6c4f8ce65c708c569521501c21148304dfaf93074f33c7534d40f6f761f98341

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260804-wfbk7awfla
SHA256 6c4f8ce65c708c569521501c21148304dfaf93074f33c7534d40f6f761f98341
MD5 de735b1491238f5c75536492853fafc9
SHA1 19518956419859dc8a0bc0a1aaa8e6b6462d97e8
SHA512 ef25700cf0e3bab3f7e63cc41dabbe48103f5911f817dda0d5cb7ee2f1c871383f1b4ad6ee5910673b01bc384e329e8cc152d3847eeaaeb670190b19143bf54c
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1A934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1212	CP.exe
5040	uojhczupjh.exe
3852	CP.exe
1696	CP.exe
2600	i_uojhczupjh.exe
5684	ebwuomgeyw.sys
1572	CP.exe
5184	romhbzwrpj.exe
988	CP.exe
4952	CP.exe
2240	i_romhbzwrpj.exe
5424	gbztrojgbz.sys
4276	CP.exe
5160	ztoljdbwto.exe
624	CP.exe
5028	CP.exe
4780	i_ztoljdbwto.exe
5796	tqljgbytqo.sys
1196	CP.exe
3820	wqolgdbytq.exe
4380	CP.exe
5688	CP.exe
3192	i_wqolgdbytq.exe
2072	gdywqoigay.sys
3188	CP.exe
2496	qoidaytnlf.exe
3184	CP.exe
2680	CP.exe
2444	i_qoidaytnlf.exe
1188	nigaysqnli.sys
3480	CP.exe
3008	ifaxvpnlid.exe
5840	CP.exe
2464	CP.exe
5052	i_ifaxvpnlid.exe
1540	zxvpnhfaxs.sys
1248	CP.exe
5864	ausnkfdxvp.exe
2020	CP.exe
1824	CP.exe
2324	i_ausnkfdxvp.exe
4416	xusmkhczur.sys
396	CP.exe
3428	xuspkhczxu.exe
4696	CP.exe
3476	CP.exe
3488	i_xuspkhczxu.exe
6012	hezwusmkec.sys
1200	CP.exe
456	omhezxrpjh.exe
1424	CP.exe
4524	CP.exe
3396	i_omhezxrpjh.exe
5740	xrpjhbzwro.sys
4904	CP.exe
4224	rojhbztrmj.exe
5584	CP.exe
2988	CP.exe
5684	i_rojhbztrmj.exe
4760	ljhbztrljd.sys
3384	CP.exe
5180	ljhbztrljd.exe
712	CP.exe
2076	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_1891659143\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_1964810430\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_826003800\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_1048859420\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_826003800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_1964810430\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5300_820909132\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebvtqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztoljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoidaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkicaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebvtqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigayoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigayoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojhczupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojhczupjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romhbzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoidaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspkhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romhbzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztoljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspkhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5972	ipconfig.exe
4320	ipconfig.exe
5972	ipconfig.exe
3984	ipconfig.exe
2340	ipconfig.exe
5628	ipconfig.exe
5032	ipconfig.exe
3452	ipconfig.exe
5768	ipconfig.exe
5940	ipconfig.exe
3016	ipconfig.exe
4160	ipconfig.exe
3752	ipconfig.exe
1276	ipconfig.exe
5740	ipconfig.exe
4448	ipconfig.exe
792	ipconfig.exe
3636	ipconfig.exe
4616	ipconfig.exe
1240	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303394938190565"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{0C662466-8101-4E5D-9163-9ABB185FF754}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2548	msedge.exe
2548	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe
5300	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	i_uojhczupjh.exe
Token: SeDebugPrivilege	2240	i_romhbzwrpj.exe
Token: SeDebugPrivilege	4780	i_ztoljdbwto.exe
Token: SeDebugPrivilege	3192	i_wqolgdbytq.exe
Token: SeDebugPrivilege	2444	i_qoidaytnlf.exe
Token: SeDebugPrivilege	5052	i_ifaxvpnlid.exe
Token: SeDebugPrivilege	2324	i_ausnkfdxvp.exe
Token: SeDebugPrivilege	3488	i_xuspkhczxu.exe
Token: SeDebugPrivilege	3396	i_omhezxrpjh.exe
Token: SeDebugPrivilege	5684	i_rojhbztrmj.exe
Token: SeDebugPrivilege	2480	i_ljhbztrljd.exe
Token: SeDebugPrivilege	4636	i_olgdywqoig.exe
Token: SeDebugPrivilege	4900	i_oigayoigay.exe
Token: SeDebugPrivilege	1088	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	5572	i_pnkicaxsqk.exe
Token: SeDebugPrivilege	4972	i_nhfzxrpkhc.exe
Token: SeDebugPrivilege	5788	i_mkecxupmke.exe
Token: SeDebugPrivilege	788	i_mjhbzurmke.exe
Token: SeDebugPrivilege	5692	i_ojhbztomje.exe
Token: SeDebugPrivilege	1124	i_omgebvtqol.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 3120	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3120 wrote to memory of 5300	3120	iexplore.exe	90
PID 5300 wrote to memory of 3432	5300	msedge.exe	91
PID 5300 wrote to memory of 5620	5300	msedge.exe	92
PID 5300 wrote to memory of 1392	5300	msedge.exe	93
PID 5300 wrote to memory of 5620	5300	msedge.exe	92
PID 5300 wrote to memory of 5620	5300	msedge.exe	92
PID 5300 wrote to memory of 4928	5300	msedge.exe	94
PID 5300 wrote to memory of 4928	5300	msedge.exe	94
PID 5300 wrote to memory of 292	5300	msedge.exe	96
PID 5300 wrote to memory of 292	5300	msedge.exe	96
PID 5300 wrote to memory of 292	5300	msedge.exe	96
PID 5300 wrote to memory of 2616	5300	msedge.exe	97
PID 5300 wrote to memory of 2616	5300	msedge.exe	97
PID 5300 wrote to memory of 2616	5300	msedge.exe	97
PID 5300 wrote to memory of 3308	5300	msedge.exe	98
PID 5300 wrote to memory of 4616	5300	msedge.exe	99
PID 5300 wrote to memory of 3308	5300	msedge.exe	98
PID 5300 wrote to memory of 3308	5300	msedge.exe	98
PID 5300 wrote to memory of 4616	5300	msedge.exe	99
PID 5300 wrote to memory of 4616	5300	msedge.exe	99
PID 5300 wrote to memory of 1744	5300	msedge.exe	100
PID 5300 wrote to memory of 1744	5300	msedge.exe	100
PID 4512 wrote to memory of 1212	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5040 wrote to memory of 3852	5040	uojhczupjh.exe	105
PID 5300 wrote to memory of 1332	5300	msedge.exe	108
PID 5300 wrote to memory of 6008	5300	msedge.exe	109
PID 5300 wrote to memory of 1332	5300	msedge.exe	108
PID 5300 wrote to memory of 6008	5300	msedge.exe	109
PID 5300 wrote to memory of 5892	5300	msedge.exe	111
PID 5300 wrote to memory of 2040	5300	msedge.exe	112
PID 5300 wrote to memory of 2040	5300	msedge.exe	112
PID 5300 wrote to memory of 2620	5300	msedge.exe	113
PID 5300 wrote to memory of 2620	5300	msedge.exe	113
PID 5300 wrote to memory of 2120	5300	msedge.exe	116
PID 5300 wrote to memory of 2120	5300	msedge.exe	116
PID 5300 wrote to memory of 2184	5300	msedge.exe	117
PID 5300 wrote to memory of 2184	5300	msedge.exe	117
PID 4512 wrote to memory of 1696	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4512 wrote to memory of 1572	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 5184 wrote to memory of 988	5184	romhbzwrpj.exe	124
PID 4512 wrote to memory of 4952	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4512 wrote to memory of 4276	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5160 wrote to memory of 624	5160	ztoljdbwto.exe	133
PID 4512 wrote to memory of 5028	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4512 wrote to memory of 1196	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3820 wrote to memory of 4380	3820	wqolgdbytq.exe	142
PID 4512 wrote to memory of 5688	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5300 wrote to memory of 780	5300	msedge.exe	148
PID 5300 wrote to memory of 4800	5300	msedge.exe	149
PID 5300 wrote to memory of 3976	5300	msedge.exe	150
PID 4512 wrote to memory of 3188	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 2496 wrote to memory of 3184	2496	qoidaytnlf.exe	155
PID 4512 wrote to memory of 2680	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4512 wrote to memory of 3480	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 3008 wrote to memory of 5840	3008	ifaxvpnlid.exe	164
PID 4512 wrote to memory of 2464	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4512 wrote to memory of 1248	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 5864 wrote to memory of 2020	5864	ausnkfdxvp.exe	173
PID 4512 wrote to memory of 1824	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4512 wrote to memory of 396	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 3428 wrote to memory of 4696	3428	xuspkhczxu.exe	182
PID 4512 wrote to memory of 3476	4512	2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5300 wrote to memory of 1364	5300	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_de735b1491238f5c75536492853fafc9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9a586c188,0x7ff9a586c194,0x7ff9a586c1a0
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,8590950802634793782,3939656344064474613,262144 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,12832117867206648634,3933411663421078315,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
      4⤵
      System Time Discovery
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14890931702977454776,6381255114774535886,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,11197893936657196640,16096748675856700850,2097152 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,8287092998549007366,13988533711949412709,2097152 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,11858739536308873593,3331374830474883949,2097152 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,9593095972345574285,9574097056699274207,2097152 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:9
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,11674066299327680400,17086560015606956915,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3153069407600966882,17847217817983801354,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,13981259209210708372,3112723641449587619,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12455018473019222264,11983293652099538977,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,12455018473019222264,11983293652099538977,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17999615565800858667,480305159127374930,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,9917924448633078887,5061007086527140574,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,8854119869775457826,17189108857268043568,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,13560660618188636204,8020032629347486950,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:2184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,11215284242100406658,15982359550228024847,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,15650760157674834790,2863319984073906766,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,10113784144687941405,8145581614457090569,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,4217651873035449691,14865160261154940387,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,3430278775687728841,11984245086563035441,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,17912347956545260528,18213780251334151544,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,3512664105766220734,14965906226143611396,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3440,i,12861977900240980858,8570794982213079032,262144 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,3225019725515715964,12662503588275356450,524288 --field-trial-handle=2284,i,16267820812389662255,15675639448079853682,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uojhczupjh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1212
- - C:\Temp\uojhczupjh.exe
    C:\Temp\uojhczupjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uojhczupjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1696
- - C:\Temp\i_uojhczupjh.exe
    C:\Temp\i_uojhczupjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romhbzwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1572
- - C:\Temp\romhbzwrpj.exe
    C:\Temp\romhbzwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romhbzwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Temp\i_romhbzwrpj.exe
    C:\Temp\i_romhbzwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztoljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Temp\ztoljdbwto.exe
    C:\Temp\ztoljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztoljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\i_ztoljdbwto.exe
    C:\Temp\i_ztoljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgdbytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1196
- - C:\Temp\wqolgdbytq.exe
    C:\Temp\wqolgdbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgdbytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5688
- - C:\Temp\i_wqolgdbytq.exe
    C:\Temp\i_wqolgdbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoidaytnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Temp\qoidaytnlf.exe
    C:\Temp\qoidaytnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoidaytnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\i_qoidaytnlf.exe
    C:\Temp\i_qoidaytnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvpnlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Temp\ifaxvpnlid.exe
    C:\Temp\ifaxvpnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvpnlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2464
- - C:\Temp\i_ifaxvpnlid.exe
    C:\Temp\i_ifaxvpnlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1248
- - C:\Temp\ausnkfdxvp.exe
    C:\Temp\ausnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_ausnkfdxvp.exe
    C:\Temp\i_ausnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xuspkhczxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:396
- - C:\Temp\xuspkhczxu.exe
    C:\Temp\xuspkhczxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xuspkhczxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\i_xuspkhczxu.exe
    C:\Temp\i_xuspkhczxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1200
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4524
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4904
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2988
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljhbztrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Temp\ljhbztrljd.exe
    C:\Temp\ljhbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljhbztrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_ljhbztrljd.exe
    C:\Temp\i_ljhbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdywqoig.exe ups_run
  2⤵
  PID:2836
- - C:\Temp\olgdywqoig.exe
    C:\Temp\olgdywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdywqoig.exe ups_ins
  2⤵
  PID:3256
- - C:\Temp\i_olgdywqoig.exe
    C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigayoigay.exe ups_run
  2⤵
  PID:3976
- - C:\Temp\oigayoigay.exe
    C:\Temp\oigayoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigayoigay.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_oigayoigay.exe
    C:\Temp\i_oigayoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run
  2⤵
  PID:1480
- - C:\Temp\nlfdxvqnig.exe
    C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_nlfdxvqnig.exe
    C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnkicaxsqk.exe ups_run
  2⤵
  PID:4404
- - C:\Temp\pnkicaxsqk.exe
    C:\Temp\pnkicaxsqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnkicaxsqk.exe ups_ins
  2⤵
  PID:2132
- - C:\Temp\i_pnkicaxsqk.exe
    C:\Temp\i_pnkicaxsqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:4800
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxrpkhc.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_nhfzxrpkhc.exe
    C:\Temp\i_nhfzxrpkhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupmke.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\mkecxupmke.exe
    C:\Temp\mkecxupmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupmke.exe ups_ins
  2⤵
  PID:5844
- - C:\Temp\i_mkecxupmke.exe
    C:\Temp\i_mkecxupmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmke.exe ups_run
  2⤵
  PID:5500
- - C:\Temp\mjhbzurmke.exe
    C:\Temp\mjhbzurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmke.exe ups_ins
  2⤵
  PID:52
- - C:\Temp\i_mjhbzurmke.exe
    C:\Temp\i_mjhbzurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztomje.exe ups_run
  2⤵
  PID:4320
- - C:\Temp\ojhbztomje.exe
    C:\Temp\ojhbztomje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztomje.exe ups_ins
  2⤵
  PID:2600
- - C:\Temp\i_ojhbztomje.exe
    C:\Temp\i_ojhbztomje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgebvtqol.exe ups_run
  2⤵
  PID:5576
- - C:\Temp\omgebvtqol.exe
    C:\Temp\omgebvtqol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgebvtqol.exe ups_ins
  2⤵
  PID:2016
- - C:\Temp\i_omgebvtqol.exe
    C:\Temp\i_omgebvtqol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3828

C:\Temp\ebwuomgeyw.sys
C:\Temp\ebwuomgeyw.sys
1⤵
- Executes dropped EXE
PID:5684

C:\Temp\gbztrojgbz.sys
C:\Temp\gbztrojgbz.sys
1⤵
- Executes dropped EXE
PID:5424

C:\Temp\tqljgbytqo.sys
C:\Temp\tqljgbytqo.sys
1⤵
- Executes dropped EXE
PID:5796

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
- Executes dropped EXE
PID:2072

C:\Temp\nigaysqnli.sys
C:\Temp\nigaysqnli.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\zxvpnhfaxs.sys
C:\Temp\zxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:1540

C:\Temp\xusmkhczur.sys
C:\Temp\xusmkhczur.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\hezwusmkec.sys
C:\Temp\hezwusmkec.sys
1⤵
- Executes dropped EXE
PID:6012

C:\Temp\xrpjhbzwro.sys
C:\Temp\xrpjhbzwro.sys
1⤵
- Executes dropped EXE
PID:5740

C:\Temp\ljhbztrljd.sys
C:\Temp\ljhbztrljd.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\wtomywqoig.sys
C:\Temp\wtomywqoig.sys
1⤵
PID:1040

C:\Temp\olgdbvtqli.sys
C:\Temp\olgdbvtqli.sys
1⤵
PID:5772

C:\Temp\qnifdxvqni.sys
C:\Temp\qnifdxvqni.sys
1⤵
PID:3488

C:\Temp\pnifaysqki.sys
C:\Temp\pnifaysqki.sys
1⤵
PID:1844

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
PID:3940

C:\Temp\urpkhcausm.sys
C:\Temp\urpkhcausm.sys
1⤵
PID:5940

C:\Temp\mkeczurpjh.sys
C:\Temp\mkeczurpjh.sys
1⤵
PID:5516

C:\Temp\mjebztrpjh.sys
C:\Temp\mjebztrpjh.sys
1⤵
PID:3636

C:\Temp\wrojhezwqo.sys
C:\Temp\wrojhezwqo.sys
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgeyw.sys

Path C:\Temp\ebwuomgeyw.sys
Size 141KB
SHA256 74358894753dfb2b06f429d5edc0bf35ffe6033ba9ad2cfa1da79839348146e7
MD5 7d6b18883e4d7b6586b3eb2a4533c63e
SHA1 339a94ea96ab6ca296eecff36b7d3fa562ca5fed
SHA512 ee653eafb94d36e1a3cf542d050bfc66318a75d17ef4cf7899f0d28d40575cdb373f63fe632ea48597633f8e2ca0e17b6a01ecdeb8fb5ca995251bcef9611277
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrojgbz.sys

Path C:\Temp\gbztrojgbz.sys
Size 141KB
SHA256 313a4b7b5ee517fdf74879cb8b2295c7bcf35d463906dcde593d3cbc8d55270f
MD5 dcd3e7bc75c8327974f41502486a3a16
SHA1 b77322400d4554979783ca8e6ae5997dbd73e679
SHA512 0f82f4920723d5b61d1946bfaac5d426d401ffe76ffc654abae1743ac661eadb4e6587476ef2269a5396abdc5d5b61089305a75eebc5e3c64f2b7ef768f715a7
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.sys

Path C:\Temp\gdywqoigay.sys
Size 141KB
SHA256 34256d1952a3e8ad2c044e8ce3d1acb9f6b16a1bfc4799bc7304603d07e0d23f
MD5 8143f3408e19494d9f96e2edc144e8a0
SHA1 ada693ffd4736616f7170a1f62e0b83d68bad857
SHA512 0aee09e4cc8e98c2d81e63b6cf529a9d9982ddc777098e8e9d96530ac42f72cac0c98f15b2bb54ce0317b10cd971d0d249ac86984616753945741c2f8d0c29d9
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxvpnlid.exe

Path C:\Temp\i_ifaxvpnlid.exe
Size 226KB
SHA256 18ad9d45e4f6a74b929364ef1a0ee75451eb5454e56cb07aa3eb63eed41bc899
MD5 4fbd18161c895429390f3a3a84f23de0
SHA1 e72bfcc16fd1d3d61ea92b9ce91dd61ba205a797
SHA512 a388495776ae02f950916e7e5a940b5d6c1cd682d60a8f8ca0d3fe356ed955eb2e33855d4244e1e109574214a8745b73ab505e8c80a5076d769ce0f9efe59a27
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoidaytnlf.exe

Path C:\Temp\i_qoidaytnlf.exe
Size 226KB
SHA256 c9a09b51549dcc5cd0bc837854a7cd3757db330f340209c6fac3ccc9ee30efc3
MD5 b8b17baa07f4e534dd03e0ea4d19b982
SHA1 4584b9305fb0bc8a362202c56187733818489699
SHA512 d859a9a1b514d062c0a57cbc2d55791657f4168ae39b3a6b223b8917efaab56afca33f0ea3e242768bd678974f9e5794bd36b72e8c6224a0b7db7586e75f31fa
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T15134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romhbzwrpj.exe

Path C:\Temp\i_romhbzwrpj.exe
Size 226KB
SHA256 ac596332d71383bf0d3ab39717f69878d354b61ba98616e54acfff18bdb9c52e
MD5 7826b65d64d4530661e24b644cfc5f7b
SHA1 798577aee2c91afb5171aa030d8e292c3cf1e183
SHA512 dfaf383cad002ec784067c4fcf72e8bdb23a7149fe089ed7878d2e5ce6d07dd987c077690a5bbf6b24c8e0fff4483bda5a44aacce5137cf541a07ca2f79c5ff8
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1F634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uojhczupjh.exe

Path C:\Temp\i_uojhczupjh.exe
Size 226KB
SHA256 7bf9353e0450da7431884a5cdd3d64fcfe9fce81d561a460ff5619390fbf2e70
MD5 db83694dc7a3c66fd30c7c82343073cf
SHA1 f22ce075ce7cd700723cafeeeba8ae6ccb0be083
SHA512 2301497150844551ab4c67b69aa0366a636375be9a56894f7b51ed91d012f1559ced7a0c545c7e327ea56df97d86546b52ff8cb35b6af14ba97dbad98d7071e7
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqolgdbytq.exe

Path C:\Temp\i_wqolgdbytq.exe
Size 226KB
SHA256 55a9c33fff69b313ed86e052f4b7200072bc250a6addefcfeb8f3455686e306c
MD5 c49744f315167530744458c8bfbbf7a9
SHA1 08c53c8c6e2989577c0edfb1d6e2c04b4331a4e1
SHA512 93e6bc062d21e4432af6c11c1097df1f997315e0d6e8167142fe3547c8f86cb1d2d8ba9d40a5dd285360d2df3070b3e0fe0b18288d5359d0748327ebcb2114b4
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztoljdbwto.exe

Path C:\Temp\i_ztoljdbwto.exe
Size 226KB
SHA256 191e1c8bd81085495c2f4c3a553f64de4e1679939b1c0a11e1102a070a976c8f
MD5 f869ba2614d315f5a6ae9cb2d22a9484
SHA1 8db6451c95618bc9ff5343b55f5af9aa7a9119c6
SHA512 c1bd94fdd594ce60f2ea9edc5fdfcd788527be85b7394804ec057233b0fdeabce61e176b12dd5640a0ef09e12565dd822b9a588df6bb07e324d0097edff888fd
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1DD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvpnlid.exe

Path C:\Temp\ifaxvpnlid.exe
Size 226KB
SHA256 316eff4bfab9e7a388b3bb0590533c62cd8b9b1c0316933ad5f698d44e420edd
MD5 1bb949f41b78a496cde9d538744bbb57
SHA1 c970addcb2baed7215e96fa37b1929d5ac5680a7
SHA512 0e8561bfd56e9b612550c326d49bc9dee84299119cedffb5ad653167be67edc18fb597013c8e3cbca657561e28bba1688ca01c0eb808f3814e4b21bb0d29e091
SSDEEP 3072:VGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:0XY4LK+a3lLNngoqRttA7
TLSH
T19D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqnli.sys

Path C:\Temp\nigaysqnli.sys
Size 141KB
SHA256 7b67578c1f460a801e16ae2e6d1ecb97e325b74fdbeb55cacd29c78b1ef4c903
MD5 a3b6c6ebecfaab2d636035993374c932
SHA1 9f2966f03712ca900bb07aaa0f1316c535556fa2
SHA512 568ac4a51edf49bbcf26675234d79e392bda19104a47fa75af515c14eafa0bd5e78a0955462d97f4cc40c4fae17cb83a645596b98193aef87807f755a4537133
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoidaytnlf.exe

Path C:\Temp\qoidaytnlf.exe
Size 226KB
SHA256 e258e3c730cf04bcc0f0b11e91cc77a351196da734fe2e51941127713775eedb
MD5 cfb566f3b7e855f4a8b7bd8625f085ee
SHA1 fce21805aee5d52416b53b314c2b14046ad2eef1
SHA512 5cb6760103202bdc80ab5eca0c4285156a43a28593d7c7a030f0270a9278bf890ae4cbac55faa1a91432b6cf5abd8d60c74089c664ddab20673c2a2e83e1cefc
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T13E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romhbzwrpj.exe

Path C:\Temp\romhbzwrpj.exe
Size 226KB
SHA256 19831d0158f0d308abb189318d11305abdeb35c0ff9bac4fb242372df9203243
MD5 bd0ecf493aacf6e3efcf0ff2412a4736
SHA1 ac1b4c5a07201a6b17a62079c4807a4e8a03e1c9
SHA512 3342cadcacfe09b05dea553bd9d96c3fc2f15f236b89200606853bd0a59a9841607b1ea1cb5c1cb4fc2927bd281a23d25bf5b67d2f0395f7fd77448ee448eefc
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T18C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljgbytqo.sys

Path C:\Temp\tqljgbytqo.sys
Size 141KB
SHA256 28e762848e4e4c54a255b657ed1e737a96c22fb7eda9bbe6f27ebf62bf00097e
MD5 b4356b540337cfb46919e6da95a5d223
SHA1 49c2b7c135edaa27d1b843e27cc1b4c32f797e65
SHA512 7bebc9fc341ef242096a7efdd04c77ef4cc15ab1b623b130db6a849f3a351d009e358dd4822b9321264225f52342964e4bb18ab726d538efb9f5265087ca39a1
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BFE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uojhczupjh.exe

Path C:\Temp\uojhczupjh.exe
Size 226KB
SHA256 fed4aad4dca97cd2bf4b036d0f10809162580bac3409206a2d212664be3fc52a
MD5 32b4264c95aa62feb3ce3d6586c755ca
SHA1 2abd3b2431ddccd094192538cc9f61dbc90ca9a8
SHA512 a808cbf781532b935b9027c49d65756857d8f79f4003a7d7779fa9933809d5905a25a7f4ccd144df5d6583aa2c156ae6bffe2a009f0bbf020c01c88791810fa6
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1EF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqolgdbytq.exe

Path C:\Temp\wqolgdbytq.exe
Size 226KB
SHA256 985e5cb3b2671fc965f3a6695c69ed51869813193ca833ea4ab2343dcd056970
MD5 626f36192d47d87f81d2e36de33bf93d
SHA1 d0bd58ddb60825be7323799fc9d608e3b5426c6e
SHA512 a22c7ee04d7ecf0a847504b55f01bfe41a5e8e24d63421dd0d683ee0a996ee4aba9de8fe968b79bef4e3abbb7f5680d1503265ce5c7417cae7c4b7fb24f2fe65
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T1D134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztoljdbwto.exe

Path C:\Temp\ztoljdbwto.exe
Size 226KB
SHA256 ae6bd5ba8962d5b768a2ae9efb2e4415ede2f2df0b6f2577d46337b549a26eb1
MD5 74e4a9644cbc7b31e1164a2262f4fc81
SHA1 d29812bb74786833e8fa20d11592a7f9079672ff
SHA512 07f50ecf55b17fbd7f13cdac3f2dd507e783b500ec75b8ede4573cad7a851675364bc70e6b139ab503339953fca7e3fdc7de36bf6769716fec6e3d0dca95393f
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

167880bc-894e-47dc-82a9-5f26ce0160bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\167880bc-894e-47dc-82a9-5f26ce0160bf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8a959647fdce84dfc1e69d1b3eca47c9a088fa08066c6b69afd0926651a89288
MD5 d74e671b92b66f4fc3b736585e656218
SHA1 94341de16fda818fea69019e3582e48f899e40b8
SHA512 b932910cecf31f4f50246bc9dc8b671fef252642ca8d81bdc3f5e2cceeafbb539f6b34a2e7e4b808c6477019174d2b2750230af0b988937f71906b1a49b3c511
TLSH
T152518202B321D7E3D72F88FD60E2D448F6F144540A272E985265AE7F65A6F0678F2273
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59792e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59792e.TMP
Size 3KB
SHA256 368b99e7b9ccac88f2e9e27256a01964c07450548766e8c498d998e2b3e8d266
MD5 34e57ffe2e47c2cfa35b6c7e29d0764f
SHA1 6e22777ae12fa38e3b73659dfb53092d51642b5f
SHA512 b156383f4a41ecceca2560b480e2939ad017ba5d63b975c5101e5117d851c860f061705c25ce8575983eefcfacb6165ba228417d36a03dd8eb546411816d3d4a
TLSH
T1CA519202B321D7E3D72F88FD60E2D448F2F144540A272E984265AE7F64A6F0678F2273
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4640a21ff4220d333186f913472d8fae0ddcff03f0659a9377ebb40ee7c6cc5a
MD5 5da2188e315cf08ab903d941247536f1
SHA1 11d47d87f8fcf20b7905fb691972c857ddbc7992
SHA512 e394c469ffc6fb4164f068198c1bbdcdb0bc278388b66401f214ba5763f5cc8215b7953e17e86763375a90e400ee8254fd01a5e948fdd867e78fa3c8b1be7097
TLSH
T1EA51BFF3C6E8C66D891156F0AB187E2BDE2D0914432C3D5AC8E4EF5BA3E3471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ee3eb44b7e9d00d624aed3351e07ad9afd47878f549757fe29b7fec784a437e9
MD5 19569e085502122d7096385833a9d5e7
SHA1 beb74194e5906fd027ae3436c0852959f9fa3d62
SHA512 108703ee017fbba1b917939d7968fd3560e80480837fd3b25842937feba0a96814fde6e95bbbd7aca2c03e7b10bca0f82b9496d2a02e0dcdfb4001f31bb028ee
SSDEEP 192:sxRBRWyM/jK1Ml8wCM/fasC4cZxdPyzoA8p9gB/g6+WNCgTkd/YleGibGkIgVBZD:sxRBk8M/fasC4ixZ/E/5k/n9t
TLSH
T1FA62F805AA249D77CCDBD20DFA557F93D6F91573A1941E48AAFC8A0C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 55a0ceb7b3c03f8810c76360e7e1f231a275395487b8bda6e03878a039acb7a0
MD5 2ea12488b5d0eb19ec0fbad66aa76eb5
SHA1 974e5c3b958c0b645ec4c3089595e7f9b600aa25
SHA512 97a80bee7f56b890660bfbf821b797cbff2c75f8e613508707b05997a85918fefeec571d55d237088d67ecec9356e8e81d4874109c2d4f92fbcd5625441325d1
SSDEEP 192:sxRiRWyM/jK1Ml8UQvCM/fasHUcZxdPyzoA8prgB/g6+WNCgTkd/YleCibGkIgDJ:sxRikq6M/fasHUixZ/m/5k/L9l
TLSH
T13662E815AA245D77CCDBD20DFA917F93D6F91573A1941E48AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cbebf9599fd24f33a5f0b200df11963c8034f5c5ee044b79609d7f8955030c59
MD5 45e9a477181a93ec9adbe012eac20975
SHA1 affa1b6362f75461a2bc88033e91818c4dd46702
SHA512 583ffe914518ba02f1c570decfcbf1f4af587c9e4d728108e35b6c8ea6b3dbe5387550b6866406cb63698dd757e6e3a2d6cd0486c4103aa1fbbd805ba918a9f2
SSDEEP 192:sxRiRWyM/jK1Ml8wCM/fasH4cZxdPyzoA8p9gB/g6+WNCgTkd/YleGibGkIgDLBZ:sxRik8M/fasH4ixZ/E/5k/n9f
TLSH
T15262F805AA249D778CDBD20DFA517F93D6F91573A1901E48AAFC9A0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e2ebee4f9116d6c9851566e9b25761075dae3492304d98b301875777b131f2d0
MD5 7b6da0e6efbe3a97b5b49ac92fa31681
SHA1 89823e00129ad83c756c10a99387b5b0a9df590a
SHA512 18be20b4ac4d193b85970a4a24e73aaed12a23237c5e7677260da40c8d246291e3de58fd5f399e7e3864ece6438480207f85409743c7088746368bd8efeb7d6c
SSDEEP 768:dhRAdg7pLuLfmxWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDAV13fzroPQHX:dhRAdsEfmxWgg+fAJu1jaEAVlfAIHX
TLSH
T1F5E2FD3B680CCB7E4F804A9CEC29BE9A6DE802CF56D8C95447EA840C03C67EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 667e74abf3423ec784623eccd28ac27493a25c2921fa77c69e279aadf26157f7
MD5 1c7b32e09c9e8fea0aed9b650a2eb05b
SHA1 df1424ce32ec7760af204966c576f796383f8247
SHA512 764cb4a1b7c4e4bb38248c5774185111ff113d00ae67e3d87cedfacc0a5191108a5c8a8685e045c1183eb2968150bcfb09704dcbbe36995d91e397e665e51813
SSDEEP 96:KRxOf7JrvbWf8qgjbK4igtbcx50HPoHWLa2Q44eWIdFgWeK4rgEec+W10mPWPLPP:CxOf7Jrv6f8bjhigtIx50HPoHWLa2Q47
TLSH
T13F91F610323A07C0397E6E1AC1F89C6B92C67CA13598A42F7BE845655F67E039CFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

936986ed-0213-4be0-8977-fbfc646318f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\936986ed-0213-4be0-8977-fbfc646318f3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1f819a649ca2a8707c4635d7a769a7a7e2c8cf2bae0d2dead75477e27c5b8ebd
MD5 ee6bc2b2f7326546fef3c84aa0d326f5
SHA1 660464cf15b0dcdb5c594f8aa5fbdd3586508928
SHA512 fb7226c97da45c0e39456ab7e9fd5e979c4064de18b87b52f8e74222f0aba767b2ec07ec8c3d5e21c89d3215722824274490cfb36c78a22db75dcd1961b5476d
SSDEEP 768:nU3RVFiJ1E6bNHXmTWTbc+HjojKgqmU4e:nU3xsE6deWn1DfgRU4e
TLSH
T134F2CE709CAAAA77EDF69FC5B54A7B06AEF81063C1D41998D9DC7B0D018354C031B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a54f99f01c519ee2b093b1c37ea7fee9c9bd5d983e0c768e8d8e95b54cab89b1
MD5 cea85d839b7459b459eb648dced1eb10
SHA1 15267ae6fc67c86f62bc51d50be1567ea974155f
SHA512 755c04bbcffded1c96b4408142b3a7bafcc9b675675dd103ff842c4c8e6679a3f0d2df24dbd86426c91db74da857716a044e28c2d7d073f6a8cc1c6381537698
SSDEEP 768:nrv+4UNbd73KVFiJ1E6ENHXmTWTbc+HjojKgqmU4i8:nbsbh3asE6ceWn1DfgRU4i8
TLSH
T16013CF3098ADAA77DEF69FD4B04B7A477FF8105385D40A98DDD82B8D028B48D131B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4bc01eeaa4856dbdbbebe6675046aa24eb95eb0d54fcfd881282dc12c1ccb09e
MD5 c1512bd5d0a9354d7f419d6878135e80
SHA1 f16fe49cb9b3458f6db40baefa209ecefd16784c
SHA512 ebf9dbf84ca803dff8fc36ae55d3733ab90fd85ddf19f22692ad446224b5e7e61f265839562f7d980c181191eded7f51a2acaf426fa8420e7e7cfa0423a00db6
SSDEEP 768:arv+4UNbdM3nJfiJ1E6BNHXmTWTbc+/GeVH1SvyZ:absb+3BsE63eWn1OEH1dZ
TLSH
T18003CF319CFD9A37ADE69A88708BB6577EF811B385C406C4C8D96B4D028748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 039ef0b3b68d08304a1f144c8212aeaf0b7b52eed5a214ff22dc2fa8942879d5
MD5 1d26ee3c2b683ae9081ce9a66e9c9791
SHA1 8fa8248abe3998f6762d4180bcd005ebe3022c0b
SHA512 71f6fffa27a982783e452812a639c222da62e8a22ded4752c57755c1a682c2c815424bf30bcd5c84b28ea8158e4109e2fa19530c602bd55b0ff962f8933c5767
SSDEEP 768:9U3KVFiJ1E6bNHXmTWTbc+HjojKgqmU4e:9U32sE6deWn1DfgRU4e
TLSH
T198F2CE709CAAAA77EEF69F85A54A7B46AEF81063C1D41998D9DC7B0D018354C031B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

0f38eacd-117b-4863-a7e7-e045455635fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0f38eacd-117b-4863-a7e7-e045455635fa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59501a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59501a.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

f710a387-6657-49c3-8c6e-d259465ad162.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f710a387-6657-49c3-8c6e-d259465ad162.tmp
Size 43KB
SHA256 a7939084704318da8afbd71ccc3ed8e5f0eb8ed638a7ab41e12194bfb6e34354
MD5 f22a3f84c06480aefd66b28b467a85ab
SHA1 a255c2070a03e4937ec0a2423622b62b31c27faf
SHA512 91157674bf70745925bafcec2cff93a2db290543c7ab655bea922487bb000d58661fd8608939fcd4d4fd9614071d76a0a29567a975bd1e0f5084bdbe3542c95a
SSDEEP 768:RFQG3MwgUg0c1E6rNHXmTWTbc+HjojKgqmU4e:gG3iE6teWn1DfgRU4e
TLSH
T1361317F188E79677E9AE4B83677D6E069EBCC053B1985494BBC86D4CCC8207FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b05401f-1e6e-4286-93d0-69d6edbfa7cf.tmp

Path C:\Users\Admin\AppData\Local\Temp\2b05401f-1e6e-4286-93d0-69d6edbfa7cf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5300_432379490\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1040-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1188-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1540-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1844-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-536-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3488-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-711-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3940-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-728-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5424-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5516-699-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5684-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-568-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5772-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5940-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6012-591-0x0000000000010000-0x0000000000083000-memory.dmp

Download