d9ad2e3f7d1a015140ffa8d41004de465bf76c8ec521adb9390057986109ac71

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260730-v5dw6sda37
SHA256 d9ad2e3f7d1a015140ffa8d41004de465bf76c8ec521adb9390057986109ac71
MD5 6773ec395b21fbb060a0271a875e2d02
SHA1 b07da53f019f2b12f25ba63a0f3976ff8d7b1dee
SHA512 598b8f2fb525527e37f76a7268d36acedffd9cbef2021b3d80fdb342830819acb1d1a6d81f8aa14a16be0c0df0701e4357e313e5a85c30f3cfb91ff3f99f6f8c
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3508	CP.exe
5068	wrpjhbwrmg.exe
4384	CP.exe
5952	CP.exe
2132	i_wrpjhbwrmg.exe
4896	jdbwtomgey.sys
676	CP.exe
2488	eywtomgdbv.exe
4512	CP.exe
4308	CP.exe
5628	i_eywtomgdbv.exe
2396	qolgdywqoi.sys
620	CP.exe
3580	lidbvtnljg.exe
4768	CP.exe
708	CP.exe
3700	i_lidbvtnljg.exe
2132	davtqnifdx.sys
5416	CP.exe
1744	dxvpnlfdav.exe
4208	CP.exe
2012	CP.exe
2904	i_dxvpnlfdav.exe
596	kifaysqkid.sys
5652	CP.exe
5628	xusnkfcaus.exe
2944	CP.exe
3548	CP.exe
3352	i_xusnkfcaus.exe
5728	axspkhfcxs.sys
2996	CP.exe
5768	axspnhfcax.exe
3140	CP.exe
4192	CP.exe
1560	i_axspnhfcax.exe
4272	ezxupnhfzx.sys
1528	CP.exe
2468	zxsmkecwup.exe
5900	CP.exe
5316	CP.exe
204	i_zxsmkecwup.exe
4176	urmkezwuom.sys
4108	CP.exe
1264	xrpjhbzurm.exe
3192	CP.exe
4592	CP.exe
6020	i_xrpjhbzurm.exe
2132	ebwurmjhez.sys
5144	CP.exe
5248	rljebwtrlj.exe
4972	CP.exe
616	CP.exe
3348	i_rljebwtrlj.exe
2124	ztrljdbwto.sys
2696	CP.exe
204	uolgeywtom.exe
1424	CP.exe
3592	CP.exe
1956	i_uolgeywtom.exe
4796	jdbytqlgdy.sys
3352	CP.exe
6020	dbvtnlgdyv.exe
4232	CP.exe
1192	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1373006201\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1373006201\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1630733079\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1373006201\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_1383743406\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5012_196651574\_locales\mk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnhfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxsmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtomgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uolgeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbwrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnhfcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnkifdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnlfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uolgeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausmkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtomgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausmkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnkifdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbwrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnlfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxsmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2584	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5752	ipconfig.exe
2672	ipconfig.exe
1536	ipconfig.exe
5252	ipconfig.exe
5856	ipconfig.exe
2476	ipconfig.exe
756	ipconfig.exe
2228	ipconfig.exe
4460	ipconfig.exe
5676	ipconfig.exe
700	ipconfig.exe
5424	ipconfig.exe
5856	ipconfig.exe
1876	ipconfig.exe
5564	ipconfig.exe
2704	ipconfig.exe
6052	ipconfig.exe
5736	ipconfig.exe
5828	ipconfig.exe
3348	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299064566817876"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{2BC0BE38-0164-45C0-A073-9FEF3C63D51B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2800	msedge.exe
2800	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2132	i_wrpjhbwrmg.exe
Token: SeDebugPrivilege	5628	i_eywtomgdbv.exe
Token: SeDebugPrivilege	3700	i_lidbvtnljg.exe
Token: SeDebugPrivilege	2904	i_dxvpnlfdav.exe
Token: SeDebugPrivilege	3352	i_xusnkfcaus.exe
Token: SeDebugPrivilege	1560	i_axspnhfcax.exe
Token: SeDebugPrivilege	204	i_zxsmkecwup.exe
Token: SeDebugPrivilege	6020	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	3348	i_rljebwtrlj.exe
Token: SeDebugPrivilege	1956	i_uolgeywtom.exe
Token: SeDebugPrivilege	2100	i_dbvtnlgdyv.exe
Token: SeDebugPrivilege	2192	i_davtnkifdy.exe
Token: SeDebugPrivilege	5492	i_vsnlfdxsqn.exe
Token: SeDebugPrivilege	5268	i_fcausmkica.exe
Token: SeDebugPrivilege	4848	i_hfcxusmkfc.exe
Token: SeDebugPrivilege	3456	i_ecxrpjhbzu.exe
Token: SeDebugPrivilege	3336	i_rljebzwrpj.exe
Token: SeDebugPrivilege	1272	i_trojgbzwro.exe
Token: SeDebugPrivilege	4432	i_tqljgbytqo.exe
Token: SeDebugPrivilege	5528	i_sqlidavtnl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3492	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3492 wrote to memory of 5012	3492	iexplore.exe	90
PID 5012 wrote to memory of 5548	5012	msedge.exe	91
PID 5012 wrote to memory of 4904	5012	msedge.exe	92
PID 5012 wrote to memory of 2584	5012	msedge.exe	93
PID 5012 wrote to memory of 4904	5012	msedge.exe	92
PID 5012 wrote to memory of 4904	5012	msedge.exe	92
PID 5012 wrote to memory of 3440	5012	msedge.exe	94
PID 5012 wrote to memory of 3440	5012	msedge.exe	94
PID 5012 wrote to memory of 3184	5012	msedge.exe	96
PID 5012 wrote to memory of 3184	5012	msedge.exe	96
PID 5012 wrote to memory of 3184	5012	msedge.exe	96
PID 5012 wrote to memory of 3868	5012	msedge.exe	97
PID 5012 wrote to memory of 3868	5012	msedge.exe	97
PID 5012 wrote to memory of 3868	5012	msedge.exe	97
PID 5012 wrote to memory of 2848	5012	msedge.exe	98
PID 5012 wrote to memory of 2056	5012	msedge.exe	99
PID 5012 wrote to memory of 2848	5012	msedge.exe	98
PID 5012 wrote to memory of 2848	5012	msedge.exe	98
PID 5012 wrote to memory of 2056	5012	msedge.exe	99
PID 5012 wrote to memory of 2056	5012	msedge.exe	99
PID 5012 wrote to memory of 2544	5012	msedge.exe	101
PID 5012 wrote to memory of 2544	5012	msedge.exe	101
PID 5012 wrote to memory of 2320	5012	msedge.exe	102
PID 5012 wrote to memory of 4592	5012	msedge.exe	103
PID 5012 wrote to memory of 2320	5012	msedge.exe	102
PID 5012 wrote to memory of 4592	5012	msedge.exe	103
PID 5064 wrote to memory of 3508	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 5012 wrote to memory of 2364	5012	msedge.exe	107
PID 5068 wrote to memory of 4384	5068	wrpjhbwrmg.exe	109
PID 5012 wrote to memory of 4540	5012	msedge.exe	112
PID 5012 wrote to memory of 4540	5012	msedge.exe	112
PID 5012 wrote to memory of 5820	5012	msedge.exe	113
PID 5012 wrote to memory of 5820	5012	msedge.exe	113
PID 5012 wrote to memory of 6088	5012	msedge.exe	116
PID 5012 wrote to memory of 6088	5012	msedge.exe	116
PID 5012 wrote to memory of 3244	5012	msedge.exe	117
PID 5012 wrote to memory of 3244	5012	msedge.exe	117
PID 5064 wrote to memory of 5952	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 5064 wrote to memory of 676	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 2488 wrote to memory of 4512	2488	eywtomgdbv.exe	124
PID 5064 wrote to memory of 4308	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 5064 wrote to memory of 620	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 3580 wrote to memory of 4768	3580	lidbvtnljg.exe	133
PID 5064 wrote to memory of 708	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 5064 wrote to memory of 5416	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 1744 wrote to memory of 4208	1744	dxvpnlfdav.exe	142
PID 5064 wrote to memory of 2012	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5012 wrote to memory of 5316	5012	msedge.exe	148
PID 5012 wrote to memory of 2872	5012	msedge.exe	149
PID 5012 wrote to memory of 572	5012	msedge.exe	150
PID 5064 wrote to memory of 5652	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 5628 wrote to memory of 2944	5628	xusnkfcaus.exe	155
PID 5064 wrote to memory of 3548	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5064 wrote to memory of 2996	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 5768 wrote to memory of 3140	5768	axspnhfcax.exe	164
PID 5064 wrote to memory of 4192	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 5064 wrote to memory of 1528	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 2468 wrote to memory of 5900	2468	zxsmkecwup.exe	173
PID 5064 wrote to memory of 5316	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5064 wrote to memory of 4108	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 1264 wrote to memory of 3192	1264	xrpjhbzurm.exe	182
PID 5064 wrote to memory of 4592	5064	2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5012 wrote to memory of 2848	5012	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6773ec395b21fbb060a0271a875e2d02_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff95dc0c188,0x7ff95dc0c194,0x7ff95dc0c1a0
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,15963356566189134566,13334483412144624596,262144 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10387981993616347072,11096817005962828492,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
      4⤵
      System Time Discovery
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,9419084949486613526,6675086648710130599,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,15396394482935632856,11997338119235405636,2097152 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,9430141024323514564,901635368157428378,2097152 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:3868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,4084936946826525933,10112647159081493928,2097152 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,11401489625411417237,3796449786330481495,2097152 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,14693043014301048332,3710198088047562237,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,11544582185243350923,6630691081137749821,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,4134708560796448819,6513982257387835297,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6076289799137428125,1314224828555696724,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,6076289799137428125,1314224828555696724,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,9000585529025674389,13069136610438005644,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,2356269501700548794,10171080072903436435,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,832463727253641123,12070839581828764200,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,10086986958372509722,2013599790117045895,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,13700866862332010207,4331877723082469426,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,14485810814264299944,13309038926536151982,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,7325284315942970675,12845360701437369575,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:14
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,684435223076201687,6186212070752506964,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,2191634294085088793,12785150012839171978,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,7986963865932669957,15096997986534193082,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:14
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,10648660255079089829,16231088775820020303,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6076,i,5198028630410925689,523101483441440761,262144 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,1824575961545836640,15998875848819969816,524288 --field-trial-handle=2248,i,3661569453509710665,10212172483845046724,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:14
      4⤵
      PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbwrmg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3508
- - C:\Temp\wrpjhbwrmg.exe
    C:\Temp\wrpjhbwrmg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbwrmg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5952
- - C:\Temp\i_wrpjhbwrmg.exe
    C:\Temp\i_wrpjhbwrmg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtomgdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:676
- - C:\Temp\eywtomgdbv.exe
    C:\Temp\eywtomgdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtomgdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\i_eywtomgdbv.exe
    C:\Temp\i_eywtomgdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:620
- - C:\Temp\lidbvtnljg.exe
    C:\Temp\lidbvtnljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:708
- - C:\Temp\i_lidbvtnljg.exe
    C:\Temp\i_lidbvtnljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnlfdav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5416
- - C:\Temp\dxvpnlfdav.exe
    C:\Temp\dxvpnlfdav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnlfdav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_dxvpnlfdav.exe
    C:\Temp\i_dxvpnlfdav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusnkfcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5652
- - C:\Temp\xusnkfcaus.exe
    C:\Temp\xusnkfcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusnkfcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3548
- - C:\Temp\i_xusnkfcaus.exe
    C:\Temp\i_xusnkfcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspnhfcax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\axspnhfcax.exe
    C:\Temp\axspnhfcax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspnhfcax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4192
- - C:\Temp\i_axspnhfcax.exe
    C:\Temp\i_axspnhfcax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxsmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1528
- - C:\Temp\zxsmkecwup.exe
    C:\Temp\zxsmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxsmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5316
- - C:\Temp\i_zxsmkecwup.exe
    C:\Temp\i_zxsmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbzurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4108
- - C:\Temp\xrpjhbzurm.exe
    C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\i_xrpjhbzurm.exe
    C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5144
- - C:\Temp\rljebwtrlj.exe
    C:\Temp\rljebwtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebwtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Temp\i_rljebwtrlj.exe
    C:\Temp\i_rljebwtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uolgeywtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Temp\uolgeywtom.exe
    C:\Temp\uolgeywtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uolgeywtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\i_uolgeywtom.exe
    C:\Temp\i_uolgeywtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlgdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\dbvtnlgdyv.exe
    C:\Temp\dbvtnlgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlgdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1192
- - C:\Temp\i_dbvtnlgdyv.exe
    C:\Temp\i_dbvtnlgdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnkifdy.exe ups_run
  2⤵
  PID:3864
- - C:\Temp\davtnkifdy.exe
    C:\Temp\davtnkifdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnkifdy.exe ups_ins
  2⤵
  PID:2324
- - C:\Temp\i_davtnkifdy.exe
    C:\Temp\i_davtnkifdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxsqn.exe ups_run
  2⤵
  PID:5552
- - C:\Temp\vsnlfdxsqn.exe
    C:\Temp\vsnlfdxsqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxsqn.exe ups_ins
  2⤵
  PID:1224
- - C:\Temp\i_vsnlfdxsqn.exe
    C:\Temp\i_vsnlfdxsqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcausmkica.exe ups_run
  2⤵
  PID:4640
- - C:\Temp\fcausmkica.exe
    C:\Temp\fcausmkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcausmkica.exe ups_ins
  2⤵
  PID:3036
- - C:\Temp\i_fcausmkica.exe
    C:\Temp\i_fcausmkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcxusmkfc.exe ups_run
  2⤵
  PID:3204
- - C:\Temp\hfcxusmkfc.exe
    C:\Temp\hfcxusmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcxusmkfc.exe ups_ins
  2⤵
  PID:3656
- - C:\Temp\i_hfcxusmkfc.exe
    C:\Temp\i_hfcxusmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxrpjhbzu.exe ups_run
  2⤵
  PID:3780
- - C:\Temp\ecxrpjhbzu.exe
    C:\Temp\ecxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxrpjhbzu.exe ups_ins
  2⤵
  PID:5408
- - C:\Temp\i_ecxrpjhbzu.exe
    C:\Temp\i_ecxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebzwrpj.exe ups_run
  2⤵
  PID:4704
- - C:\Temp\rljebzwrpj.exe
    C:\Temp\rljebzwrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljebzwrpj.exe ups_ins
  2⤵
  PID:6124
- - C:\Temp\i_rljebzwrpj.exe
    C:\Temp\i_rljebzwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgbzwro.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\trojgbzwro.exe
    C:\Temp\trojgbzwro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgbzwro.exe ups_ins
  2⤵
  PID:4868
- - C:\Temp\i_trojgbzwro.exe
    C:\Temp\i_trojgbzwro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljgbytqo.exe ups_run
  2⤵
  PID:4812
- - C:\Temp\tqljgbytqo.exe
    C:\Temp\tqljgbytqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljgbytqo.exe ups_ins
  2⤵
  PID:5736
- - C:\Temp\i_tqljgbytqo.exe
    C:\Temp\i_tqljgbytqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidavtnl.exe ups_run
  2⤵
  PID:5784
- - C:\Temp\sqlidavtnl.exe
    C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidavtnl.exe ups_ins
  2⤵
  PID:1584
- - C:\Temp\i_sqlidavtnl.exe
    C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1560

C:\Temp\jdbwtomgey.sys
C:\Temp\jdbwtomgey.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\qolgdywqoi.sys
C:\Temp\qolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:2396

C:\Temp\davtqnifdx.sys
C:\Temp\davtqnifdx.sys
1⤵
- Executes dropped EXE
PID:2132

C:\Temp\kifaysqkid.sys
C:\Temp\kifaysqkid.sys
1⤵
- Executes dropped EXE
PID:596

C:\Temp\axspkhfcxs.sys
C:\Temp\axspkhfcxs.sys
1⤵
- Executes dropped EXE
PID:5728

C:\Temp\ezxupnhfzx.sys
C:\Temp\ezxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\urmkezwuom.sys
C:\Temp\urmkezwuom.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\ebwurmjhez.sys
C:\Temp\ebwurmjhez.sys
1⤵
- Executes dropped EXE
PID:2132

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\jdbytqlgdy.sys
C:\Temp\jdbytqlgdy.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\dyvtnlfdav.sys
C:\Temp\dyvtnlfdav.sys
1⤵
PID:3856

C:\Temp\licavsnlfd.sys
C:\Temp\licavsnlfd.sys
1⤵
PID:3636

C:\Temp\icavsnkica.sys
C:\Temp\icavsnkica.sys
1⤵
PID:4968

C:\Temp\nhfcausmke.sys
C:\Temp\nhfcausmke.sys
1⤵
PID:1272

C:\Temp\ecwupmhczu.sys
C:\Temp\ecwupmhczu.sys
1⤵
PID:5904

C:\Temp\ezwurmkecw.sys
C:\Temp\ezwurmkecw.sys
1⤵
PID:3704

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
PID:4896

C:\Temp\ztrlgeywto.sys
C:\Temp\ztrlgeywto.sys
1⤵
PID:1972

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspkhfcxs.sys

Path C:\Temp\axspkhfcxs.sys
Size 141KB
SHA256 2ecb62bd95a9fe3758fa9c64519951a68b250e1847b2a297c56f07688fce1ac8
MD5 b8b91409d1c5804a8775a564241cde1d
SHA1 2e790c61fcfe5e69420d8f1650f52492893e10a4
SHA512 ebc7b955e0d02e92cea6235034559474a3bde55dbfa5ebc9ce85238c013d3435cfdd155e3b0ca394444bce5d499a57a790d93a0711388c44711c56d74fdd4c2d
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axspnhfcax.exe

Path C:\Temp\axspnhfcax.exe
Size 226KB
SHA256 27ef040b767bbf554893ef2dd7e65ae6a899c64061a7bba6f6ceaae68d1c008c
MD5 d927705699edad61f253846934c19328
SHA1 e297187e91d4836086fb05969d0f22c6e9f45cb0
SHA512 b9dcfa66e09403e17d5c47a9a3c0c89619fd2d2ecebc025262f3c51f78d932b3ee2c6c442fcc2e13ed4b1187a1329d6a6c22e57b9e34442549abad31eac4d189
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtqnifdx.sys

Path C:\Temp\davtqnifdx.sys
Size 141KB
SHA256 c4bc8ffd748936f0b18519c1ac6b6facd3aa2f169b832b921f934bfd5362d225
MD5 a758ba1610e931935332b7d2864ed19e
SHA1 7b3b452238e29b26dc6c217536b52f538a50acb7
SHA512 2caaea0ac9d9b4146823db5f5157b1cf69f0acb84dcc3e77cf914610223c9e14261c8fbbb86c4c42c932e8621db56451654fffc0c9cbfd6ba989ac978453164a
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnlfdav.exe

Path C:\Temp\dxvpnlfdav.exe
Size 226KB
SHA256 b48ae7a04438bee8ba2e318f61f09923e0efcb45c8f7091e6b96c839192a4471
MD5 f542e36f35351cd27de16a8bb104364b
SHA1 711c4b316793139b5da216d767ab446cfe937edf
SHA512 59c62c027802a7146c1a6a65a564f71fa86890f9356b8d540409a22de072c13b2ff1045bdff5d7a7f167c80b982af90bb6493c4a2d48dfd79e584a9bb46ab090
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtomgdbv.exe

Path C:\Temp\eywtomgdbv.exe
Size 226KB
SHA256 fc5210e26bc67ac5cb4e45e016af33b5d0986424426be23c333cd5a642d48730
MD5 99f597a84255aaf0b8c60384b339adb2
SHA1 ac5caf6c0787fc92866638654e0ee7178a4bb916
SHA512 45967b00ab44d69cb53878d737ab9c8a441a12194aaa1d8b44eb2f826250644dce7670e1950585f8a8ce6349355e87268d912b1108997abe837ea33aaad006fa
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1F334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspnhfcax.exe

Path C:\Temp\i_axspnhfcax.exe
Size 226KB
SHA256 3a4e5deec70ac6eb37d6893bb571d0e6835edc7d0a53599ff39f8847c267e587
MD5 a26577d83044f2d9c795fef13af0ea62
SHA1 a9f1bbb8d2339a5d42f49dafd153d709719e371c
SHA512 5fbfe034e79a20b7b3e8fad0ae450e10bb081835a755ed892876af564909746fb0e8e910eb76df8d8d2115d21857ef4c63cd40fc31149293333fff0984daad20
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T10A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnlfdav.exe

Path C:\Temp\i_dxvpnlfdav.exe
Size 226KB
SHA256 52d779d6498b7b3e3edf33c1e921f030b6453e9609a20fd1a973e119935a1d58
MD5 a722b7b98cd9dde1a48cba93296158ee
SHA1 4bddec9814a441abbf3104c4fd7968b01638e011
SHA512 1c64d136658f0d58b34d06dd283fecdde213371c06d59e3c2479aeb91e0f266448abdd58c3f7091ed2d7505c5c669617c673b96323d077577ca3f72dcf6ddda3
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywtomgdbv.exe

Path C:\Temp\i_eywtomgdbv.exe
Size 226KB
SHA256 094df9a665e39bb8ba72bf63163d9bdc2533c95cb8a4775404b7da6bf1e5a1cf
MD5 71f8711b0a95ed8ab3e670c007ad312e
SHA1 59de9f32646de7c740ba3766d84416e0afd5166e
SHA512 f5b1d348c3d0fdede227937902e29531acd88b3669bc8542ab29e4defd67f9f7296798db513c8b19ae89533a779d97b6abcc0981c11e0ac68a1b2daf75836569
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1B334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnljg.exe

Path C:\Temp\i_lidbvtnljg.exe
Size 226KB
SHA256 c882a3701daecc2141adcc3ddec83867daf72c749c8c1bf688198dcf5a77f6a9
MD5 4057a99c57ded89bc19bbfee918c897f
SHA1 e9e540d8b7eea31ed3c11193b62223f582e1023d
SHA512 9c4202eb37e44a0cd374b6c047b174738dc5781ffa145b45553169240ae10922be04771d65ab9dc7ed8ee1ab0ec33c8abc02151119cb08ee19cde675f904fc89
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbwrmg.exe

Path C:\Temp\i_wrpjhbwrmg.exe
Size 226KB
SHA256 638a4915d5a75d1995dbf02d793bad54ffad29d2e67a9b65a7414a45ddc237b7
MD5 f85b1d1c2a54a8da206bfebfc702bfa4
SHA1 8098bed5f8031951eb4e0c0af75ff060d4e6bd6e
SHA512 07e2abc2b3a66b6703f72276dcaf17829231fb192a36373b9898c0aeecf0c2a405aeb5db79d7ee0ab983a859b2345a6aa0b25abeb230fd6b8700a199e4da1da9
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1F334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusnkfcaus.exe

Path C:\Temp\i_xusnkfcaus.exe
Size 226KB
SHA256 818518d8b37bc3539433b565f264b2d72233a5a8b15a2cf4229226194fbaae86
MD5 0c85c683c686cdee980f7ab835aa6659
SHA1 795b268352cf92452f7abea973d993c9c45e361b
SHA512 2b40fa9acb4ba6e46e922687407c1b1e52d245c6b0469b232af938910e895e7ef00cbc7cf19ed54a09c48830b98918e66c7367959424b11f3af7fe7b3d462760
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T18734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.sys

Path C:\Temp\jdbwtomgey.sys
Size 141KB
SHA256 d925dfd1fd20d58a4aed51b977e1a988826f54071bee732e012db1c79174b020
MD5 5c642dacca5ccd1c0431ada7741dd311
SHA1 449471d50bd03f61e5c7448a7d813eb805ade066
SHA512 1d1cf55ffdd74bdb3d87bf18586bbd29cca2a815f0b26a0e097ee7974b7836411df8bf348933b530bb0ddf415a5b8a1effbf9602e14c9671f5375fe08ec255e0
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaysqkid.sys

Path C:\Temp\kifaysqkid.sys
Size 141KB
SHA256 edc9ed9d96a1d32e7c461d87df579e9973a375f16e0f885b566fdd2afbf33deb
MD5 aa215627ce346636501437a43fd06560
SHA1 8156731e5aeef7a14e765d788fc91e182da56621
SHA512 9d0567e2c1730860af67979f22fd1e7982beae7643187e545d93a51ba5e87b88588a6d8d165d56c3ec3679614314c6470021802381e954830f507d0ee1a5e0db
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T153E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnljg.exe

Path C:\Temp\lidbvtnljg.exe
Size 226KB
SHA256 bc4b9d0b6febba73ae87877ea84c8b8538571b63c38260f510a4a9c5513a8c94
MD5 5162b0194f6edbb8576c4f81f012db20
SHA1 ec22134af9ac60e83dd5b410d720e9884904341a
SHA512 1abac2e1e21ad95b83df66122506d78694a8900982164c1f27f2b05937838b6e69fdaa9d6b3a10a2e4f2f138b3baa6c1a6c4fe03355b2769bbb3a64ef5d67608
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1D434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdywqoi.sys

Path C:\Temp\qolgdywqoi.sys
Size 141KB
SHA256 c93632178ddf16eaeeec14d070b089a400aa9937c6cc74e4b2ec6b99e880bd5f
MD5 dc0c1684d98d263f527612e8d6faa5d3
SHA1 00fa109dd558425ec4d38c042c9504925415e05a
SHA512 4dca54652841b88e63ac2f51e1071481ab93c52e0da02fe1235c22bc461b90c1d376efcf07bc3b8a07670c6c43762343f1846c7ee01b7464e5cce3974212bbb7
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbwrmg.exe

Path C:\Temp\wrpjhbwrmg.exe
Size 226KB
SHA256 94e3609a8a19fc944374ba12f24b7b617f912d6a560a59fc00f7159629ce6512
MD5 1eeb785ee01022f8584dfd768a886e46
SHA1 b138dae06ec9d262a29e2d5f5c3bb5afd8ed5953
SHA512 55a83d885a742de3121f836b3feb251ff33debf14618adf48c8755a2489a1a9d613612533c0bab5ca2e57ce5b13cce8ad2cac720b8f674b8eec8b983c9aa22bc
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T13F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkfcaus.exe

Path C:\Temp\xusnkfcaus.exe
Size 226KB
SHA256 2023a12b7fd2ee4f349e344fb5ec1a1b02bd7f2d34615e23610c10895218a4de
MD5 3176de846dbc34f762967ee0d5590783
SHA1 f52b0e74c7133301be84ba371cd581a4b66e8932
SHA512 be624fec01807bfe9f8e397e288b8c2ea0332373d27aa633c9b4c574e7e8bf133d2202d26df282a79ac636fb6f0423b9512fd810492f58ba5f8bc7e18644c1e4
SSDEEP 3072:ZGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:IXY4LK+a3lLNngoqRttA7
TLSH
T1DF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

541b2a83-9b13-428b-813b-d6a77d95070a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\541b2a83-9b13-428b-813b-d6a77d95070a.tmp
Size 29KB
SHA256 24410ba3aaad1217fac5761d84be5b7f718003ca511af84d49c481482f0ca2f9
MD5 fec6170bc2070b51cc165682e214a2a5
SHA1 c454f3aa07677d1afb6c32a5e875c78ecec21278
SHA512 64d0d14be9678fe111c50ec144405545133956da8af11278776acaa686477815f1e50df132b5bc44b02f95de40cb1816e40eaa6b3e90f138de14a6a1adf8ef47
SSDEEP 768:ky2S3x7pLuLfsvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBsdSV44ro2+O:ky2S3nEfsvWgd5f/bu1jausdU4DZO
TLSH
T1E5D2EA3B640DCB7F4F804ADDE8197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 bb7956e6b65670b1266bc0bd07a0bf959a10f986920d9edfe58fc04ce6c394d7
MD5 cf46aaa019279d40a07c2400a74e6b75
SHA1 e1aeea077dc8b855307870447436b1d7524f073d
SHA512 df3507fa4611de1a7bb60fd8b353d206026c829db101ed11a6d00b3b6e2c557ef9e7b1089c821a52bb121c4cae5b20274e4c5adfa7c0dff71291a5eae85845f3
TLSH
T122512B501B2FF9C9EBBFD87174E0C0E8367DCAA9D147AE4351B891345A0E30C17C0129
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1cf6a1a48627f4181a4b4b31dee6a30b7f2be3f5b96119a91a738b51f2c844e5
MD5 82d4938facbea8c33ccf61f061fd87e7
SHA1 071a73f04626f59f0ca0ed77d0b2da81c12e01f4
SHA512 0203aef6520b3add2cd23eedc5073f1d19f64f066fe3fa96380715d04c3e00518b16cc6497bc78eb7656ee68dd7ea3103b634de9ac52afd5a9876af6ce81dfea
TLSH
T1F9517DF3C2E8856ECD0196F4AA146E1BCE1D0914832C3D5AC9E4AF5B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ee9d73e90c4478052f9804ee050815d6dd535e5df63cd1618936d24bcce132b3
MD5 eb3201b8fcfc8be760fe9c723c343191
SHA1 199b8dbdbf24d573fc2b0bd80978c7d99b8ef5fb
SHA512 501c060ad291fa4648ae081ee38ca6328c4ebecae036b241437d0fb040733d78f7db1ec84d67b7a1e5aee0a8c86711a9b96eaec63d848f6b81c461ca731dea16
SSDEEP 192:sxRkRDC+/fFs4iZZQjzoA8p9B/g6+WNCEc/YZ7TKAHjGiIgV+qHJ:sxRk0+/fFs4i3QSb/5W/U7/
TLSH
T19642B81A6E28A93B9CC7D21DBB557F53D2F85032A1D01E58BBFC8A0C45E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f0b1ecc2257c34e49f71f399d591eb78458104e570a3dab4374c94c36e7c6ca0
MD5 f759580cfe5b51698e269d4579c89b8f
SHA1 e174cd55b9d16dae71a652207e5edcf3c9fde3d9
SHA512 94e4c561bf7842e775b80bbad931ab57f6cc372b74c340891918d81d3fdc3af9eba0642c3ff78f4c9491e7f185594a7ddd4118e687514fe94bb10745fc4a76f4
SSDEEP 192:sxRDRDC+/fFsIGZZQjzoA8p9B/g6+WNCEc/YZ7TgAHjGiIgD6+qHJ:sxRD0+/fFsIG3QSb/5W/k78
TLSH
T18E42B81A6928A93B9CCBD61DB7557F53E2F85032E1C01E58ABFC8B0C45E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4a40416397315aa2879245a580c85836025c5347c55dab9c38787d199b386592
MD5 fc04bc2e1566715141753623a674442a
SHA1 68890f4b5b4fd2f6485d8eb9fd4bfb28b07fe3b9
SHA512 25c15245ebed121689889a408c597bcf95e4a650a2e78304ab4861332ddbb6118b0b854a94a0ea86a5dfd95637c863e73f12002857731f14989068ed9cc27a03
SSDEEP 192:sxRDRDC+/fFsIiZZQjzoA8p9B/g6+WNCEc/YZ7TKAHjGiIgDY+qHJ:sxRD0+/fFsIi3QSb/5W/U7i
TLSH
T1D442B91A6E28993B5CC7D61DB7557F53D2F85032E1D01E58A7FC8A0C45E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4ec6c41c25cedd5eb5f6aba50be44c4639ea6cf50ff15a2b151bf4208fc3302f
MD5 693f854e9039b42de7cfa7d5a6ce144d
SHA1 e45eec689652099f778c5328cd95650b52c2755f
SHA512 c036f18c0808979bc9f42a780f6dcfa871da97bf230c05ad91a4d98d7bab032a31d67dae9dbb994564480cba2cbef2202dfc5e0eeae600715b8f4fcb92c857e6
SSDEEP 24:KSiFEiNi4iaPifSiMiIir1i4iHDiaI4iUirKXikhPiGir1RiCi7SriV5iwJiIiYG:K8SI/Kzq43ypCI/KPK8b7IFKMEI9yW
TLSH
T108910547717E529139BE180D98A1C52BC6C2B4F33668E56B3BE850724BAAF410DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed606212-f449-46f2-b0d2-f29b4c1ebd94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed606212-f449-46f2-b0d2-f29b4c1ebd94.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 09d25f8035da99d2f074de86b6880db0431947a7a2451aaeb52cb5fafb998c81
MD5 bc55f9d8b4a46664641d8037c5fa0e61
SHA1 2723191a528fc6c6054fc2c6b0885ed4e4536f19
SHA512 e9a32c2ccf849ff8538430d039cd064a04c66410bb640260aa2acc4199943a136cbc902f250dfe89aac2bbbcb2c353dec77e3c992ac97198fc10a810772d0d9f
SSDEEP 768:E03qCq9LRLHOAam6aQMGdjWca4Ghf9x1a:E03YgmaME6pxQ
TLSH
T155E2AF315C65DC339CABA695F72A2783BDF06173D8C84E54D9D9AB0E029358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a3893387cb3da1fc4f6d0d47bc8b58304b376344f69949714b394d77e6c23a2a
MD5 dd65025958dcc302b7b27332ac971ae6
SHA1 54feecdb9bf5e065c9eb0044efc1780dae042b4d
SHA512 cdeb9def626073e2d11f671a6662dc1eb0fc25e96161e8c4656365f42e062c7e87fa5b14169bca15755843e3a7422535b3a028c5df50b708f9a2cf6340aba005
SSDEEP 768:+FQe3IwgzePLRLcAam6aQMGdjWca4Ghf9x1a:Ve36maME6pxQ
TLSH
T1440307F188D78937D8AE5787A33D2E4299BCD163B4884994F7C85E0DCD921BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 82622dc756fdea4fcdb4b1a5f49d5d3cb869a551c96fca1e74f935ba6e012795
MD5 3def9fcceca2d4da656c9e3a66d92fe0
SHA1 bc88f85bad0df218e29d15b0cbd683805b5c66fc
SHA512 aa8e5e56350d58c3362d8b2adbef5a433d3d5b7e9d2137c9c1a308178f1c313c5d13b0a6d27238b45b0e0ec44f4fed09527f0793e9cb051670a9b78e8f8183d4
SSDEEP 768:c03RCq9LRLHOAam6aQMGdjWca4Ghf9x1a:c03VgmaME6pxQ
TLSH
T1DAE2AF315C65DC339CABA695F72A2783BDF06173D8C84E54D9D9AB0D029358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 101104131b6a9a5fbccd775c136ddf0370d669ba3b51372c408372679d6bd972
MD5 4f87d66a406f27f7b137bb5d8f3abe58
SHA1 0d892333f6987f2b09fbc239158b6231803953de
SHA512 337d2b8c20bd6631c612262163aefe6a3170ff9ae6dc602f199e5f420345d8b8f23e3df30c74059b355237d96b1fada4a4c1602cd16eb2123c522c5b03f79b8d
SSDEEP 768:Arv+4UNbd/3PCq9LRLH0Aam6aQMGdjWca4Ghf9xhD:Absbh3vWmaME6pxh
TLSH
T1BAF2BF31686CD9339CB7A695F21B7683BEB021B388C40E94D9D96B0D439758E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 207955663b0d4a0e11613caa60135ffd08bd34610f84270d24eef6da081ee328
MD5 ce596125b5506ed3ceb002ba1c80b8ac
SHA1 bf875bdcf315695b91700f2f4469f8afe59fce98
SHA512 0e50e6346eeacdc97fa8d4ebdd9c6f7ea335955f78efff36cb76789d65237135fa94ae2f6ccb6bce3bc27accacae12f2e2d563e4c23341455108bb550b3d96c9
SSDEEP 768:/rv+4UNbdq3eXq9LtAAam6aQMGdjWca4GhfBLPeU/:/bsbc3PKmaME6pjH
TLSH
T198F2AE31A86C9573DDB79A99F21B6787BEF021A384D40A90D9D92B0D439748E3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

0fc7ee70-8cac-48c3-a7b7-a44bb8d14cc1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0fc7ee70-8cac-48c3-a7b7-a44bb8d14cc1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe597ac4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe597ac4.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

0f9f6b57-2ba4-468e-9616-2dbe7800afb9.tmp

Path C:\Users\Admin\AppData\Local\Temp\0f9f6b57-2ba4-468e-9616-2dbe7800afb9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5012_2029955008\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/596-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1272-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1972-703-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1972-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-567-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3456-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3704-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3856-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3856-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4176-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4272-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-699-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4968-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5728-518-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download