304a5489b2dc9e8086b24b178a75825d9f5105160db2ca1829048261a821256d

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260731-xd3sbsem51
SHA256 304a5489b2dc9e8086b24b178a75825d9f5105160db2ca1829048261a821256d
MD5 34594c8a87b246de297ac377224c5664
SHA1 5d03466e2492620f914681bc667139809112d3db
SHA512 c87ba58ad7d5f072a3c68045deb6edfd6b3aa30ad07d804c0798913bbe8b1c85acdd8bf2177fb16b7df45f87edff3eb4b01700fce2c401e8a872bba074650774
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1828	CP.exe
4276	tnlidyvqlg.exe
2268	CP.exe
364	CP.exe
5192	i_tnlidyvqlg.exe
3944	nifaysqkic.sys
3856	CP.exe
4384	icavsqnifd.exe
4340	CP.exe
5032	CP.exe
5752	i_icavsqnifd.exe
4668	icauspkica.sys
2108	CP.exe
4600	kicauspnhf.exe
6020	CP.exe
2528	CP.exe
5604	i_kicauspnhf.exe
4248	pkhczusmkh.sys
5976	CP.exe
2576	mhfzxrpkhc.exe
5844	CP.exe
4580	CP.exe
880	i_mhfzxrpkhc.exe
5712	mkhczurpmk.sys
5112	CP.exe
2756	zurmjecwuo.exe
4548	CP.exe
4172	CP.exe
2728	i_zurmjecwuo.exe
2344	ezwrpjhbzt.sys
2428	CP.exe
3156	bztrpjebwu.exe
2948	CP.exe
2664	CP.exe
4248	i_bztrpjebwu.exe
5152	ztrljdbzwr.sys
1624	CP.exe
1656	ywtrljgeyw.exe
1088	CP.exe
3368	CP.exe
2476	i_ywtrljgeyw.exe
2640	rlbvtolgeb.sys
1964	CP.exe
1336	dbytqligby.exe
1428	CP.exe
5792	CP.exe
5096	i_dbytqligby.exe
4932	dbvtrlidbv.sys
4132	CP.exe
2908	bqlidyvtnl.exe
5384	CP.exe
5080	CP.exe
5204	i_bqlidyvtnl.exe
3380	sqkidavtqk.sys
3984	CP.exe
3136	nlfdxvqnlg.exe
1936	CP.exe
3784	CP.exe
208	i_nlfdxvqnlg.exe
2176	licavsnlfd.sys
2356	CP.exe
1824	fdxsqnifax.exe
3192	CP.exe
2388	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1612801853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_671315659\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_671315659\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_455474773\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_455474773\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1119853610\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_1612801853\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_455474773\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5236_330762024\_locales\fil\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxsqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axrpkhcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigayvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidyvqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqlidyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aukeczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidyvqlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicauspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigayvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicauspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axrpkhcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bqlidyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxsqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aukeczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsqnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebvtody.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebvtody.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausmk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5372	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5312	ipconfig.exe
1088	ipconfig.exe
5580	ipconfig.exe
3516	ipconfig.exe
1176	ipconfig.exe
5408	ipconfig.exe
5020	ipconfig.exe
1596	ipconfig.exe
2724	ipconfig.exe
4316	ipconfig.exe
3244	ipconfig.exe
4560	ipconfig.exe
5296	ipconfig.exe
4752	ipconfig.exe
4244	ipconfig.exe
4684	ipconfig.exe
3716	ipconfig.exe
1208	ipconfig.exe
4576	ipconfig.exe
1104	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299971173619183"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{000145E1-F2AE-4D88-9D7E-0477609D0AF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5404	msedge.exe
5404	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe
5236	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5192	i_tnlidyvqlg.exe
Token: SeDebugPrivilege	5752	i_icavsqnifd.exe
Token: SeDebugPrivilege	5604	i_kicauspnhf.exe
Token: SeDebugPrivilege	880	i_mhfzxrpkhc.exe
Token: SeDebugPrivilege	2728	i_zurmjecwuo.exe
Token: SeDebugPrivilege	4248	i_bztrpjebwu.exe
Token: SeDebugPrivilege	2476	i_ywtrljgeyw.exe
Token: SeDebugPrivilege	5096	i_dbytqligby.exe
Token: SeDebugPrivilege	5204	i_bqlidyvtnl.exe
Token: SeDebugPrivilege	208	i_nlfdxvqnlg.exe
Token: SeDebugPrivilege	2432	i_fdxsqnifax.exe
Token: SeDebugPrivilege	5992	i_axrpkhcxup.exe
Token: SeDebugPrivilege	5848	i_aukeczurmk.exe
Token: SeDebugPrivilege	1460	i_zurmjhezxr.exe
Token: SeDebugPrivilege	5752	i_trmjecwuom.exe
Token: SeDebugPrivilege	5204	i_rljdbvtolg.exe
Token: SeDebugPrivilege	1460	i_oljebvtody.exe
Token: SeDebugPrivilege	5096	i_kigayvtnlg.exe
Token: SeDebugPrivilege	5884	i_kifaysqkif.exe
Token: SeDebugPrivilege	4332	i_sqkicausmk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 2352	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2352 wrote to memory of 5236	2352	iexplore.exe	89
PID 5236 wrote to memory of 4952	5236	msedge.exe	90
PID 5236 wrote to memory of 5860	5236	msedge.exe	91
PID 5236 wrote to memory of 5372	5236	msedge.exe	92
PID 5236 wrote to memory of 5860	5236	msedge.exe	91
PID 5236 wrote to memory of 5860	5236	msedge.exe	91
PID 5236 wrote to memory of 4940	5236	msedge.exe	94
PID 5236 wrote to memory of 4940	5236	msedge.exe	94
PID 5236 wrote to memory of 2428	5236	msedge.exe	95
PID 5236 wrote to memory of 2428	5236	msedge.exe	95
PID 5236 wrote to memory of 2428	5236	msedge.exe	95
PID 5236 wrote to memory of 5092	5236	msedge.exe	96
PID 5236 wrote to memory of 5092	5236	msedge.exe	96
PID 5236 wrote to memory of 5092	5236	msedge.exe	96
PID 5236 wrote to memory of 3952	5236	msedge.exe	97
PID 5236 wrote to memory of 3952	5236	msedge.exe	97
PID 5236 wrote to memory of 6028	5236	msedge.exe	98
PID 5236 wrote to memory of 3952	5236	msedge.exe	97
PID 5236 wrote to memory of 6028	5236	msedge.exe	98
PID 5236 wrote to memory of 6028	5236	msedge.exe	98
PID 5236 wrote to memory of 2448	5236	msedge.exe	99
PID 5236 wrote to memory of 2448	5236	msedge.exe	99
PID 5236 wrote to memory of 5116	5236	msedge.exe	101
PID 5236 wrote to memory of 1840	5236	msedge.exe	102
PID 5236 wrote to memory of 5116	5236	msedge.exe	101
PID 5236 wrote to memory of 1840	5236	msedge.exe	102
PID 5324 wrote to memory of 1828	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 5236 wrote to memory of 2876	5236	msedge.exe	106
PID 4276 wrote to memory of 2268	4276	tnlidyvqlg.exe	108
PID 5236 wrote to memory of 3960	5236	msedge.exe	111
PID 5236 wrote to memory of 3960	5236	msedge.exe	111
PID 5236 wrote to memory of 4264	5236	msedge.exe	112
PID 5236 wrote to memory of 4264	5236	msedge.exe	112
PID 5236 wrote to memory of 1020	5236	msedge.exe	114
PID 5236 wrote to memory of 1020	5236	msedge.exe	114
PID 5236 wrote to memory of 5152	5236	msedge.exe	115
PID 5236 wrote to memory of 5152	5236	msedge.exe	115
PID 5324 wrote to memory of 364	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 5324 wrote to memory of 3856	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4384 wrote to memory of 4340	4384	icavsqnifd.exe	124
PID 5324 wrote to memory of 5032	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 5324 wrote to memory of 2108	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4600 wrote to memory of 6020	4600	kicauspnhf.exe	133
PID 5324 wrote to memory of 2528	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 5324 wrote to memory of 5976	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 2576 wrote to memory of 5844	2576	mhfzxrpkhc.exe	142
PID 5324 wrote to memory of 4580	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5236 wrote to memory of 5296	5236	msedge.exe	148
PID 5236 wrote to memory of 5556	5236	msedge.exe	149
PID 5236 wrote to memory of 5312	5236	msedge.exe	150
PID 5324 wrote to memory of 5112	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 2756 wrote to memory of 4548	2756	zurmjecwuo.exe	155
PID 5324 wrote to memory of 4172	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5324 wrote to memory of 2428	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 3156 wrote to memory of 2948	3156	bztrpjebwu.exe	164
PID 5324 wrote to memory of 2664	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 5324 wrote to memory of 1624	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 1656 wrote to memory of 1088	1656	ywtrljgeyw.exe	173
PID 5324 wrote to memory of 3368	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5324 wrote to memory of 1964	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 1336 wrote to memory of 1428	1336	dbytqligby.exe	182
PID 5324 wrote to memory of 5792	5324	2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5236 wrote to memory of 3704	5236	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_34594c8a87b246de297ac377224c5664_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x300,0x7ff8233dc188,0x7ff8233dc194,0x7ff8233dc1a0
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14392883059435725072,16934774400990139196,262144 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,1216972567853279176,6414532147919196643,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,14620724708216827293,12037191040923168089,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:13
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,16839915549411531548,5334291494812473823,2097152 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,15415054323708171254,5775492227862989512,2097152 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,984720974695589530,11354021176707066091,2097152 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,7066360623254758967,7056307437026513225,2097152 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=1628 /prefetch:9
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,10483036648090717267,11870188811012461081,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,11661747838290177102,9558803089369802708,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,15679274810151514500,9700266990236826797,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9887664297869410841,14712028015480656484,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,9887664297869410841,14712028015480656484,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,10934828571641493766,9131742839546459065,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12792086048251408146,10894514480108493954,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,9471369026151494463,11065302790536899591,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,13376219354950197751,11781207331208606836,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,5162514260323560399,10760663805004460663,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2750715451225706588,3863779789419528815,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,655133792455899299,11111746009616524950,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,7810970761905933540,10200259824430503919,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,11756342294203833210,12937708378578293223,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,4649894584182467618,11465996595948429653,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,2509947877510759795,9191422810373879311,262144 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7691319147775343106,1557029891709893229,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,7349350846601652293,5571955821333238257,524288 --field-trial-handle=2336,i,4937219577997270262,8660076478887732118,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidyvqlg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1828
- - C:\Temp\tnlidyvqlg.exe
    C:\Temp\tnlidyvqlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidyvqlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Temp\i_tnlidyvqlg.exe
    C:\Temp\i_tnlidyvqlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsqnifd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\icavsqnifd.exe
    C:\Temp\icavsqnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsqnifd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Temp\i_icavsqnifd.exe
    C:\Temp\i_icavsqnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicauspnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Temp\kicauspnhf.exe
    C:\Temp\kicauspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicauspnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\i_kicauspnhf.exe
    C:\Temp\i_kicauspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5976
- - C:\Temp\mhfzxrpkhc.exe
    C:\Temp\mhfzxrpkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_mhfzxrpkhc.exe
    C:\Temp\i_mhfzxrpkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5112
- - C:\Temp\zurmjecwuo.exe
    C:\Temp\zurmjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4172
- - C:\Temp\i_zurmjecwuo.exe
    C:\Temp\i_zurmjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrpjebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Temp\bztrpjebwu.exe
    C:\Temp\bztrpjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrpjebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2664
- - C:\Temp\i_bztrpjebwu.exe
    C:\Temp\i_bztrpjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtrljgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1624
- - C:\Temp\ywtrljgeyw.exe
    C:\Temp\ywtrljgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtrljgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3368
- - C:\Temp\i_ywtrljgeyw.exe
    C:\Temp\i_ywtrljgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytqligby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1964
- - C:\Temp\dbytqligby.exe
    C:\Temp\dbytqligby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytqligby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5792
- - C:\Temp\i_dbytqligby.exe
    C:\Temp\i_dbytqligby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bqlidyvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\bqlidyvtnl.exe
    C:\Temp\bqlidyvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bqlidyvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5080
- - C:\Temp\i_bqlidyvtnl.exe
    C:\Temp\i_bqlidyvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3984
- - C:\Temp\nlfdxvqnlg.exe
    C:\Temp\nlfdxvqnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Temp\i_nlfdxvqnlg.exe
    C:\Temp\i_nlfdxvqnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxsqnifax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2356
- - C:\Temp\fdxsqnifax.exe
    C:\Temp\fdxsqnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxsqnifax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\i_fdxsqnifax.exe
    C:\Temp\i_fdxsqnifax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axrpkhcxup.exe ups_run
  2⤵
  PID:2172
- - C:\Temp\axrpkhcxup.exe
    C:\Temp\axrpkhcxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axrpkhcxup.exe ups_ins
  2⤵
  PID:4948
- - C:\Temp\i_axrpkhcxup.exe
    C:\Temp\i_axrpkhcxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aukeczurmk.exe ups_run
  2⤵
  PID:4108
- - C:\Temp\aukeczurmk.exe
    C:\Temp\aukeczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aukeczurmk.exe ups_ins
  2⤵
  PID:2548
- - C:\Temp\i_aukeczurmk.exe
    C:\Temp\i_aukeczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmjhezxr.exe ups_run
  2⤵
  PID:4316
- - C:\Temp\zurmjhezxr.exe
    C:\Temp\zurmjhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmjhezxr.exe ups_ins
  2⤵
  PID:3696
- - C:\Temp\i_zurmjhezxr.exe
    C:\Temp\i_zurmjhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecwuom.exe ups_run
  2⤵
  PID:3268
- - C:\Temp\trmjecwuom.exe
    C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecwuom.exe ups_ins
  2⤵
  PID:5148
- - C:\Temp\i_trmjecwuom.exe
    C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  PID:720
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  PID:3212
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oljebvtody.exe ups_run
  2⤵
  PID:5904
- - C:\Temp\oljebvtody.exe
    C:\Temp\oljebvtody.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oljebvtody.exe ups_ins
  2⤵
  PID:2640
- - C:\Temp\i_oljebvtody.exe
    C:\Temp\i_oljebvtody.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kigayvtnlg.exe ups_run
  2⤵
  PID:3484
- - C:\Temp\kigayvtnlg.exe
    C:\Temp\kigayvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kigayvtnlg.exe ups_ins
  2⤵
  PID:6004
- - C:\Temp\i_kigayvtnlg.exe
    C:\Temp\i_kigayvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaysqkif.exe ups_run
  2⤵
  PID:5852
- - C:\Temp\kifaysqkif.exe
    C:\Temp\kifaysqkif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaysqkif.exe ups_ins
  2⤵
  PID:964
- - C:\Temp\i_kifaysqkif.exe
    C:\Temp\i_kifaysqkif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausmk.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\sqkicausmk.exe
    C:\Temp\sqkicausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausmk.exe ups_ins
  2⤵
  PID:5492
- - C:\Temp\i_sqkicausmk.exe
    C:\Temp\i_sqkicausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5392

C:\Temp\nifaysqkic.sys
C:\Temp\nifaysqkic.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\icauspkica.sys
C:\Temp\icauspkica.sys
1⤵
- Executes dropped EXE
PID:4668

C:\Temp\pkhczusmkh.sys
C:\Temp\pkhczusmkh.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\mkhczurpmk.sys
C:\Temp\mkhczurpmk.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:2344

C:\Temp\ztrljdbzwr.sys
C:\Temp\ztrljdbzwr.sys
1⤵
- Executes dropped EXE
PID:5152

C:\Temp\rlbvtolgeb.sys
C:\Temp\rlbvtolgeb.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Temp\dbvtrlidbv.sys
C:\Temp\dbvtrlidbv.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\sqkidavtqk.sys
C:\Temp\sqkidavtqk.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\licavsnlfd.sys
C:\Temp\licavsnlfd.sys
1⤵
- Executes dropped EXE
PID:2176

C:\Temp\kfvsnkecxu.sys
C:\Temp\kfvsnkecxu.sys
1⤵
PID:5148

C:\Temp\zxrmkhfzxr.sys
C:\Temp\zxrmkhfzxr.sys
1⤵
PID:1108

C:\Temp\xusmkecwur.sys
C:\Temp\xusmkecwur.sys
1⤵
PID:3472

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
PID:3692

C:\Temp\wrojgeyomg.sys
C:\Temp\wrojgeyomg.sys
1⤵
PID:5344

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:5608

C:\Temp\qligaysqli.sys
C:\Temp\qligaysqli.sys
1⤵
PID:4364

C:\Temp\nlfdavsnki.sys
C:\Temp\nlfdavsnki.sys
1⤵
PID:6032

C:\Temp\avsnlicavs.sys
C:\Temp\avsnlicavs.sys
1⤵
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpjebwu.exe

Path C:\Temp\bztrpjebwu.exe
Size 226KB
SHA256 937bc511ed9537c9a09ee6784fbc4e63241ddde6c975df6dc29a5a4ce7ef9f5f
MD5 a76d960f2878994ee5ecc45895136ccd
SHA1 43f292dbded4076c739c9ee58398d62517ae6897
SHA512 c809def0f6d35ac2c780cee8594ad21e737aa317b960d010a2fa9bf6b464411d8e309ca79a7c6e3e120e66504dd1dd081b5fc15e535078b2367e579a2cbf358e
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1A534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.sys

Path C:\Temp\ezwrpjhbzt.sys
Size 141KB
SHA256 eed9de4b3d86470395cf4ee9a861e1c542a9a464f9a11a10902821c71c2bff2c
MD5 f9ed765e933244765cf3d80f4f3b0d27
SHA1 6305438cf338fdbc0b58c50bbb9113cfaa2ac27e
SHA512 5719f1525f00eb40e62bd91f029f9e25af85d81b7fdadfed0335026feb4d416fc136030cd2179d288f802152815cc6079403e7369a60f0595345753a42e165ea
SSDEEP 1536:ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13CE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsqnifd.exe

Path C:\Temp\i_icavsqnifd.exe
Size 226KB
SHA256 403ab6ebb725cba68ae0c738ca9ad5f91d7f03d7ebe1961f54ff5096f5ad0ca3
MD5 f962d31f9831873255c8e834dc88e059
SHA1 ea2f5e09bdb92ce141ecbaf403f732c995ceaf86
SHA512 043f35e553b1f9660946915c903e4f5859fab0ee0de1f8affc4c92168f585d2aef6a265d681038c286fce97d5953f212b6e25b72793fcfc99c6752c6a8518c0a
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicauspnhf.exe

Path C:\Temp\i_kicauspnhf.exe
Size 226KB
SHA256 6603811f4f0ae27793dfd3e8d5cabc748022c63259e5e2c233ce449f2e2200b7
MD5 e9aaceb9e52436a317f541cb89a1abd1
SHA1 b340585f36f62fe19aa3431fb670be38b9cf11a8
SHA512 b4da5ca3ba57df69efead7c148ff0a294533c9a2ce7cf6db6a77174f7dd7f4a145000fb88b8e8c7cd19f2108a2538b7c6d19acaec7a4727314a78d081ee4ff1e
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T12634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfzxrpkhc.exe

Path C:\Temp\i_mhfzxrpkhc.exe
Size 226KB
SHA256 2d61722d0f2ebf0c6463130cbd66acb71b43e164d17d0be5e196f7d621706f30
MD5 bc93ba122bfe5f465f401f5ef5a9b7c0
SHA1 e8e649c1b2ced0d60bac2593f2d44ed067f55849
SHA512 0babf0f6d1c8b194187304e1fe1c04501722728087163225cbaba5ead878813dd1a1fc11844c04865fcbc0577a98f455b9de4f331c6fefe1fdb45ab35a3cd267
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1A834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlidyvqlg.exe

Path C:\Temp\i_tnlidyvqlg.exe
Size 226KB
SHA256 478c3a5b47a1ceefde43ce5938ed18ffef84449c0a829898e7ec951de790427f
MD5 a342c5330240d47c9ed6e9701dd19e3a
SHA1 c2aa77f02700999a192d7cd4d8819da61bfc3c62
SHA512 2edc1922be0aa2c0fb777947bd1daa2749ca620fbcf12effb66827ebf155e0807d6e9c4f4a210eed285eed7a1c07c7911758825454dc31fdfce4de491e01eb49
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1D734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmjecwuo.exe

Path C:\Temp\i_zurmjecwuo.exe
Size 226KB
SHA256 7df3d2bac5cb581a9bcd79cb5fcd1d29cd5a83176d3e387bf8b44d79b2cecadf
MD5 8117b9af8c6964ab55077b2d614aa6bb
SHA1 d2b1c8ba7d86b12ed3b1d021ead9641c41d77641
SHA512 3354aa7a4c228c7f51564848abc9fd30a50ae187a3d996a412e2224ee3c58a976b1457c4c860580ddd22185bcfc0b3615699064c6220dba941609461c464c398
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T15334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icauspkica.sys

Path C:\Temp\icauspkica.sys
Size 141KB
SHA256 4ed5c39f11a656a4994697aed43fb3b4bec1003c561a96a956ddd06cf23df628
MD5 67eec01546f37bf5cdc8b6efa1bfd8fc
SHA1 a74d76e46d875dafd637511672b3b1da1594f7ea
SHA512 492de2f77591541a071c467bba69fe77e6e410176eedf632afb0de76c3f7a40ac7096c3ff9781ace0fdc4405fb1b5fa595b69d10c563554b5f9cf369bffaf6ea
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T182E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsqnifd.exe

Path C:\Temp\icavsqnifd.exe
Size 226KB
SHA256 b598cb963d4c035cc5d1acf09f120407b8941194cfb0a38d2768f7edf49a3d10
MD5 f8d32798deb77a4329fef02ad61b0007
SHA1 64fcd8c025c8e644ba73c15603ce9778875fdf62
SHA512 4cdeb7c73b9c9f6a0e096eb50d2a4b380d0ef315a3ae619f5f9b5adb97e82ba7c7f1ca07c095611113a0149d7503a0843c6caa4b0cd378ccdb6ebd96281f1bb9
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T10134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicauspnhf.exe

Path C:\Temp\kicauspnhf.exe
Size 226KB
SHA256 f66107c831fd61fd41d5ca78d8b5a9c7afce2a8e277a088316f3fb4a42333f23
MD5 6d8573fd5c4c66bcaeb194075462e5e2
SHA1 7355be38501390dc89a02b39d67f78926cab0dbe
SHA512 6f06edc6decb134a9f3270a664b5b162dea299c9ac93529f032e388404ae9ff2f1ae0165aab3f0e42b1c7221892210dc107046c80d8f0731045d99e81ca5880f
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T11F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpkhc.exe

Path C:\Temp\mhfzxrpkhc.exe
Size 226KB
SHA256 63f1a3c82aedc38a4e9c167fddef4d55f9dd713a1395bf5a8120282c051634c3
MD5 d30014c0c232acfeafc32ce380a77039
SHA1 0c76f873df6a5d4bbb0b8ff23557107029e3974c
SHA512 24e1ef531a2442785e7829ae889f55e259954565b841b8f629a461e4658a73a4278e57b18614403d5698eec88ebc653bbca6e772dd68de26eaf8c555e781a220
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T15B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczurpmk.sys

Path C:\Temp\mkhczurpmk.sys
Size 141KB
SHA256 ecca85c052fd0f9260c593628b4104475f601bac6b55d1b25052d69f5496a1bd
MD5 dcb9e41cf01f0bb28958e43a29ac802d
SHA1 af8c6bbdec4b5c6f35469377a99b543e911ab246
SHA512 78fbcf714d458bd2d8d56194dc67fa971dad2670aef2420e366d5de7b56d98174ad30e030b2141840fb6d9c69920041defdeb48445ef07df9f79c1786ff2e203
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T191E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkic.sys

Path C:\Temp\nifaysqkic.sys
Size 141KB
SHA256 5ca3286947e1b409eebf3d01e714f92ea70c755073e6528dcb0f67d8d3bec3e3
MD5 fc4c4bb5a257fed136275cd32576fdf2
SHA1 d23a00d6cfbdd4e3cba63f9d5eae5443ea8a1382
SHA512 280eb88e24c1e08ecd4906ba9c0672ae69cf9a6413e583e3b705248d5dd01a7edc9d70d6a206a3d01e3193facf87f5f8eabb1e931000b62ff4eb8197ea238be6
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczusmkh.sys

Path C:\Temp\pkhczusmkh.sys
Size 141KB
SHA256 1e7e313ad955724180ae81320571be2cf0350fb5ccd6179b199210d5eb9b40e5
MD5 6e9b7dc786ea3a1d6ea67a1ff5382d62
SHA1 70919748521ed37629e98b499aa9dc4e7dd3b42f
SHA512 66c059b87fbc67dc6fa796c5d4088abc10bad889dd97e1e8bd0f5b96140d70c9839e8aff93e480f0b9c7395b2bff61b573f6688b1e9013e2fd46b7025e3891db
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidyvqlg.exe

Path C:\Temp\tnlidyvqlg.exe
Size 226KB
SHA256 c437f0e651de811f76ddc8015e317d7f60f67095941b7b80d8edd5e24f8a691d
MD5 6a1d239b0391a4d20eca97ab1c52aae0
SHA1 dea7057f714784732e5bfcef0845232df3586535
SHA512 4a48a50151851db3cf5b36e3412c6573b89a5df9492ac76d8d5062ab524f09f4190a64b8fd172a706cea41bf31dc59ac12daf4a9ac2a9d75fce334873a841b51
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T16634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjecwuo.exe

Path C:\Temp\zurmjecwuo.exe
Size 226KB
SHA256 82c0cdd478ac5c982750e62c55e2e8ff821102328283954fb06e8833578ebebe
MD5 6d9973f327d72627750b55a88df1dca2
SHA1 3f9653dd477c7f4de3a94a4b3b0d1fd07d48b4f6
SHA512 89a36ae8681926f0cd6e42d71445b6fb69e71150ebc4b20539fbbee6f017b9e7d96c5155274077373feda9b76321717ddcd520e3d6c61c263310ecfd58fb5551
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T11834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 620398557eb777b32ec0513d8b857c8239d583f309fa7f242953b50e949603a6
MD5 413e7241023451ad3dada7015150399d
SHA1 f07604d409182a8cb4a985e7ac234c747cc3c228
SHA512 0d7b6a6f7920137fc3f2bd7f3f3a7a130f6771f85046110e7540ce812db714ee842222deae8f6c8ca334733ddafd7fb592a0189f8f422dd94de48cb6431e8475
TLSH
T17741FC66CBF8B8DDD79248B110E0116A32F584D9051BEEA072F49EB34AC3F3491F8123
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f16703dd3d3d50cfa96d044b54ddc38e378b0d06ae8034823af4f49a1288b87e
MD5 2e94e770d76776c135298700e146cb7b
SHA1 3c8316a71276b553432a6d46c7a7ffe2894b9487
SHA512 0bcf19652c511dd47640a97bc78a50e4fb4788829b6624ab695bfe41d3932e21cb88cba20da622cc31891353bca94caecbb19fd3c0ece33d114fd7f6f6652bd3
TLSH
T10A519FF3C6E8866E890156F4AA146E2BCE1D0954432C3D9A88E4EF1B93E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ad30cb0320db90b433c323838c197210c207572ce5764cc09b80ca063c2b0b60
MD5 27aabab37c1daa0929bf16996018c62c
SHA1 e11b39ed717e25bd7a25d8b4966ac5c7de157c00
SHA512 dbd1a3b1cb27b1cc0f4ee31f630dc257ff48d6731a25a0ace6d7815b24f35dddf9944f2f212eeaff89d300545f3a28d85881cb4757af6ad3efdddba7fcaa5da0
SSDEEP 192:sxRRR+CD/fvsPVvZq1uNzoA8p90/g6+WNC82oJ/YZFLwYVGMIgVNtVJ:sxRR7D/fvsPVxq1W/5N/SFJ
TLSH
T11C42B8166D28A93B5CC7D21DBB59BF53D2F95032B5945E48FAFC8A0C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8f3e97cddd5fa9ff5fa5dead888a1c473f007bc9e4e345802f4d9d4ced3de792
MD5 4466265346b449c43fe995d6635c6fd8
SHA1 4ef1bbe7639bbc44eb6808c3c6807727ab04b978
SHA512 060887852dc7923a98f087a4ec1d595943bb338804bf87383aed853a9b3943448f6ff663829aa76f7a3556b685d910d2fc987103fa867a46e82009287731e51e
SSDEEP 192:sxRSR+CD/fvs+xvZq1uNzoA8p90/g6+WNC82oJ/YZFLwwVGMIgDoNtVJ:sxRS7D/fvs+xxq1W/5N/Sf4
TLSH
T16D42B81A69289D3B5CC7D219BB55BF53E2F95032B5912E48E6FC8B0C14EB6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2ad9035c64993a947933252a538e3a4f20e8da38d9e8bcf57351b8b41c0ccec3
MD5 abf4e29608bb6b856218e5d4e15c52b7
SHA1 79f7bf8db6bb0a1fd8930b0b54b968a7f823c6f6
SHA512 bdb5d75f73c58fedaf361e534b0ce9c5b4aac683884a039e50bb4471e5882698cbd0ebd272c0bd57190ccd785d38ad16036655d2b2c99a4056cd4d4d4637ac71
SSDEEP 192:sxRSR+CD/fvs+VvZq1uNzoA8p90/g6+WNC82oJ/YZFLwYVGMIgDSNtVJ:sxRS7D/fvs+Vxq1W/5N/SF6
TLSH
T11F42B71A6D28993B5CC7D21ABB55BF53D2F95032B5905E48EAFC8B0C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 f8fd2c3670b91458d605c4deea41b568c90524f302e5dc7f771de5da80567d36
MD5 a973f42dd7fb26a8cfb7d6e35ea3600b
SHA1 e48eaa5d74e1756255dd4eb54b258334d84e933e
SHA512 5a9effc17e56da595859c0ba224ddcd78e1386ad4f44ec985bbe5c95e566b06f1f968964f82cbb6e67e2a4addc27e8c79e0b7149b9605c8467ddbfb388755fb3
SSDEEP 768:K80EpB7pLuLfrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV99owLWiroLWwJp:K80Ep3EfrwWgNhfVNu1jaG9ogW5LWwJp
TLSH
T112D2E97B740DCB7E4F800ADDAC197E9A6DA802CB96D8CD8047FE855C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4fc03bca33e34028649ac2f72c4d8f82a8cccb7155c8cfec56b642eeb0d00110
MD5 55025fa4c4147b65982a20f1e5e256f1
SHA1 fc08876f210e41562448224ee1aa7016a20a6901
SHA512 f5df22d16680e6120e7338ee4f4c05ca3af33ae7182c4556c2aefbea487d1365571c7eaecacf94f6698ce2bfa09b5aabc72279b61b8b6baf172b768fa308c8d7
SSDEEP 96:KRT8ZNbRRtWFKAg1tK4MgbtcjbylxWH+zC+4AwmWgFNg+mK4jg8mc2edsBMgK96+:CT8ZNbRRIFKR1nMgbCjbylxWH+zC+4A0
TLSH
T1D9A10314307A06543C3D7A1889A89D6F97C2B4E23019E52B7BE951F60F6AE434EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 673b745f6beb13c464bcc61324e6573e457d62e873c88ced94cb425c66546da6
MD5 26cad4ea014a7760f46e474364ce32de
SHA1 81215f841f285d357b47c7c9cde0a65ef5bfa527
SHA512 e2dab4003ba50df19507b3abdeb622c0ce9986eb299376c736115ad3a3b27644c529093d9f7d1b343e7f78db2b8dedbc1b95f1de958b83a0b502eb2f73738aa9
SSDEEP 768:dr3bk+LeSFOUkdyX4fouOToPvB2thtA9VAgEb9MS:dr3Hsnnwthttdb+S
TLSH
T145F2B071A8698D73DCDAD354720A37966FF0517399D40F88DADD9B0D0907AAD0F0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 11a57ee042411d270146f90c6c16eb9f0d4504458cb1ac2da3e57f29b6ec7f7d
MD5 3e9826b377fffc860968cba534810cbd
SHA1 27c00a56e58a9774eea2b1dd9bd9f9f1c9d5a466
SHA512 56ceeb9281277ca29438e5f7963ed1623ede0e6b70eaf19086a18222ae5f974ead26a3059d622170aefa85a02478d6531bcf133f402c92122d17368ab4554854
SSDEEP 768:grv+4UNbdH3d1+LeSFOUWX4fouOToPvB2thtA9VAwGeVH1SlX:gbsbh39snnwthttHEH1Y
TLSH
T17703CF32A8A88933EDE6D398720B76472FF4816396D00BC4DADD1B4D079B9DD070BC5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1ac9dee4c2dc55d846dd05b9f4bc45748fdc2f3eea6f8ed93b7b281f6d581580
MD5 c7054bfbec26bb01aace0c430562d684
SHA1 4a0e063f0993306c0e91893b9d2e411044b66104
SHA512 0abe92d6ae95d4baa1ee01c22919e703b6e918989c427bac644a9ab873f88471584566eab22f29217747a34b3bb947f44ea7dd035024461705cc92fee110d147
SSDEEP 768:jJ37yk+LHScOUkdoX4fouOToPvB2thtA9VAgEb9MS:jJ37Ysnnwthttdb+S
TLSH
T1701349F1A8D74933D89D9357733E2E811EBCC163B5940A84BBD95A0DCD065BFCB0A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6d59e7ac173e2ea7cb0125c37359b8ad8a5b981fc981fb2e3bac3225897f3724
MD5 59ed3d80d652722ad48f567f3704ae1a
SHA1 f1aed6c3994db55fb02c69b796907c76512e6e63
SHA512 e52de1a0647e8cc5772a9086b4f00c2eabd689dc5cc357aa3c2ddce657bb9167e7b2b79810f0e759f117429392482e5918bb8e1e5d41a655ef7205fa4f3546b6
SSDEEP 768:crv+4UNbdE3rk+LeSFOUkdLX4fouOToPvB2thtA9VAgEb9Mh:cbsbq3Csnnwthttdb+h
TLSH
T18913C031B86C8D73DDE6D268720B76873FF051A399D00B88DAD95B4D094B5EE1B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 36085acf8c54d3969c4fa89f0f455a7d054a22ddfc6ad23a61b015f7ca0a5704
MD5 3efc3d7a9334afc3043d3f42080ad0e9
SHA1 9bdee5ec42d8f4a3cf93d33c95dfa0226679b2ab
SHA512 4b2cd463e52c810e869084e982499c489316da392ac40a22273348cc8772ab311ef23bd37d2b50494dd0344dfad4edd5265f94ad531c1c03923264ac9739ca42
SSDEEP 768:4r3Kk+LeSFOUkdyX4fouOToPvB2thtA9VAgEb9MS:4r3gsnnwthttdb+S
TLSH
T135F2C071A8A98D73ECDAD354720A37966FF0517399D40F88DADD9B0D0907AAD0F0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfcaffc1-c500-45d8-9717-904d0664199d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dfcaffc1-c500-45d8-9717-904d0664199d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59c896.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59c896.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

08467cf6-8b23-475c-a68e-754c035e3a71.tmp

Path C:\Users\Admin\AppData\Local\Temp\08467cf6-8b23-475c-a68e-754c035e3a71.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5236_1410442688\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2176-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2344-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2640-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3380-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-609-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3692-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4248-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-710-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4364-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4932-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5148-588-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5152-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5344-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5608-668-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5608-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download