02b7ca5d4eda2999896344592cd93c9b7efb068205e28e02d25c3a31678bfb4b

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260804-c94paa1ana
SHA256 02b7ca5d4eda2999896344592cd93c9b7efb068205e28e02d25c3a31678bfb4b
MD5 71a9d9eaa6dd08a4c121af107bb2a5b3
SHA1 10f93e69ce3aaf70ddf86c74205a28ad580970dc
SHA512 0f247125181e33da0b2bfb416062653089c6b7167096734b555f1f821eed2f3e8b7c44e3ad600189b976d00b6f8ca089f62bbadfb2f896a6782e24bae7c82136
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T14434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5884	CP.exe
2580	ljebwtojbw.exe
1308	CP.exe
5304	CP.exe
1540	i_ljebwtojbw.exe
3564	eywqoigbyt.sys
6108	CP.exe
2532	nljdbvtolg.exe
4432	CP.exe
1324	CP.exe
5208	i_nljdbvtolg.exe
2848	nljdbvtnlf.sys
96	CP.exe
816	gdyvqliday.exe
872	CP.exe
4352	CP.exe
6088	i_gdyvqliday.exe
6084	sqkidaysqk.sys
4320	CP.exe
6064	qnlfcavsqn.exe
2436	CP.exe
5312	CP.exe
5092	i_qnlfcavsqn.exe
2660	sqnhfaxsqn.sys
4120	CP.exe
5744	pnkfdxvpnh.exe
5916	CP.exe
616	CP.exe
3912	i_pnkfdxvpnh.exe
5300	uspkhfaxvp.sys
3676	CP.exe
1352	pnkfcxrpkh.exe
1728	CP.exe
4356	CP.exe
5084	i_pnkfcxrpkh.exe
1436	pjhfzxrpkh.sys
4612	CP.exe
1172	mkecwupmhe.exe
3984	CP.exe
4128	CP.exe
2128	i_mkecwupmhe.exe
5180	mkecwuomjh.sys
5740	CP.exe
4488	mkecwuomge.exe
3812	CP.exe
4424	CP.exe
2400	i_mkecwuomge.exe
1120	rojheywtrl.sys
4520	CP.exe
5596	omgeywuomg.exe
3324	CP.exe
2600	CP.exe
5628	i_omgeywuomg.exe
5876	ebztoljebw.sys
2388	CP.exe
4164	qoigbytqol.exe
1980	CP.exe
4268	CP.exe
5180	i_qoigbytqol.exe
6104	vtqligeywq.sys
692	CP.exe
1788	vtnljdbvtn.exe
1552	CP.exe
5676	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1042524303\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_752349117\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1004_1692093400\_locales\en_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwrpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtojbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kiusnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kiusnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgebztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfcavsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfcavsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtojbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwrpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgebztroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfdxvpnh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3320	ipconfig.exe
5636	ipconfig.exe
1064	ipconfig.exe
5716	ipconfig.exe
1980	ipconfig.exe
2308	ipconfig.exe
2956	ipconfig.exe
2604	ipconfig.exe
4092	ipconfig.exe
1788	ipconfig.exe
2660	ipconfig.exe
1596	ipconfig.exe
4152	ipconfig.exe
924	ipconfig.exe
4272	ipconfig.exe
3340	ipconfig.exe
4672	ipconfig.exe
3416	ipconfig.exe
1576	ipconfig.exe
5964	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302852558856257"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{491D60EC-1B1A-4738-A349-A411C70910BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	i_ljebwtojbw.exe
Token: SeDebugPrivilege	5208	i_nljdbvtolg.exe
Token: SeDebugPrivilege	6088	i_gdyvqliday.exe
Token: SeDebugPrivilege	5092	i_qnlfcavsqn.exe
Token: SeDebugPrivilege	3912	i_pnkfdxvpnh.exe
Token: SeDebugPrivilege	5084	i_pnkfcxrpkh.exe
Token: SeDebugPrivilege	2128	i_mkecwupmhe.exe
Token: SeDebugPrivilege	2400	i_mkecwuomge.exe
Token: SeDebugPrivilege	5628	i_omgeywuomg.exe
Token: SeDebugPrivilege	5180	i_qoigbytqol.exe
Token: SeDebugPrivilege	1092	i_vtnljdbvtn.exe
Token: SeDebugPrivilege	4700	i_vqnlfdxvqn.exe
Token: SeDebugPrivilege	6104	i_snkifaysqk.exe
Token: SeDebugPrivilege	4744	i_kiusnkfcxv.exe
Token: SeDebugPrivilege	4316	i_hczxupmkec.exe
Token: SeDebugPrivilege	4700	i_hecwrpmhez.exe
Token: SeDebugPrivilege	3432	i_mjecwuomhe.exe
Token: SeDebugPrivilege	6140	i_ojgebztroj.exe
Token: SeDebugPrivilege	5024	i_ljdbvtolge.exe
Token: SeDebugPrivilege	4524	i_igaysqlida.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3372	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3372 wrote to memory of 1004	3372	iexplore.exe	91
PID 1004 wrote to memory of 1656	1004	msedge.exe	92
PID 1004 wrote to memory of 244	1004	msedge.exe	93
PID 1004 wrote to memory of 4296	1004	msedge.exe	94
PID 1004 wrote to memory of 4296	1004	msedge.exe	94
PID 1004 wrote to memory of 1264	1004	msedge.exe	96
PID 1004 wrote to memory of 1264	1004	msedge.exe	96
PID 1004 wrote to memory of 1264	1004	msedge.exe	96
PID 1004 wrote to memory of 4816	1004	msedge.exe	98
PID 1004 wrote to memory of 3280	1004	msedge.exe	97
PID 1004 wrote to memory of 4816	1004	msedge.exe	98
PID 1004 wrote to memory of 4816	1004	msedge.exe	98
PID 1004 wrote to memory of 3280	1004	msedge.exe	97
PID 1004 wrote to memory of 3280	1004	msedge.exe	97
PID 1004 wrote to memory of 4572	1004	msedge.exe	99
PID 1004 wrote to memory of 4572	1004	msedge.exe	99
PID 1004 wrote to memory of 4572	1004	msedge.exe	99
PID 1004 wrote to memory of 1148	1004	msedge.exe	100
PID 1004 wrote to memory of 1148	1004	msedge.exe	100
PID 1004 wrote to memory of 1148	1004	msedge.exe	100
PID 1004 wrote to memory of 944	1004	msedge.exe	101
PID 1004 wrote to memory of 944	1004	msedge.exe	101
PID 1004 wrote to memory of 1884	1004	msedge.exe	103
PID 1004 wrote to memory of 3864	1004	msedge.exe	104
PID 1004 wrote to memory of 1884	1004	msedge.exe	103
PID 1004 wrote to memory of 3864	1004	msedge.exe	104
PID 2300 wrote to memory of 5884	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2580 wrote to memory of 1308	2580	ljebwtojbw.exe	108
PID 1004 wrote to memory of 3724	1004	msedge.exe	112
PID 1004 wrote to memory of 4844	1004	msedge.exe	113
PID 1004 wrote to memory of 4844	1004	msedge.exe	113
PID 1004 wrote to memory of 5636	1004	msedge.exe	126
PID 1004 wrote to memory of 5636	1004	msedge.exe	126
PID 1004 wrote to memory of 2256	1004	msedge.exe	117
PID 1004 wrote to memory of 2256	1004	msedge.exe	117
PID 1004 wrote to memory of 1792	1004	msedge.exe	118
PID 1004 wrote to memory of 1792	1004	msedge.exe	118
PID 2300 wrote to memory of 5304	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 2300 wrote to memory of 6108	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2532 wrote to memory of 4432	2532	nljdbvtolg.exe	125
PID 2300 wrote to memory of 1324	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 2300 wrote to memory of 96	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 816 wrote to memory of 872	816	gdyvqliday.exe	134
PID 2300 wrote to memory of 4352	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 2300 wrote to memory of 4320	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 6064 wrote to memory of 2436	6064	qnlfcavsqn.exe	143
PID 2300 wrote to memory of 5312	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 1004 wrote to memory of 3624	1004	msedge.exe	149
PID 1004 wrote to memory of 2928	1004	msedge.exe	150
PID 1004 wrote to memory of 4128	1004	msedge.exe	151
PID 2300 wrote to memory of 4120	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 5744 wrote to memory of 5916	5744	pnkfdxvpnh.exe	156
PID 2300 wrote to memory of 616	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 2300 wrote to memory of 3676	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1352 wrote to memory of 1728	1352	pnkfcxrpkh.exe	165
PID 2300 wrote to memory of 4356	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 2300 wrote to memory of 4612	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 1172 wrote to memory of 3984	1172	mkecwupmhe.exe	174
PID 2300 wrote to memory of 4128	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 2300 wrote to memory of 5740	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4488 wrote to memory of 3812	4488	mkecwuomge.exe	183
PID 2300 wrote to memory of 4424	2300	2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 1004 wrote to memory of 2564	1004	msedge.exe	188

C:\Users\Admin\AppData\Local\Temp\2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_71a9d9eaa6dd08a4c121af107bb2a5b3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x314,0x7ff860c4c188,0x7ff860c4c194,0x7ff860c4c1a0
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,17584482143533687895,6713820487886869236,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
      4⤵
      System Time Discovery
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1959078763249313689,10136207691355437352,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:13
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,4731113135949999432,8736566785664649720,262144 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,13213993202678788881,3791599753246650219,2097152 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,17579662739205525195,12987620128758912816,2097152 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17447111077431279881,18321529283666892504,2097152 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14476641707564067757,11087052015811161728,2097152 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:9
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,11603129534709976252,4693865165883000805,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:14
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,5017226621969023038,18016830179070528640,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,14428745533826694229,13684796552427185433,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5437222180778372297,1196202682564348571,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5437222180778372297,1196202682564348571,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,3660606795603875089,4657628642850091129,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,1360276439740184861,7525740058473781973,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,4628452476028834454,17321356813641771404,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:2256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15824947719775043305,5894436502466584147,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,10734931051068765383,3665969357890084702,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,6083307631426895458,4972891111994301134,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8170059207506976267,14687873575937045538,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,9532639036614744062,12978578495269257080,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,4843947299011547966,568804248549973791,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,1280142290744391494,13227239591258399438,262144 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,13166856165423297209,14244831391446519438,524288 --field-trial-handle=2228,i,12177784507629028057,7833467621448959370,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:5264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwtojbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5884
- - C:\Temp\ljebwtojbw.exe
    C:\Temp\ljebwtojbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwtojbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\i_ljebwtojbw.exe
    C:\Temp\i_ljebwtojbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nljdbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6108
- - C:\Temp\nljdbvtolg.exe
    C:\Temp\nljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nljdbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\i_nljdbvtolg.exe
    C:\Temp\i_nljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqliday.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:96
- - C:\Temp\gdyvqliday.exe
    C:\Temp\gdyvqliday.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqliday.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_gdyvqliday.exe
    C:\Temp\i_gdyvqliday.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfcavsqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\qnlfcavsqn.exe
    C:\Temp\qnlfcavsqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfcavsqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5312
- - C:\Temp\i_qnlfcavsqn.exe
    C:\Temp\i_qnlfcavsqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4120
- - C:\Temp\pnkfdxvpnh.exe
    C:\Temp\pnkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Temp\i_pnkfdxvpnh.exe
    C:\Temp\i_pnkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkfcxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Temp\pnkfcxrpkh.exe
    C:\Temp\pnkfcxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkfcxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Temp\i_pnkfcxrpkh.exe
    C:\Temp\i_pnkfcxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\mkecwupmhe.exe
    C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\i_mkecwupmhe.exe
    C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5740
- - C:\Temp\mkecwuomge.exe
    C:\Temp\mkecwuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4424
- - C:\Temp\i_mkecwuomge.exe
    C:\Temp\i_mkecwuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4520
- - C:\Temp\omgeywuomg.exe
    C:\Temp\omgeywuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\i_omgeywuomg.exe
    C:\Temp\i_omgeywuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytqol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2388
- - C:\Temp\qoigbytqol.exe
    C:\Temp\qoigbytqol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytqol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4268
- - C:\Temp\i_qoigbytqol.exe
    C:\Temp\i_qoigbytqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnljdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Temp\vtnljdbvtn.exe
    C:\Temp\vtnljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnljdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\i_vtnljdbvtn.exe
    C:\Temp\i_vtnljdbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnlfdxvqn.exe ups_run
  2⤵
  PID:6088
- - C:\Temp\vqnlfdxvqn.exe
    C:\Temp\vqnlfdxvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnlfdxvqn.exe ups_ins
  2⤵
  PID:2504
- - C:\Temp\i_vqnlfdxvqn.exe
    C:\Temp\i_vqnlfdxvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkifaysqk.exe ups_run
  2⤵
  PID:1012
- - C:\Temp\snkifaysqk.exe
    C:\Temp\snkifaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkifaysqk.exe ups_ins
  2⤵
  PID:3980
- - C:\Temp\i_snkifaysqk.exe
    C:\Temp\i_snkifaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kiusnkfcxv.exe ups_run
  2⤵
  PID:5284
- - C:\Temp\kiusnkfcxv.exe
    C:\Temp\kiusnkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kiusnkfcxv.exe ups_ins
  2⤵
  PID:2256
- - C:\Temp\i_kiusnkfcxv.exe
    C:\Temp\i_kiusnkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczxupmkec.exe ups_run
  2⤵
  PID:3212
- - C:\Temp\hczxupmkec.exe
    C:\Temp\hczxupmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczxupmkec.exe ups_ins
  2⤵
  PID:3968
- - C:\Temp\i_hczxupmkec.exe
    C:\Temp\i_hczxupmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwrpmhez.exe ups_run
  2⤵
  PID:1960
- - C:\Temp\hecwrpmhez.exe
    C:\Temp\hecwrpmhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwrpmhez.exe ups_ins
  2⤵
  PID:2976
- - C:\Temp\i_hecwrpmhez.exe
    C:\Temp\i_hecwrpmhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomhe.exe ups_run
  2⤵
  PID:4736
- - C:\Temp\mjecwuomhe.exe
    C:\Temp\mjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomhe.exe ups_ins
  2⤵
  PID:5948
- - C:\Temp\i_mjecwuomhe.exe
    C:\Temp\i_mjecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgebztroj.exe ups_run
  2⤵
  PID:2544
- - C:\Temp\ojgebztroj.exe
    C:\Temp\ojgebztroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgebztroj.exe ups_ins
  2⤵
  PID:5336
- - C:\Temp\i_ojgebztroj.exe
    C:\Temp\i_ojgebztroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  PID:5648
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  PID:3416
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqlida.exe ups_run
  2⤵
  PID:2104
- - C:\Temp\igaysqlida.exe
    C:\Temp\igaysqlida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqlida.exe ups_ins
  2⤵
  PID:3668
- - C:\Temp\i_igaysqlida.exe
    C:\Temp\i_igaysqlida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4380

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:3564

C:\Temp\nljdbvtnlf.sys
C:\Temp\nljdbvtnlf.sys
1⤵
- Executes dropped EXE
PID:2848

C:\Temp\sqkidaysqk.sys
C:\Temp\sqkidaysqk.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\sqnhfaxsqn.sys
C:\Temp\sqnhfaxsqn.sys
1⤵
- Executes dropped EXE
PID:2660

C:\Temp\uspkhfaxvp.sys
C:\Temp\uspkhfaxvp.sys
1⤵
- Executes dropped EXE
PID:5300

C:\Temp\pjhfzxrpkh.sys
C:\Temp\pjhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:1436

C:\Temp\mkecwuomjh.sys
C:\Temp\mkecwuomjh.sys
1⤵
- Executes dropped EXE
PID:5180

C:\Temp\rojheywtrl.sys
C:\Temp\rojheywtrl.sys
1⤵
- Executes dropped EXE
PID:1120

C:\Temp\ebztoljebw.sys
C:\Temp\ebztoljebw.sys
1⤵
- Executes dropped EXE
PID:5876

C:\Temp\vtqligeywq.sys
C:\Temp\vtqligeywq.sys
1⤵
- Executes dropped EXE
PID:6104

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
PID:4480

C:\Temp\pnkfcayvpn.sys
C:\Temp\pnkfcayvpn.sys
1⤵
PID:1456

C:\Temp\icausnkica.sys
C:\Temp\icausnkica.sys
1⤵
PID:508

C:\Temp\khfzxrpnhf.sys
C:\Temp\khfzxrpnhf.sys
1⤵
PID:2000

C:\Temp\hbzwusmkec.sys
C:\Temp\hbzwusmkec.sys
1⤵
PID:2884

C:\Temp\xrpjhecwuo.sys
C:\Temp\xrpjhecwuo.sys
1⤵
PID:3104

C:\Temp\rojgebwtrm.sys
C:\Temp\rojgebwtrm.sys
1⤵
PID:3864

C:\Temp\oljdbztrlj.sys
C:\Temp\oljdbztrlj.sys
1⤵
PID:2432

C:\Temp\igaytqliga.sys
C:\Temp\igaytqliga.sys
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoigbyt.sys

Path C:\Temp\eywqoigbyt.sys
Size 141KB
SHA256 7a8c2356b19295d161fa2a323a31e2217cf335646cec4a09b4a61535ff71fe45
MD5 a9cf3548b69c7d21c5f625a4fb5687ed
SHA1 27f1563baf9723c44bad2b1bbdd759dc721117b3
SHA512 f483b1d2a9639fd97caad02353dc3823c358893d24f5ebbbda8b8c3bf12749742b9aa17d548944005fa51c4a22300bb254aca06dbd6bcfc7da2295c25b31fedc
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T133E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqliday.exe

Path C:\Temp\gdyvqliday.exe
Size 226KB
SHA256 fb5e8025d7b0661ae580728afaa55decbb2e5c895de61bf6182300e4711fd277
MD5 86bed7cd9266a635422331cc645b37f9
SHA1 2b693c2d1d8b5e12c7b3063a00b686c25a9b1acd
SHA512 11f0467bb49edc69565041144e4b4905fef8715eceb0e612a22382639a9e87e54a42b4e8946207f3008822dfb6d11388c9e12b4a7c4fb10bb211377cf04efe79
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T13634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqliday.exe

Path C:\Temp\i_gdyvqliday.exe
Size 226KB
SHA256 ae3daba7c96c8d39861f26aa21bbaff8311b46f8f4d33067fa53fedd43dc55bf
MD5 9f0745dd3d0381282862a10dfda78d62
SHA1 2cc6bd4c37d437ed8963d177dc13ecb2608abb70
SHA512 1faa22e66ed99bf01a43ab5fe5a77ac90263bd391d1fb3748c9645f0685da39ab42bcb400e7443924a9368cb075fd145c7ee210a9b36eed0a245004732cebc3e
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T10434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebwtojbw.exe

Path C:\Temp\i_ljebwtojbw.exe
Size 226KB
SHA256 c47002a7d859a5fe80e38436ebc72d77fdc5a141859aec0f7aa340adaee4866e
MD5 78c5d5996757714625c17d69038ccfda
SHA1 8c43d345e1d45b99a11ea791382ddd5479e9836c
SHA512 85d3f67e20480e1235a4f2cdfae0bdb77cc7f3146253d3ae0da453e3ce4dc050f8ac5d92ccf535b36f59c20d460ca926f99f8cb2ac2a5fd2ecc364f32c0847f9
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1B434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljdbvtolg.exe

Path C:\Temp\i_nljdbvtolg.exe
Size 226KB
SHA256 3aa807158e9087c413415c2421ce9b34150c1192b463cbec7ac38e41d585ba52
MD5 2289746a4b7a58714662cd89b100425b
SHA1 3aee25f29836a116d62494a9eae0d14438088741
SHA512 64b6abddcda1143b8f9dd662c9e966c6189aac632f33c46c8d4c02c9ea04ba5af679bc62fecb52fff686728a0a5852fa32c538b9be9700279b607d07a3cb7b67
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T12D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfcxrpkh.exe

Path C:\Temp\i_pnkfcxrpkh.exe
Size 226KB
SHA256 48cc111f0963c02058c3209f0f0f396dd2a5016b526e13bd7bc4c6b7ee929e33
MD5 8ea97c20eb99c4240347383e2b4b86f8
SHA1 a67d5ae127e6690ea61909e7b9185613214581f6
SHA512 98a74e52e24364334c634eefe45486739e5fce5dfbb35b1485f8cd7b8bec539a11c9b114a13489a40d927c8c046f996032da404aa7d127123a09fe3b5153636a
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfdxvpnh.exe

Path C:\Temp\i_pnkfdxvpnh.exe
Size 226KB
SHA256 1e92a0beeb1468b7fe6434f18df6b5578dabca0f78c8c8ba513bacb02babdfed
MD5 09ad10481c9bcd5ee01405a2c757cdae
SHA1 103372e5ef9c815bf095e736145bf37aa6864a6c
SHA512 ba834a3770f6dbdfebe41604eac51b7682925f8f5a58684eefe69a944edc5b121b67e101d414e031c9102eb45f621fcd01b723200429abafd6898bc13383508b
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1F534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfcavsqn.exe

Path C:\Temp\i_qnlfcavsqn.exe
Size 226KB
SHA256 a60cf1b4c092941b5c4466bec16342822049eff5ab740486e67bfefd3f17fb7b
MD5 f8a3a3bd9040e0685517918866f2d366
SHA1 152c4af3e3ccc3ebd397730257a812cf15acbebc
SHA512 e32bebe65167604575f513d746ca64c0b6834107c658efb3dad28b5ad4c538145e16e9d11b18d02043b960b21937d9ec1b36ae9423bca1b1342dc76ecf316a45
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T10D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtojbw.exe

Path C:\Temp\ljebwtojbw.exe
Size 226KB
SHA256 dcfa234af5c8b94fc9596a4a0dc7d3052d1b83a65ac50ebe5d8b9a76d3e6c43f
MD5 f4be70265c2f78cd7dc1e3f1cfcc40c7
SHA1 34b7a9b4e2b4abcbec9de42836d796ee57df55c9
SHA512 a51f592065e068fdd6aba921e9df0ffc62a8d3146b769f0a0c8d38eea4fad5173cd3b06c9602a045a398430b430415735475f6e0b92c45da0d2ad67447b4f8aa
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtnlf.sys

Path C:\Temp\nljdbvtnlf.sys
Size 141KB
SHA256 2c157157e25deb6e0621e4be28919f7dd5373ebb996e7da2a125f151ed744a9d
MD5 150ac1465224cb1a4ccef29bbb9edeb5
SHA1 8745b0b1517c05dc7a0f28d9db0aa157575ff1b4
SHA512 50f720e835004050f7f577b30ff5a2b916f7ef3e4a9af4fd3218a7b3ea6508936270574430fdbd989bafa63179feb6300fd8e4d0cb00c5b5344f66e1bc8142d3
SSDEEP 1536:0a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:0a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B8E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdbvtolg.exe

Path C:\Temp\nljdbvtolg.exe
Size 226KB
SHA256 4ac5fc0cadba3d7a6ba6000b018daf46206da461e2822d5c21957c10cb529b91
MD5 42972b13cee38d6bed43d77fe1ddc623
SHA1 d16454e16cc0686a3ead37dfc7e3bba1342187a7
SHA512 a6f28407c8961c96886b002a5022b7ca8204254f850f7107fb44e642309a45776cd6a0c529887d35f29e6c5eb16b06537e9b4e2c2094fca154b62cc14ed4910c
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T11434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcxrpkh.exe

Path C:\Temp\pnkfcxrpkh.exe
Size 226KB
SHA256 5e64b32351098d35bec3d9d10f5066ecd0f82ad346f6121d29d59a69c8ee1673
MD5 6acc7a8408220dae7987139b310c662a
SHA1 819f9628c0c08f1115835b5ea104d5a18c5194f8
SHA512 1a196f820e3419bc158054fef562ddcddc7d9d940fffd55003f03e25864b4813e3efd82410c79803165f7a758214c13dd2a2e3c6b0eba4a67a36dc731fb96d9d
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfdxvpnh.exe

Path C:\Temp\pnkfdxvpnh.exe
Size 226KB
SHA256 b71971ce444d4294f7437d520d8fc643640f23cd88e6784d8b34b1bf808ad0eb
MD5 56ae905785d5e8d5dc2eca9040ab58b0
SHA1 157e1f15e956c9bbc14e4bf95598f82bffb43668
SHA512 b4fd94e083994ae01df626a2dd7abb94394ffbdc1497310a8f9d621775762b4c99f360674574a119eec480fb08bfe7275dc702d72ecce93b7ec65fbb36c6b2b4
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T17334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfcavsqn.exe

Path C:\Temp\qnlfcavsqn.exe
Size 226KB
SHA256 c5da3ca013cda5cfbf9c2738faf08264176b597240a2354c50fc7a821091b5f3
MD5 3d79c318e4ec820c9b9b095c3c8916c1
SHA1 a8be4be2ff9b15030ccc61e93030999e8116ebd4
SHA512 cfd7a3f4e3c9060fc1cfa4259c0b36dd1427c4eec417db2548c90b3a8b8852caa1e5c301c3f5281484bc5a97559eed8a5f16b129de63b8af29387558a2bbfee3
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T18D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidaysqk.sys

Path C:\Temp\sqkidaysqk.sys
Size 141KB
SHA256 5dae5272e6c42d719838963b9c9f74f99f2cf670a7001cca0b4c8c365f46ba83
MD5 3c2bcf8713a297ed94eeb650eff00aac
SHA1 766e8f7267b5476e5dc3e576510ac8ec67e977e8
SHA512 f4302ff21c2b545576874fc91d304d7b5dbceea28eef4169d8bdf85ce8eb7dbe9d4c33dc37e616ae9122914d1d5c86335c25b48dd7f658d4947e3df6a575b0c4
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnhfaxsqn.sys

Path C:\Temp\sqnhfaxsqn.sys
Size 141KB
SHA256 051fa5461cd6ca0a5b560877b81b04b9ba5edb8ed1aa783a5efa5b345657057c
MD5 3f0425ef20680e147824f5d7638888b4
SHA1 c4725f5584891b3427c2c9dda9d4171feeb79485
SHA512 309b861cc8326d9578ea873a279a349e8135cb2bd809c8c92a15239fd8ee34616122f28716f2f9eaa4ca1f69effb0f712bf26c29cf10c8e764198f1202a7c7d4
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12EE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkhfaxvp.sys

Path C:\Temp\uspkhfaxvp.sys
Size 141KB
SHA256 13d53fa21dd962508e38e3629b3bd1fae4e176fa001d4fb43a78580ff6f2946e
MD5 56fc54760459179387145d017dba68d2
SHA1 662ea2b51bcac823e387e62878e6936f6e7d6696
SHA512 d3b6d4445e2b450966094a84e9f7b296e452f1a4c843fd2b085b1626041bd2aa231d2090c3cc5a97f667431a9ca7014ee9a1aacf5bbfb349065b92b1466a2395
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T187E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 08f253607fd3040872be19b672ea3e447da55bf342d3d0958c081ab45db68efb
MD5 a8d0878ed4a6e158317791c0ebc09a03
SHA1 7a5b0b1e7ef65c5cb93a829644684970e385f9ec
SHA512 4093ea7c949317f7cee280f161ced8fc1e14e42c11334b78612655d3e5309cf442390508b8f49594c1cfae259fbe96806edba3670c931625d78a20c693e964a7
TLSH
T199611CED733EAFC3FF604CB29C90A49A31E48645162BAE82A1501DF0484EF6461DB127
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ac63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ac63.TMP
Size 3KB
SHA256 046c1353ac9bb1432ee7da6d943fc75cf50298897ee77322b47230e28da40e40
MD5 c04f8e8e10202e24d6b7747c9016bef9
SHA1 0970f99363f3010cf9dddec53a9d5a159007bf35
SHA512 06040136297a910705b3bf47510230316070aeb7148dabbb8a892b23dd16f523de94c9826734ada00781b5554b8324eb0bf2c7cf0a52b39c4dde52e34257dab6
TLSH
T1A0612CED773EAFC3FF604CB29C91A49A31E48645062BAE83A0501DF0480EF2461DB127
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e09c4d9e5871afce53ef5ca379a50beb4d5f6cfd4425800542e517ed32d85123
MD5 c2e035df98448c90c84a75e713e27f07
SHA1 c483f196cbed50e4c63fc8d096abdd5b86d05283
SHA512 59d6c7df39f4f3f70ca9ea4d8f6249013853fc320db9ea44a77796122b22d6482757a0af726a62fa1de45427ab09166301b5f49cd4b178d9143a7b8309b40790
TLSH
T13B51ADF3C7E8862EC91196F0AB146E1BDE2D0914832C3D5AC9E4AF5B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 96d5ef73c8c0f7bd560bc98e32bb5b34517257980fd832eb3f65f0f6551b3507
MD5 77498834c283ec36560355f04f846d78
SHA1 bb69bffdc1b6cb212440cc55b9b317c3b827b917
SHA512 27a013db4b31d0fd9989b6c71b53e27943e06c040bb642a3f7b4a1c1f45821d34b5e8a28a9de2451adc0051dbdf60a9afc071a4225b6807f21ee7ae50ff3cd48
SSDEEP 192:sxRWRoCs/fbsQduqZCiOzoA8p9a/g6+WNCwk/YnS3hhGbIgVSWOOJ:sxRWds/fbsQA8CizQ/5q/7RE/
TLSH
T18242D8166A68AD3B4CCBD21DBB657F53D2F91022A1D41F58E6FC9A1C04EB6CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6964b3db22b12a8164440a2dcbb73852aa649f78354d54ee60c70862f01149a9
MD5 3544ef89a5ccddded2b0da6480adae0e
SHA1 ab15ac0c93bb361b36c40ac26a2b61af3987122c
SHA512 2b883ae5075077700b5036b1b217fd19a661324430db0adf022cf7dce91af1b5cec1331927b67d66d86b70a53c45061e3e22711ea4fd235790a75b162c2ce70a
SSDEEP 192:sxR1RoCs/fbsoduqZCiOzoA8p9a/g6+WNCwk/YnS3hhGbIgDxSWOOJ:sxR1ds/fbsoA8CizQ/5q/7REX
TLSH
T12742D9166A68A93B4CC7D21DBB657F53D2F91032A1D41F58E6FC9A1C04EB6CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d49c043374f5698b99888174affac892b4782f457d6ee7ae22743c3898cde562
MD5 a5df9036bdeec1b2f794f8a03aa29d3c
SHA1 49bb53995a3a99b954c6581525827f95cbbe128a
SHA512 4c517c3d05b0133ec71b243d33646075a5ae16f8d1e0bb280e26c09232c68097fabdc8c41dcaeab264d43911116130196c9125e502f244cc1a3ca7af4a30e667
SSDEEP 192:sxR1RoCs/fbsodFqZCiOzoA8p9a/g6+WNCwk/YnS2hhGbIgDbSWOOJ:sxR1ds/fbsoj8CizQ/5q/78EB
TLSH
T11042E915A968AD3B5CC7D20DBB657F53E2F95032A0D51F08E6FC9A1C04EB6CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 91b5094465276af3feb6b57db7bda9cbb02401b34e4bada4d2986c61a11aa51e
MD5 cea82a9021e1d7a4fbaccf14a9df3991
SHA1 b39adee41170e07ed3671a846a8e9ecf81935db0
SHA512 f0d78de02a039e9a5c03e7155d738f7322ebd554dfc00f933ebef909d35607c911b3b55dbaac46892befa7df1d3174ff0cb668432af11aff3fa79b7db05b933e
SSDEEP 768:wb8dX77pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5Bmu469rohlrby:wb8dXNEfR6Wgouf6Mu1ja6BmV62Dny
TLSH
T1EED2DA7B744CCB7E4F800ADDEC19BE9F6DA802CB96D8C94047FA951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 86d63aa7f8272f216a1fe9b6d22bf45593dbb82b10f02f46149df404db8b7c29
MD5 c446e74c997099ad43dc16ae11991491
SHA1 acc1fd1a085cb7a7f3c6479befde80bb389c11d8
SHA512 5fd10e9fcec8cf9755b7d3b332533c35f488708e3154685505265421d1f9790044a12cd448622bafbda1dbb9e2152fad2f0b471411e1cb596c12d1337dbcefa4
SSDEEP 768:8R3L5DZIO0UiAZNzc4ReyIsPe1ojKgqmUkhOGE:8R37Ztc44bsW1fgRUk8GE
TLSH
T1C3F2BE70A825DD63ECFAA281F64636927EF41127C1D42E99D1EDAF0C09036EE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95d71fe4a59f991e153609ef83871fed53bb4ec9f87e96ea7726c59b3fea3bfb
MD5 867dc19ca152014350e3450d025d91fa
SHA1 4b988008aca226e890fc74f29f37caf0b52f7d39
SHA512 9836c64ff36bd10db2a76ad714c1c4d951af0d0561572ead6054b5f4030b3f0b8bb0e6599bcd3e6a2d5fb42ba3b862d6721e3dde4ca0b11addbc6833b63d5b7e
SSDEEP 768:6rv+4UNbds3+BDZIO0UgNzc4ReyIsXfeVH1S5D:6bsbS3Ltc44bsPEH1Y
TLSH
T13F03CE32A8789A77ACF66786B50776533EF8512782D81ED0C4DE2F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 580adfd525497198a6d329717850b504c8d6720c480268fda47d6e3b7e5547f5
MD5 9607fd73ffb8327354e2ebfeff833c5e
SHA1 31cca7ebffd1bb5bfbb70ae05d14f3a22e3af65b
SHA512 52b6f03c80d8737de63019f05d8e2a238afb50686e23b8dc92004d0578963cbc00a049694dd86cdbe601193da42e79d7522d7a36b89fa3da1451546e5f0e86cf
SSDEEP 768:iR3C5DZIO0UiAZNzc4ReyIsPe1ojKgqmUkhOGE:iR30Ztc44bsW1fgRUk8GE
TLSH
T180F2BE70A825DD63ACFAA281F64636927EF41137C1D42E99D1EDAF0C09036EE171F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f4a6427edd4da1e27c552f52d9525b9b182b8f46b66d28b442b161de3a0fd600
MD5 4d43d2673b51aaa90a0c709df7facd36
SHA1 b948086f4b26f0fb7b3077f71de9f5f1bb8d278f
SHA512 a4956a3c0e8e3a376d09567004215068ab9af8b269a588806247d03b99ebfee8a65e45541b631212b9d35a1e0f8d6253bc29c06ee1fe601a8aebd1b099491d1d
SSDEEP 768:Orv+4UNbd+3i5DZIO0UiANNzc4ReyIsPe1ojKgqmUkhOGK:ObsbE3UNtc44bsW1fgRUk8GK
TLSH
T1D713BE31A829DE63ACFA6281F1477A837EF4106781C42EA4D5D96F4C4A4B1DE271FA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 798e70b585f309191d7e476da77a2dcaf006230b353b2d355773a1478f6ba6d9
MD5 e44b8e24ca13b521ca36995d2430f4c2
SHA1 eb968105304189454517bd087f75da4221d51164
SHA512 deafaf138514c37ea19016c095c68deaa05a0d67c3ad1c595e6ccad43fd1573e18b54e68255b26054bc11b040ddb813052994ffa219480d5dc494b62edf725a4
SSDEEP 768:rs37IZQ5O0UiApNzc4ReyIsPe1ojKgqmUkhOGE:rs3Sptc44bsW1fgRUk8GE
TLSH
T1611307F498E79972E8AE5383A37D6D426DFCC023B1885994B7D95E0CCC421BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

2831bdf3-50fd-496b-98b3-ca34725406df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2831bdf3-50fd-496b-98b3-ca34725406df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5983cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5983cc.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

71890b54-1671-48d4-b66a-d709d51c054d.tmp

Path C:\Users\Admin\AppData\Local\Temp\71890b54-1671-48d4-b66a-d709d51c054d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1004_1607252465\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/508-613-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1120-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1436-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1456-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1716-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2000-633-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2432-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2848-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2884-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3564-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3864-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-592-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5300-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5876-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6084-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download