid.exe
    C:\Temp\ifdxvtnlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxvtnlid.exe ups_ins
  2⤵
  PID:3368
- - C:\Temp\i_ifdxvtnlid.exe
    C:\Temp\i_ifdxvtnlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidxvpnk.exe ups_run
  2⤵
  PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1628

C:\Temp\yvtnlfdyvt.sys
C:\Temp\yvtnlfdyvt.sys
1⤵
- Executes dropped EXE
PID:5428

C:\Temp\fdavtnliga.sys
C:\Temp\fdavtnliga.sys
1⤵
- Executes dropped EXE
PID:6244

C:\Temp\ifdxvpnhfa.sys
C:\Temp\ifdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\xvpnhfzxsp.sys
C:\Temp\xvpnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:2748

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\hbzusmkhbz.sys
C:\Temp\hbzusmkhbz.sys
1⤵
- Executes dropped EXE
PID:2876

C:\Temp\wrojhbztrl.sys
C:\Temp\wrojhbztrl.sys
1⤵
- Executes dropped EXE
PID:6880

C:\Temp\bztrljgbyt.sys
C:\Temp\bztrljgbyt.sys
1⤵
- Executes dropped EXE
PID:824

C:\Temp\dbvtqljdby.sys
C:\Temp\dbvtqljdby.sys
1⤵
- Executes dropped EXE
PID:2812

C:\Temp\qoigdywqoi.sys
C:\Temp\qoigdywqoi.sys
1⤵
- Executes dropped EXE
PID:5788

C:\Temp\sqnigayvqk.sys
C:\Temp\sqnigayvqk.sys
1⤵
PID:1016

C:\Temp\smkifdxvpn.sys
C:\Temp\smkifdxvpn.sys
1⤵
PID:1888

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
PID:6796

C:\Temp\smkeczurpm.sys
C:\Temp\smkeczurpm.sys
1⤵
PID:5880

C:\Temp\mjebzurpjh.sys
C:\Temp\mjebzurpjh.sys
1⤵
PID:6480

C:\Temp\trlgeywqom.sys
C:\Temp\trlgeywqom.sys
1⤵
PID:1116

C:\Temp\jdbztrljgb.sys
C:\Temp\jdbztrljgb.sys
1⤵
PID:2132

C:\Temp\igdyvtnlig.sys
C:\Temp\igdyvtnlig.sys
1⤵
PID:3912

C:\Temp\ligaysqnlf.sys
C:\Temp\ligaysqnlf.sys
1⤵
PID:248

C:\Temp\qnkfdavpni.sys
C:\Temp\qnkfdavpni.sys
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdavtnliga.sys

Path C:\Temp\fdavtnliga.sys
Size 141KB
SHA256 ab05a8aa1f8d8fdfab008b1b39cedbbb8c2be4e0b00e8274f6185c073cbecd6b
MD5 5d6b9666d1c600a46bfd61659c9f2f38
SHA1 f9713815eefb6a3315189d0bfb400291a382d441
SHA512 d29a47abe2c5cb52e3429719d3bb1cbc3061aeb894816be00b8095f0f75e591cf4d60944fc242d63ed6a37957d9d2973d3dc88cc241020587fd1dd9e5cf23e47
SSDEEP 1536:Xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzusmkhbz.sys

Path C:\Temp\hbzusmkhbz.sys
Size 141KB
SHA256 1cdc3d8983f9666587b5fe2cdda9abfebf9b0fe00b58e90f8ed0b43dad5494a8
MD5 5b54d86c84b12d6f14863585182b4b9a
SHA1 a47092a37d3e4d94da79b965f6c641c9ada33dd3
SHA512 2102aaff8c0e6f10b7c1a87046bc1d7d65eafefe61171394d420043ae41c57b4a5564be6d9c5a8c26d563112ee4f855001cac98004fd2c98a3d7dba82b0a000f
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnhfa.exe

Path C:\Temp\i_lfdxvpnhfa.exe
Size 226KB
SHA256 6e6308a4006697c84166547190ae1f95fe505e59c5ecd8bf899290add02ee295
MD5 0a562463daca0b09a5dbc3fd19b03350
SHA1 cb8b52a5ee96e011239108fccacc2f23842ae1f0
SHA512 9896b2eeb968159683b5f5287afb918aee257b6e4cd81ecc9be940000d2a8b8e919973ce4795ec52a7d76f30cdb1c1cee22ae530c32931ec8af97529d8ffd4f4
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1D834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecausmk.exe

Path C:\Temp\i_smkecausmk.exe
Size 226KB
SHA256 d933bc6e918a753d3260724934ec88a294bdf5b50a0291d1ef55f1e4753645ec
MD5 6a8f6f4b73850906e9803e902ac68fda
SHA1 53681ffebf178d8e1ac4d5bf7cbe9b68cf673526
SHA512 45921e7644a63d8e8ef67e22276f064ce51af5acf74d1097bb91d5f024564e3e4dea271e618ea2e41711775320d4c2eee11053cf1c44fe4bdc26d56b0218be27
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1B434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvtnl.exe

Path C:\Temp\i_tqljdbvtnl.exe
Size 226KB
SHA256 428c42d3b3e8ef16924f2e33983823467a40f5fa43de037fee96c0c497955d2f
MD5 e70b3ce86588533535e0306e61ba5c72
SHA1 69ae94b5f9cbdb7bb2a46fb06f0a4b9807630727
SHA512 fc2aa0c3ff14b2507503a6a18755354714567f46011fef11db48521fa1aaf59ed477911c826a09a93f326ea32dfdaa4b65c71269a8cc657cfd37f2a4f7340596
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkeczxrp.exe

Path C:\Temp\i_usmkeczxrp.exe
Size 226KB
SHA256 23a7d36ae559104244282775113676209f2295c44a9dd747a9ebe61b8d60e1db
MD5 79ad878d646efad19bafb451d0fcd788
SHA1 e8660ff816b91f2a0e3256287eaee2eca0bac23d
SHA512 377268661affc70ff116b5e69b11d405a4b150fe014954da8f0fe60894cf961cf17a59d0ded2893ccb1236af04d7c0f9cf475d283caaaf92b43a2da9cbacd87a
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T11334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnigaysqk.exe

Path C:\Temp\i_vqnigaysqk.exe
Size 226KB
SHA256 a2f8fc27ee85472402559580291603dd1c0e60aeda73e3f50c9960e5a0420a59
MD5 855efbfc91545b46c2ef64e2d90bd4c3
SHA1 e689666eeabfc36c19dc811ca94a7cc67146e2bd
SHA512 6b426dd002d53241149c5288339c5183449e6304821b6bc8e3cac9b0955a6d0de9a9da29086621a4c057ab7613f182ab8bcdbb417be82cb5543b420ee2b4f035
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnigaxsq.exe

Path C:\Temp\i_xvqnigaxsq.exe
Size 226KB
SHA256 e97d7eb2b78c51bd143a14d81ddb96ef3ca23e7f1b8000dd47cbb12511abf326
MD5 ed0038b2b04e231a923cd6549a8ef823
SHA1 9ac6181e0cefa6d81ba0068c41fb215d25b62d8c
SHA512 4ca9b04afdb447c47f8638e9e6de5d73b12c03fd85d7697e53c73f9b6adb3b6d06ff16618df6d13ef8632b5db61de48b0a44531c1fd13a9dac971a0c7d407415
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T10C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvpnhfa.sys

Path C:\Temp\ifdxvpnhfa.sys
Size 141KB
SHA256 16cc42a337b0595bf910d6981b3dba75f1f2ef1aaf82b62a91a072c5c7c89132
MD5 39d2feb3789eb7597fdb39e075c7469f
SHA1 aa39e8a09424cf3e5e28255016e96456e29dfd5f
SHA512 23810796f0bfe88875a1092847e150a4e72dba6b24f23c37c4896e6825f54eedc41940903e6916285000201056974309e93156cb31ece190f12ec116574378ef
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnhfa.exe

Path C:\Temp\lfdxvpnhfa.exe
Size 226KB
SHA256 1f2e589cfb85520f3259d0038ff5c4ebe5f92cfd0ef651f1ce5494cd8299a100
MD5 f8612e8d65179af49fd83633306d3fe7
SHA1 3ad8a5a8f8b0832e521e23666f511764dfd13c76
SHA512 9432596725817b8831cc23884be5dee1cbc28018166f0ae9f5dc6ef59abdcd82d77f6bda5701aa77b10461e6f1e1d5121255b31946daa0bfc79becb6f01af873
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T15334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecausmk.exe

Path C:\Temp\smkecausmk.exe
Size 226KB
SHA256 03a7fa4ba895e0f965fa458693bdaf2afc13b2be836d897db6387efb07867467
MD5 bf403846ab2267f663a7a1b45b14cf2c
SHA1 7accb1e870d2818488b934dfc0fe63d02d21ab44
SHA512 d10ac46d06dabc68187671783666595d7bcfa80d0707ac6912b43bb1619f08d94504dcce00c1c6f10799ff9e5175b826070ef2ecf8e07a1b817f9456797fd1f6
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T18134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.exe

Path C:\Temp\tqljdbvtnl.exe
Size 226KB
SHA256 8e7298cd992696a80b6d1cd2fa0b6cda6fbc70df0e36dee06e8f7a468acd1b3a
MD5 2ce5012811a71bd25d673283d7949d99
SHA1 f3d780b234a2f57364a17d5f8838cd08d2d67fd1
SHA512 353b365030f6553bfdae0f47b7d0d767723a43e9e3aa0d2837bb9e4e49917eb247599c9ddfd38063cb920cc351e924405f4b31ea6a57f6c4f08a703168cd4842
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T19234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkeczxrp.exe

Path C:\Temp\usmkeczxrp.exe
Size 226KB
SHA256 fb042b6207c9359e311cdc1cd49918df2a75c715a8730f8b0006b76fbebb239d
MD5 c97ecd47a2125ce8180f6b22bd8d636c
SHA1 93febc9a1b3d9e0c971ca799141f9d92a5f91846
SHA512 7802f73c2ba39c8e612b1c599f3cbcd951c5f8b1cba0e3a2cecaf4f8b289109e4d0addcbd33b67b79751f8800f90c3b4a8f247755d74b47bf89aeb39c993c02c
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1ED34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaysqk.exe

Path C:\Temp\vqnigaysqk.exe
Size 226KB
SHA256 1e7f2bd3beaa1f028750db8d8489d20d6da34a9fafadd4500f85a0f9240d6d8b
MD5 d3fd742e4b2aad3a593ba7a15ca6de27
SHA1 ee531311a3e157f434c4e75110d21c9dbf1d5a2b
SHA512 f53505d3a7b4cc5ef7f1fb370b3ee38b6cfdbff55f7b2fbfc5a9553aaa6a41629ccf2995054214ecfa8853c74f52b3d66153adcb7bbe07081b96fc30a3541464
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T1FC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmhfzxrp.sys

Path C:\Temp\xrpmhfzxrp.sys
Size 141KB
SHA256 86651248eb0e3e2933f909a776160bb91e45e60d26326d35fdb0903f0d672db2
MD5 acf0e749d8f0bfbf11a42b1110338ceb
SHA1 babe08d6b993e32e43ac876adfdc08a0aa04b924
SHA512 a518241f5a9119e2539d7f26bc571d7cd9d184a0a9281c94fd002a4ae954e89579e67baa53fb9dfc474644b7d33d497165250069fe9ab0e5705d546d8450732f
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12CE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnhfzxsp.sys

Path C:\Temp\xvpnhfzxsp.sys
Size 141KB
SHA256 485b09c22a31615983fc1a5d5220d1678346c24d33fdc020da123d39069773c1
MD5 2c0f6345525aefd54a89e8d612824b7e
SHA1 886f6aeb7a78f89a5908c305201721c5d4b00eb3
SHA512 cb9ab6463a39045279954b7c3b25bac51550af1e5fd06b92dd1fb82dc865fbc6e563d4cbee2053194defa93892e7135afbfbdcbeeed7854900b5f5485ad60925
SSDEEP 1536:ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnigaxsq.exe

Path C:\Temp\xvqnigaxsq.exe
Size 226KB
SHA256 d1e824ac08ca6e8aa2aa6c4324fe1aa6d86290f3eb7d5a2caf92b7cd641320ed
MD5 7b26ccab6d85e130998bd598a98084fa
SHA1 cc229861577f58379302c1f94ebed0f2ec17a224
SHA512 673bf66e62aca79b95b323ea312f18f0144457d96babd2e69458b3a945b7f7d2a6cee6b51afd3a69660e065053450c8a8bc926e3aa41e1253eebb98bd6347e54
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvt.sys

Path C:\Temp\yvtnlfdyvt.sys
Size 141KB
SHA256 5df3329fe6ebd45c599567e771651c1f734627f6e28f7a873a27181c4c9f7ad8
MD5 c8800587fcb51e08342e8ea610d9648a
SHA1 3a77362e7bf7cd017c6056e8bb0cfe63581d9e76
SHA512 972764b7470bfa75c305b94a2a33c802497f31cc176510a0b51e82955a7630743bc929fb9ce5d2544bf6e0039f9d22fcda5739d3ff67524873cf265ed9d81cb5
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CAE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrpjhbztr.exe

Path C:\Temp\ztrpjhbztr.exe
Size 226KB
SHA256 24266a389651ee0568ccbb04c184f761e04c9751ac59ddb3e53613cc3fa1402e
MD5 677f42c907420839b1f2da6bdea22d93
SHA1 0d065fd15965f4869c0924a0961456176326eabc
SHA512 dbbd8ea18465653c7cf96c4c3e0c61c24f893c8968a3b84fb73a8a44af7193484258f7f2857990688b5b016f4521e111f44798c44544d67b94d1c183250676c8
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19509664097c265b613b84702dd83a5bf5de055759de5b566057524c40ef7e6a
MD5 21b7bb74a7a973f055e2b6a521d9b7cb
SHA1 3d70b3b2cde84afbf3f8734366a34038d4e9a9d8
SHA512 c0e322927c0dd573b4065c0af844b7689ba9ed346bc20367531c7f58dfc0db9d330f64bb479ece7c9e93e6ef8165c09293c33482618cb351288c8e942ef968f0
TLSH
T109D0C03136146102C21A22B06C00631C605D82123192C10774E1E00ECC9FA60B7C6503
MD5 SHA1 SHA512 TLSH

Submit Download

717dd0c0-6cb6-4bee-8a46-a68af235b8d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\717dd0c0-6cb6-4bee-8a46-a68af235b8d4.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 fa542aed6118e3dc7be70035ddbc6c6218383b28e636209019bce191547c398d
MD5 b28b7766e814b3e2717ebff29311a6cf
SHA1 24b12d197e63f79c0ee455b030e5701f4ecd3ec9
SHA512 74ca209572a7d87450abab1b5465320328f331c8591bb35dea0629e6154c65ae280e6c4812c81f25c46b2fa5bcd926326e9151411f5cb2807f646a7944b84ce5
TLSH
T12CF0F4B5CD25AC3718FD1B2820940B4BE79013572751889B7A3E920C4FB163B564682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 861fd64fcd655e4da831103383a27c0bc9cc73f0387d6c5328ee126661ca7368
MD5 44e077eaf658accfce35dc18d15e901c
SHA1 9efbc76d49223fdb454cecce920b21e95956c67e
SHA512 4804198837c9db1ac01310a117033ea1bd42f0f505a76d1cc6d63378d172d2c6ed54f0612263be2b28c4cde6c581481b583ec76cc18db7bb8f690bb7ee3a59e3
TLSH
T1BD41BFF383E4856D890196F0B618AE2FDE1D0514832C3D5AC9E4AF1BD3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4ef503570de91a3269a816216e3e29ba0f607182763311982c9e97c0079e8c10
MD5 08e6123c5e272d6df354ff6bd6f285f8
SHA1 21d85c78fce2373b03b606713832ce1021b772c0
SHA512 74b4a0cf4abc96856b501a160211992dd4539610931f58c619590ee79b441aebc75423ef6df428870a367d3c0c5f1d98d6a0fb78ea2526ff8396b938d7b9667a
SSDEEP 192:sxR6R0yMqZjK1Ml8wcs/fms/+cZaJ0/RxzoA8pro/g6+WNCbw/Y/vKPG2IgjRJ:sxR6dCs/fms/+iU0/RsU/5//Djb
TLSH
T17F72C81A6938997BCCDBD209FA457B53D6F81573E2845E44AAFC8B0C04E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f79ea30938faae8a7a1bc8c35c5cc233056888129bd135725f34436148512b75
MD5 535f2febd4b502eeff2eba9474ca33fd
SHA1 6838709bb5386272dabf6a16dfbd4eefdeee0f21
SHA512 a2077d0ad830e85430ccb08bea35017ef7e61f55e80d919cfebbaaa3dc7dea072b4a0717a010b61bcc1a49d25f68d498ca883d938d7f1a41daabbb62a472a3e8
SSDEEP 192:sxR6R0yMqZjK1Ml8UQVcs/fms90cZaJ0/RxzoA8pro/g6+WNCbw/Y/viPG2IgDzR:sxR6dqas/fms90iU0/RsU/5//JPR
TLSH
T11772D81A6538997BCCDBD209F6857F53D6F85573A2854E48AAFC8B0C01E7ADC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b937bc3a93f89b75e8798bbd7a60218db32e2b045bc5bbc0a8501050db0e8c13
MD5 b6e29e3befbb27d3c38b107250d1903a
SHA1 e64f872c7091905f589db8839c2fa3f807f9c390
SHA512 5c7e00c3d1e2f19645563f7366a9d1c7db715d5555fc44475c3405bd249fb1dd9acdac550727e523e6068027f44d8a81bddc1fe07cc640d2c3dc8fc4139c6acb
SSDEEP 768:zEX1hN7pLuL7w9WgLLfzE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXFmZwD/rooUE15:zEX1h7E7w9WgLLfzEu1ja4Fm2DsoUM
TLSH
T186E2FC3B680CCB7E4F444ADCEC29BD9B6DE802CF96D8895447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 85f26226b4a027544e9fe34a555a461865045ca910eef9e40152e409db3f972b
MD5 74b9a05754cfced373ddffa31760284f
SHA1 d147b478d7a85fba0374f9f9915a1917ae755d4b
SHA512 823a74fd3a0961b9f315294977699d61bc16dbb3bed13c0cf9dc599adfb2cb26f42b78ef2503b2986368da8b991751c6a82e68fad6d8ee87425a8aa526ddf559
SSDEEP 384:83lTzBt/l8joMOimxiVwEQhoGhsM1OsBcxGNwqcje:83lTzBt/l8joMOimxiVwEQhoGhsM1OsJ
TLSH
T10CB247107A7E264038BE290CE1A5956F674130B3301AB63F7BBD60E51EA7E005EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4268a52e52ad97f670e2433d878377b4269942dc5fe9ebe9e2961084013b2e04
MD5 22805b9f822e1d1558e22ccb6bb67b9e
SHA1 ffb6960514ac9309b094c6e9ed82f222ca52c047
SHA512 2af5da3754a893501831068ad351a4da9bea1d9c8a673f4ae67bfb38020a46f57ac19afa95f58948a3eaff09a6bfbf3a2fc2beae26eb96defe4b8a98759d2604
SSDEEP 768:aF1j+9IZwgQq+xquGV0mzUUyrp9Mi+0ha4vr:/9I0e0SUfr8ig4vr
TLSH
T16BC23A32DCA4DAABEDF65FD9B709764BAEE001A3C5D859D8DAD82D4C00872DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e2f9f22149583eea9717c684200fba96aca8979b27f674209644911d5aef8d10
MD5 cfdf4da05238473d98967b02ec53b82a
SHA1 0ff77fe7a1e4cdd4ba77bf925c1776868a1ae6c4
SHA512 327db1548a1e6e8abfce20e29e7e6b867fd5142c4bfa9203c41a7237ac7d96621827adecd9379b64f4982387aedf9f409af8f514ef0d72158fcd53bdb2fe40c3
SSDEEP 768:aF1j+9J6wg7qG6quGV0mzUUyrpofNmmn12bfJw:/9Jje0SUfryf40yJw
TLSH
T13FD24A32D8A4CE67ACE78BC9B74A7647EEE441A3C5C85AD8DAD85E4C00D72DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9aeb558830a89cb0d7b65415fd333e293e86528fa78f25062806c04badba1d6a
MD5 7b38b5217ec88066eecb3f63facba37a
SHA1 50f8462bd07d754cfe972f48d13b419acf771ee4
SHA512 120abea23bc017ea293ea5754fb714677da3d2fb75ddea40e6027a18d0b13037cc71bd64f01742a311a6f11466f2b232592e6c972a56163542b9571d35ef5208
SSDEEP 768:GF1j+9I6wg7q46quGV0mzUUyrpofdmmn12bfJw:z9Ide0SUfryfo0yJw
TLSH
T167E2C4F298D78977E8AE4B87673D2E0699FCC163B5885994B7C81D0CCC931BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 59427e4f7722e77bdc6c139c77074fccf130148255fde35b802fbef83aed5b3f
MD5 8d52b0bdab9a02753e880a4786c4ad1d
SHA1 3b1e6fc47242394501a0eaa6fc9073b5b64415c6
SHA512 141acc5502648005100fd0a516a008a474431534f4837c11d9d7531af39ae8c4a73bbeb37fc2daf60b6789c3316a4e4324a048cd4814a92eea3e45fab7b9dd94
SSDEEP 768:BF1j+9J6wg7qq6quGV0mzUUyrpof/mjuvC:A9Jve0SUfryfOqvC
TLSH
T15CB22A32D8A4DD67ADEB8BC9B7497647EEF0016385C85AD8DAD86E4C00D72DD070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cfccc6d-58ec-40e4-9d6d-039988289be1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\9cfccc6d-58ec-40e4-9d6d-039988289be1.tmp
Size 1KB
SHA256 8f3f529ddcc30acdfcfae833343bdc0b63ed422f30e1e6277347faaaab6631d3
MD5 9bafb2ddffbf8758e8372efaf16ca836
SHA1 6848c227df7af60869b3332a92b22d7be63b3a55
SHA512 3dc125ed4c0da71e42265770ee65296052eb2bd7940aefef2759ac9f3a03c2fe61f3dd6c3d8e601422175d7b1170512666465ff7e0884988ad4d02946b1b723c
TLSH
T1E03141E1583C1EC2C4BE0DAFA09B39FC94D8C326F5A470392898ED58523D65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 14462839ffd555bc98546f8d1b3e4dd6f030c03d221ee9448551c897d9a91e26
MD5 8434b4164633ce185686875427fefa9a
SHA1 a757fc320952c7ac5a3fee1b35249af99f4b609e
SHA512 e4cc648fe7a58cf0905bb3291e9ca95b28f316c781eb6503882ca524da3450d63ef339071b02954afb63c14a011d8696c39946ac0ec29cd0632a671654bcbe7c
TLSH
T12A3161E0583C2EC2C4BE0DAFA09B38FC94D8C726F5A4347D6854EC98463D55E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 43d9d7f422353ab6287101d7acc431a6c7e8bdbabfb18b33af64baa092b288d2
MD5 0d42f16d5d584cea6755d4dd93efdd67
SHA1 e161d9d869dc260514b4bb229c72391bfb6f24a3
SHA512 c340c0ccf898f5c643944358f3757813e4d002874babe65e7a4bfd88bc03ee75c56ab38d0811db0fb05b5059ce85ffd19465be588c614fe615e224d41c4484dd
TLSH
T1A93140E1583D1ED2C4BE0CAFA09B39FC94D8C326F5A470796894ED98563DA5E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6332_1601018085\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/248-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/824-277-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1016-302-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1116-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1888-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-257-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2748-212-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2812-281-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3912-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5428-144-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5776-218-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5776-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5788-298-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5880-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6244-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6480-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6796-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6880-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download