e5126f25916882a94d5b3c1fd853028b2f6fe33369bff8a5147d0c734d2622ee

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260805-l15dwsvcmf
SHA256 e5126f25916882a94d5b3c1fd853028b2f6fe33369bff8a5147d0c734d2622ee
MD5 88440296b84b406c0e81d3e04fa411e2
SHA1 d32250e8b98e6591560a1b0854c7c3ed5539c332
SHA512 52eb0eb70f36622d2b73fc1d5ffa948154318d88472221f897517f7567e44009c1fd3c6da215242dcaf2d00090c9b33e6afbbb304a6ef3bc063ba72649f29dd3
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1F834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1968	CP.exe
1504	rpjhcwupmh.exe
7164	CP.exe
4152	CP.exe
6668	i_rpjhcwupmh.exe
4352	ezxrpjhbzu.sys
6552	CP.exe
6532	omgezwrpjg.exe
3608	CP.exe
1596	CP.exe
6256	i_omgezwrpjg.exe
2160	trmjhbztrm.sys
6612	CP.exe
2296	rpjhbztrmj.exe
2308	CP.exe
6224	CP.exe
6500	i_rpjhbztrmj.exe
6048	geywqojgeb.sys
3192	CP.exe
3904	jdbywqomjd.exe
3824	CP.exe
6060	CP.exe
6028	i_jdbywqomjd.exe
2136	oigdyvtqli.sys
6232	CP.exe
2960	gdyvqoigay.exe
5260	CP.exe
3772	CP.exe
5452	i_gdyvqoigay.exe
6752	oigdyvtoig.sys
5456	CP.exe
6932	dxvtnicays.exe
4816	CP.exe
964	CP.exe
6068	i_dxvtnicays.exe
5856	idayspnlfd.sys
2896	CP.exe
2436	igaxvpnifa.exe
4768	CP.exe
1252	CP.exe
960	i_igaxvpnifa.exe
6412	snkfcxvpnh.sys
6452	CP.exe
6952	mkfcxvpnhf.exe
6200	CP.exe
3212	CP.exe
5804	i_mkfcxvpnhf.exe
1792	mkhfzxusmk.sys
6108	CP.exe
6600	smkhfzxrpk.exe
4592	CP.exe
7032	CP.exe
5984	i_smkhfzxrpk.exe
4596	cxupmkeczu.sys
5868	CP.exe
4088	ojhbzxrpjh.exe
4612	CP.exe
4608	CP.exe
1284	i_ojhbzxrpjh.exe
4424	trmjecwurp.sys
3068	CP.exe
1924	uomgecztrp.exe
1368	CP.exe
6352	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_15508275\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_1162470688\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_210885414\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6788_246959177\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6788_257767189\_locales\ms\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtnicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtnicays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgecztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgecztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtrojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbywqomjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhcwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavsqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaxvpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavsqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbywqomjd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2928	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1044	ipconfig.exe
3644	ipconfig.exe
6704	ipconfig.exe
1828	ipconfig.exe
4120	ipconfig.exe
6696	ipconfig.exe
5828	ipconfig.exe
2504	ipconfig.exe
6524	ipconfig.exe
6068	ipconfig.exe
6976	ipconfig.exe
6836	ipconfig.exe
612	ipconfig.exe
4204	ipconfig.exe
5080	ipconfig.exe
756	ipconfig.exe
3220	ipconfig.exe
2364	ipconfig.exe
3456	ipconfig.exe
5744	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303976632169433"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{D8C51B90-0805-4B24-A0A2-8A5ED1E2C926}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe
6788	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6668	i_rpjhcwupmh.exe
Token: SeDebugPrivilege	6256	i_omgezwrpjg.exe
Token: SeDebugPrivilege	6500	i_rpjhbztrmj.exe
Token: SeDebugPrivilege	6028	i_jdbywqomjd.exe
Token: SeDebugPrivilege	5452	i_gdyvqoigay.exe
Token: SeDebugPrivilege	6068	i_dxvtnicays.exe
Token: SeDebugPrivilege	960	i_igaxvpnifa.exe
Token: SeDebugPrivilege	5804	i_mkfcxvpnhf.exe
Token: SeDebugPrivilege	5984	i_smkhfzxrpk.exe
Token: SeDebugPrivilege	1284	i_ojhbzxrpjh.exe
Token: SeDebugPrivilege	2388	i_uomgecztrp.exe
Token: SeDebugPrivilege	1248	i_ywuoljgbyt.exe
Token: SeDebugPrivilege	6100	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	1984	i_qlidavsqli.exe
Token: SeDebugPrivilege	4288	i_qkicaysqki.exe
Token: SeDebugPrivilege	2340	i_qkicausnki.exe
Token: SeDebugPrivilege	7160	i_spkhcausmk.exe
Token: SeDebugPrivilege	7088	i_mheczurmke.exe
Token: SeDebugPrivilege	2440	i_xrpjhbztrp.exe
Token: SeDebugPrivilege	6708	i_jebwtrojge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 4864	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4864 wrote to memory of 6788	4864	iexplore.exe	91
PID 6788 wrote to memory of 3308	6788	msedge.exe	92
PID 6788 wrote to memory of 4852	6788	msedge.exe	93
PID 6788 wrote to memory of 2928	6788	msedge.exe	94
PID 6788 wrote to memory of 4852	6788	msedge.exe	93
PID 6788 wrote to memory of 4852	6788	msedge.exe	93
PID 6788 wrote to memory of 6460	6788	msedge.exe	96
PID 6788 wrote to memory of 6460	6788	msedge.exe	96
PID 6788 wrote to memory of 2412	6788	msedge.exe	97
PID 6788 wrote to memory of 2412	6788	msedge.exe	97
PID 6788 wrote to memory of 2412	6788	msedge.exe	97
PID 6788 wrote to memory of 6836	6788	msedge.exe	98
PID 6788 wrote to memory of 6836	6788	msedge.exe	98
PID 6788 wrote to memory of 6836	6788	msedge.exe	98
PID 6788 wrote to memory of 4404	6788	msedge.exe	99
PID 6788 wrote to memory of 4404	6788	msedge.exe	99
PID 6788 wrote to memory of 4404	6788	msedge.exe	99
PID 6788 wrote to memory of 4760	6788	msedge.exe	100
PID 6788 wrote to memory of 4760	6788	msedge.exe	100
PID 6788 wrote to memory of 4760	6788	msedge.exe	100
PID 5364 wrote to memory of 1968	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 1504 wrote to memory of 7164	1504	rpjhcwupmh.exe	105
PID 6788 wrote to memory of 7120	6788	msedge.exe	106
PID 6788 wrote to memory of 1132	6788	msedge.exe	109
PID 6788 wrote to memory of 1132	6788	msedge.exe	109
PID 6788 wrote to memory of 2576	6788	msedge.exe	110
PID 6788 wrote to memory of 2576	6788	msedge.exe	110
PID 5364 wrote to memory of 4152	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 6788 wrote to memory of 4268	6788	msedge.exe	115
PID 6788 wrote to memory of 4268	6788	msedge.exe	115
PID 6788 wrote to memory of 4268	6788	msedge.exe	115
PID 5364 wrote to memory of 6552	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 6532 wrote to memory of 3608	6532	omgezwrpjg.exe	120
PID 5364 wrote to memory of 1596	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 5364 wrote to memory of 6612	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 2296 wrote to memory of 2308	2296	rpjhbztrmj.exe	129
PID 5364 wrote to memory of 6224	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 5364 wrote to memory of 3192	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 3904 wrote to memory of 3824	3904	jdbywqomjd.exe	138
PID 5364 wrote to memory of 6060	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 6788 wrote to memory of 1356	6788	msedge.exe	144
PID 6788 wrote to memory of 1252	6788	msedge.exe	145
PID 6788 wrote to memory of 4740	6788	msedge.exe	146
PID 6788 wrote to memory of 6560	6788	msedge.exe	149
PID 6788 wrote to memory of 6560	6788	msedge.exe	149
PID 6788 wrote to memory of 1472	6788	msedge.exe	150
PID 6788 wrote to memory of 1472	6788	msedge.exe	150
PID 5364 wrote to memory of 6232	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 2960 wrote to memory of 5260	2960	gdyvqoigay.exe	153
PID 5364 wrote to memory of 3772	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6788 wrote to memory of 6908	6788	msedge.exe	158
PID 6788 wrote to memory of 6908	6788	msedge.exe	158
PID 6788 wrote to memory of 6908	6788	msedge.exe	158
PID 5364 wrote to memory of 5456	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 6932 wrote to memory of 4816	6932	dxvtnicays.exe	163
PID 5364 wrote to memory of 964	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 5364 wrote to memory of 2896	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 2436 wrote to memory of 4768	2436	igaxvpnifa.exe	172
PID 5364 wrote to memory of 1252	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5364 wrote to memory of 6452	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 6952 wrote to memory of 6200	6952	mkfcxvpnhf.exe	181
PID 5364 wrote to memory of 3212	5364	2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 6788 wrote to memory of 2132	6788	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_88440296b84b406c0e81d3e04fa411e2_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff8b120c188,0x7ff8b120c194,0x7ff8b120c1a0
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,18416073354260290777,13915644914070787120,262144 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,12193879926030996325,329060721678611294,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,3453600986361108524,14032203249104285328,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:13
      4⤵
      PID:6460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,8826357546903371854,8945967727744279726,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,7046167026807297035,2387100795152853489,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5012,i,12978715723794217911,10472515429337275025,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3816,i,8090035621146403237,5544615240956752684,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5590005708577680252,18090955484227036607,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5590005708577680252,18090955484227036607,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:7120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8117657576054365216,14747503754025753095,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,12463840283375419938,6948010909377145792,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,16100346303580358880,7032885691186284683,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12490658242871795411,12404114046016548270,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,11738141801177815743,5760631366247629327,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,696973814477903354,4420116966145073475,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,1679706339420343825,12551719428972840978,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:14
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3272,i,13060483116853562130,4285670846147575595,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=1864,i,5409659664374027006,14268106999001135788,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:6908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,10764592263996415984,9948216925576228028,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,17990732079602801329,9329711768975361067,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,60481564597414665,15284175607712745460,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5160,i,6740321126375812007,2657562367224373634,2097152 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=932 /prefetch:1
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,8497230146285313130,17034572564810351296,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3724,i,12076944006178350504,17712026112192945682,262144 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,9196235823279366024,7911918168400878144,524288 --field-trial-handle=2316,i,15607329936479414848,5272086223326907083,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
      4⤵
      PID:1948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhcwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1968
- - C:\Temp\rpjhcwupmh.exe
    C:\Temp\rpjhcwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:7164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhcwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\i_rpjhcwupmh.exe
    C:\Temp\i_rpjhcwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6552
- - C:\Temp\omgezwrpjg.exe
    C:\Temp\omgezwrpjg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Temp\i_omgezwrpjg.exe
    C:\Temp\i_omgezwrpjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbztrmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6612
- - C:\Temp\rpjhbztrmj.exe
    C:\Temp\rpjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbztrmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6224
- - C:\Temp\i_rpjhbztrmj.exe
    C:\Temp\i_rpjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbywqomjd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Temp\jdbywqomjd.exe
    C:\Temp\jdbywqomjd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbywqomjd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6060
- - C:\Temp\i_jdbywqomjd.exe
    C:\Temp\i_jdbywqomjd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6232
- - C:\Temp\gdyvqoigay.exe
    C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\i_gdyvqoigay.exe
    C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvtnicays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5456
- - C:\Temp\dxvtnicays.exe
    C:\Temp\dxvtnicays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvtnicays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:964
- - C:\Temp\i_dxvtnicays.exe
    C:\Temp\i_dxvtnicays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaxvpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\igaxvpnifa.exe
    C:\Temp\igaxvpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaxvpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1252
- - C:\Temp\i_igaxvpnifa.exe
    C:\Temp\i_igaxvpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6452
- - C:\Temp\mkfcxvpnhf.exe
    C:\Temp\mkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_mkfcxvpnhf.exe
    C:\Temp\i_mkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhfzxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6108
- - C:\Temp\smkhfzxrpk.exe
    C:\Temp\smkhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhfzxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7032
- - C:\Temp\i_smkhfzxrpk.exe
    C:\Temp\i_smkhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5868
- - C:\Temp\ojhbzxrpjh.exe
    C:\Temp\ojhbzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\i_ojhbzxrpjh.exe
    C:\Temp\i_ojhbzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgecztrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3068
- - C:\Temp\uomgecztrp.exe
    C:\Temp\uomgecztrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgecztrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6352
- - C:\Temp\i_uomgecztrp.exe
    C:\Temp\i_uomgecztrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuoljgbyt.exe ups_run
  2⤵
  PID:2124
- - C:\Temp\ywuoljgbyt.exe
    C:\Temp\ywuoljgbyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuoljgbyt.exe ups_ins
  2⤵
  PID:3220
- - C:\Temp\i_ywuoljgbyt.exe
    C:\Temp\i_ywuoljgbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run
  2⤵
  PID:6064
- - C:\Temp\dbvtolgdyw.exe
    C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
  2⤵
  PID:3148
- - C:\Temp\i_dbvtolgdyw.exe
    C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidavsqli.exe ups_run
  2⤵
  PID:4824
- - C:\Temp\qlidavsqli.exe
    C:\Temp\qlidavsqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidavsqli.exe ups_ins
  2⤵
  PID:6336
- - C:\Temp\i_qlidavsqli.exe
    C:\Temp\i_qlidavsqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicaysqki.exe ups_run
  2⤵
  PID:3452
- - C:\Temp\qkicaysqki.exe
    C:\Temp\qkicaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicaysqki.exe ups_ins
  2⤵
  PID:4260
- - C:\Temp\i_qkicaysqki.exe
    C:\Temp\i_qkicaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnki.exe ups_run
  2⤵
  PID:3864
- - C:\Temp\qkicausnki.exe
    C:\Temp\qkicausnki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnki.exe ups_ins
  2⤵
  PID:6576
- - C:\Temp\i_qkicausnki.exe
    C:\Temp\i_qkicausnki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhcausmk.exe ups_run
  2⤵
  PID:5140
- - C:\Temp\spkhcausmk.exe
    C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhcausmk.exe ups_ins
  2⤵
  PID:2388
- - C:\Temp\i_spkhcausmk.exe
    C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mheczurmke.exe ups_run
  2⤵
  PID:6420
- - C:\Temp\mheczurmke.exe
    C:\Temp\mheczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:7020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mheczurmke.exe ups_ins
  2⤵
  PID:928
- - C:\Temp\i_mheczurmke.exe
    C:\Temp\i_mheczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbztrp.exe ups_run
  2⤵
  PID:6084
- - C:\Temp\xrpjhbztrp.exe
    C:\Temp\xrpjhbztrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbztrp.exe ups_ins
  2⤵
  PID:5920
- - C:\Temp\i_xrpjhbztrp.exe
    C:\Temp\i_xrpjhbztrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtrojge.exe ups_run
  2⤵
  PID:4868
- - C:\Temp\jebwtrojge.exe
    C:\Temp\jebwtrojge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtrojge.exe ups_ins
  2⤵
  PID:6056
- - C:\Temp\i_jebwtrojge.exe
    C:\Temp\i_jebwtrojge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4188

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\trmjhbztrm.sys
C:\Temp\trmjhbztrm.sys
1⤵
- Executes dropped EXE
PID:2160

C:\Temp\geywqojgeb.sys
C:\Temp\geywqojgeb.sys
1⤵
- Executes dropped EXE
PID:6048

C:\Temp\oigdyvtqli.sys
C:\Temp\oigdyvtqli.sys
1⤵
- Executes dropped EXE
PID:2136

C:\Temp\oigdyvtoig.sys
C:\Temp\oigdyvtoig.sys
1⤵
- Executes dropped EXE
PID:6752

C:\Temp\idayspnlfd.sys
C:\Temp\idayspnlfd.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:6412

C:\Temp\mkhfzxusmk.sys
C:\Temp\mkhfzxusmk.sys
1⤵
- Executes dropped EXE
PID:1792

C:\Temp\cxupmkeczu.sys
C:\Temp\cxupmkeczu.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\trmjecwurp.sys
C:\Temp\trmjecwurp.sys
1⤵
- Executes dropped EXE
PID:4424

C:\Temp\wuomjebwto.sys
C:\Temp\wuomjebwto.sys
1⤵
PID:2304

C:\Temp\gdbwtolgey.sys
C:\Temp\gdbwtolgey.sys
1⤵
PID:6500

C:\Temp\ytqlidbytq.sys
C:\Temp\ytqlidbytq.sys
1⤵
PID:6996

C:\Temp\sqkidayvqn.sys
C:\Temp\sqkidayvqn.sys
1⤵
PID:5688

C:\Temp\qkicaxspni.sys
C:\Temp\qkicaxspni.sys
1⤵
PID:1088

C:\Temp\axspkicaus.sys
C:\Temp\axspkicaus.sys
1⤵
PID:2384

C:\Temp\auspjhczus.sys
C:\Temp\auspjhczus.sys
1⤵
PID:1384

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
PID:6624

C:\Temp\jhbzwrpjhb.sys
C:\Temp\jhbzwrpjhb.sys
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvtnicays.exe

Path C:\Temp\dxvtnicays.exe
Size 226KB
SHA256 214832ddc59e2351611e54782ad173fee5e497283ea41427df5765c3b7d631e8
MD5 f15da07ce7494a7af0b0aeb150a50108
SHA1 41daee1a7130cf481ff1ee45d3f273a0592b4e30
SHA512 47ebd4b99fab2e0998a8a47e9aa89bdc2b3697ba74a2be6ee0e4e38222ebc3452157ce443475ad8bfd2dcd7b6843d1b5c78229893b16ff2c4bca4fa635883b0d
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpjhbzu.sys

Path C:\Temp\ezxrpjhbzu.sys
Size 141KB
SHA256 bb197d8144e513f3d3f638b0e35fc5103916b0f0a29865dd531d8bd33b4c0dea
MD5 ae7ff94d198314e803b87f5c6bb0960a
SHA1 31fbae2d9bfdd1739fbbc5dbdfd5affb881b5f74
SHA512 de8a78044b90627c8d758f88e236f828b8ab93aaae828bd158b749f5a77108a501a45e56d5c5d658e0340e640f8fc869e91c050f802849220b3db4c63ab35234
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.exe

Path C:\Temp\gdyvqoigay.exe
Size 226KB
SHA256 79317acec3c07e472e29a7ce00529f45ed7c377f53eeb63c996315e3d637068b
MD5 cd7ff728b36239c812106609348fd49f
SHA1 d798313327c1b20920d61baf6f827247d99b3e39
SHA512 a354a0e217ee061cba5f60a3a9349f5ef9a66d6807a1cf373b4091dc825caf13b19cf6d136d798241895bd96c90ea66cff26f25cad2c5fee62d17906cdbc3a00
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1AA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgeb.sys

Path C:\Temp\geywqojgeb.sys
Size 141KB
SHA256 0fc3216ae619b674b4aea5d109d461f93b6dfe377181fb87817ef7c2455e649c
MD5 5dad4f6c9b3e59f1752d5466386bb06c
SHA1 5399b4c8b64ec8c7cb2003eb2c0f0ec3684d9415
SHA512 a5b0e9bc4d49f694e05442561b01974ff1eb7e0c48ce74f89c4fb893b83c4d08c2d365e3baa983befdb3fbef29c67bc74e4844a7e1afb0701b1702b19f1a10bc
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvtnicays.exe

Path C:\Temp\i_dxvtnicays.exe
Size 226KB
SHA256 12c0b58e5297d385684ec76e566fdfc985d5e7ca7a03d753d9b95b0ddb7bd01f
MD5 ea15a124abbc9c23483879156fc33a15
SHA1 1305aa9c722ebfe4020928e5baf9f904de35a392
SHA512 518dcd8ae0c99a3204889412aacdff9cd43522c16b07419f77e0fc00ba7d13de7191f8d56f904db77133da4458219e274d8c45ed0410af64134f1004ae9bc475
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1A734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqoigay.exe

Path C:\Temp\i_gdyvqoigay.exe
Size 226KB
SHA256 81801e2312c52db7db027c4265a5b9ea9211423c6b82e2992016d99bce98bb9f
MD5 34bc718413c3595fed4ae140aa2a8862
SHA1 fbc3fb008b34ec1677c2da1837ce6ce07d2bc105
SHA512 642376c94df2ad297a5d4da22e8d017508561cf05bef10eb35128da7b5e166d1b71abbfbfceb9dfe3b5e6ebd2c92c87711abd493dbd650380246afcc3a30e357
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbywqomjd.exe

Path C:\Temp\i_jdbywqomjd.exe
Size 226KB
SHA256 0b962a227c542a0a13a4085fb9cd44534045b04957aafbb4239f8d85dfadaf39
MD5 01302dd6c09e63e47c410256748bee5b
SHA1 b7bac95f3009cc6875ef335acebb35aa19ad2a37
SHA512 ebecd7e55661c3b92c5f18ed79010d52157fea45a3b387500f8e1d701483b41075be7e6244b8d26515cbe4a46c4c77fa8ebb31ae16fdaff105f9952e5a5acb6e
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpjg.exe

Path C:\Temp\i_omgezwrpjg.exe
Size 226KB
SHA256 5f6b33a6e22929221cce64d30db3895b1c6c4e06a58f232009f68159b9df8a89
MD5 5925deb5c5c032464275a1d5056d6eba
SHA1 fd693245adfe753557b5e034d8554cb08128009a
SHA512 01552ba284506d1f46189761450c2e1831ea3ff80cc1d0e9961b39d650fad0b4a02637558cbb2905629f13e6ad539536601ad26e3aceee2e1ccb156c6964bce9
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T19F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbztrmj.exe

Path C:\Temp\i_rpjhbztrmj.exe
Size 226KB
SHA256 725fba15ad76fd97d7bd25c6a80a8c19d0732d07e7d9029e3e4000ce342a4999
MD5 6cf6bb6fa30c38c47c510b61617b0376
SHA1 88897ca25895e9a957187fa2a8bb7ddf968d3bd1
SHA512 03ad50def7886b828aa8833e5450ebfad4d63bc3ae3108897b0911173e327031cf0da98bf4a7448aa08b8fb7bf980f2ff914f71f86f5eff332062f2a0100e0b8
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhcwupmh.exe

Path C:\Temp\i_rpjhcwupmh.exe
Size 226KB
SHA256 8fc0348a82e2bac6af3ae6680be70ff2e74f0d97c04c21c6f5ac0ef2817a5275
MD5 a914c5520ab90e2f9160292d0d6ac738
SHA1 23460f741ffa4965b9ca8b9f180faf878cf1d32c
SHA512 8b8242c157b82338d6d772a7ff1e18a43f185a0e33579c5df5d9bb2a29d045ece28734dde4550dd628fed91e9082ecbbb2681c92bfe4dbf42ef0a7d8a329c2e3
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1AF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbywqomjd.exe

Path C:\Temp\jdbywqomjd.exe
Size 226KB
SHA256 1a05ec5c7aa940aef96e9e8b05f55411b6f788e8d7c6f4af7d615674232c4122
MD5 cc9059772cc5172aa47473deb7023100
SHA1 ecf138541d5a1749232470908427b2cb171bd521
SHA512 b0b5ae9d0eb30faea85ff155800d338d9951febce4d808b77db1ee37a1219b2316c2bebd3e9302157bb4dd5e14afb150ff2af77b141424e7344ded790cfa72b5
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T11134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdyvtoig.sys

Path C:\Temp\oigdyvtoig.sys
Size 141KB
SHA256 527d3cc912385ab4a658d4792a1e98b7eb7f86be8b77bf367cd9a9611793ce87
MD5 f16634c30898ad34808461ac664a582e
SHA1 581c542da219c5ecd07c92c1cfb0de7e8e0e949d
SHA512 626623ae430d4a1d7f5c8669263e2f81740f3ffcfeece4096cb050ba6487bbfc78fcd26d9aa0b321330043828d1f3eb84d71f3f090bec3ba4ee0c58fd92f7e34
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdyvtqli.sys

Path C:\Temp\oigdyvtqli.sys
Size 141KB
SHA256 0a0b5516ad6eb0d86061c49819ab909acf424fb5e06557d9093004f42bda1ff1
MD5 6cd4343906c7ece06fec6a34e693b04f
SHA1 86337485d027602073c8ab6cb064067fe769bb07
SHA512 01cd2d01e056d1d21e1a2bd39100cd8c4df8ca61219d3b5c453fc4415cb250ee1e1cba0466f61f7e9c3020b535aef506da04f4bda96d7770f0615a27d0b99b63
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T154E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjg.exe

Path C:\Temp\omgezwrpjg.exe
Size 226KB
SHA256 878e3821593c7d21ad999ce46676ac154b542fd85ef38cad42d3b5491268bc7a
MD5 219cee9f9168d30a8ce11a6ed86a0ef3
SHA1 fba4a8969c6f3889bbbeeda74dcbcd81158c8ea1
SHA512 5d0f6e6ca16329cb0e719e556b69cccb127ae6ab97ba8d115ee337d3c13e4bbd9fec51b76d0a6768df6d9a8d4fbf65d96876cf4b2103c0afdbb47a43e7852322
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T11D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbztrmj.exe

Path C:\Temp\rpjhbztrmj.exe
Size 226KB
SHA256 8d0d963cd6b31e7bb2f0a4b97a9b62ec69ade1f57862dcf548b83d207074d525
MD5 1e197ad24d44a494234662eb4bd4b200
SHA1 536581a13f59d5d03a61e0f5e47664cdd74366b1
SHA512 3ecb5b4c41cb0ad14a7e4154cc4ccec1b2848148c17efe2dd95176129a392c6d47deb12d6589aa5e5ef387007d164c0578915b5baa0fbdb4f322987e8f74526f
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T1EA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhcwupmh.exe

Path C:\Temp\rpjhcwupmh.exe
Size 226KB
SHA256 b48229a8bdfce772227f10c8705af9bd08342a76d93070a8111086efeb56d34d
MD5 e647c3378de4bdacdc2215364ea79d6a
SHA1 6cb8e161dfea6649e6efcc83ff4bbcf92d8eba34
SHA512 1d4cabebb352ad50951d9eda38914d11e722b98f0d9635ce8eac4d7ba9c4ddc713f1a38b00d5d78da0a8746e49972f6781f4fd4af87d040ecc9a3476f7b3c2f2
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1EE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjhbztrm.sys

Path C:\Temp\trmjhbztrm.sys
Size 141KB
SHA256 5da427997309dc92e5777f8f720f51f70be8ca7c21a6f2736400a17a74774a83
MD5 15e1006f850a9e6fdf44d9f4ed12ceab
SHA1 99f7fc0dff4bd1963563a0cafbe2e5dff94be446
SHA512 5df76b5f2a04aef810e4abffc19de0be748c6225c7f798601226e3635616fb9ee2e3adaa5b1d9f986471e454a49a13312611ccde91edcd9e49ab5eb4ed3779c9
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CAE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8469f752fdda7f2021d2f1b90d664dc7fc3fa9b1bd848a3bda97497e8a5e7ba1
MD5 42eb1cd5d35f9689ce5a11cdbad2464a
SHA1 050c2192ca8ab8141a4eaa4eb948089094e15062
SHA512 72b581bde75ad89b6a7d6530f1bc7cac9b7f0f69ae79d34b5116f3bb80ae203f80bb9bf19a7e2d5e5e88a8f9b32d2568e17f855926ed75ff5878e809343eda82
TLSH
T13951BFF7C2E4856DC91196F0EB18BE2BCE2D0914832C7D5AC9E4AE1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d1e303b13c503adc5fc09e9d60e6e986d49eabed371596454c12c52d5c282a80
MD5 a2262e8762a2ba7a9c61b8fa21fef5ec
SHA1 d84216741b0079cb14c7fcbb07e87d402b1b3a23
SHA512 b86d821975b138b2370d2b7f480737e2fcf1a84327663ca7bd1e69803d0a7e599d9e17d674f58cf18846c9c7ffcf825a52be3727685f9596b0538419d9181a82
SSDEEP 384:sxRFj8//fUsNjN/RIt5y/5i/WNRisGQcomB:sJA//fFpWS/5YWN0sGQha
TLSH
T17A72FA15AA349D7B8CDBD209FA957FA3D2F9217391545E44AAFCDA0C00E67ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1b4c61332c060f6765ec61cff3d20f1947d6b7f2723422b939f0a7c339681105
MD5 813deaa85a5b2e2d9264fabcf9557d73
SHA1 d62567d733fd0ed041f550326a3ced3ddfbd99a8
SHA512 4a34e46a63f89cecea8cf818c40708fcc1a8c46e99b06ea37f6fc2f4ffd641892a9b18ead1f6451b99412b4d93788f4c9fc1afc8ee690f388c72e61bbb05f057
SSDEEP 192:sxRFRCyMqZjK1Ml8wC//fUsxPkNRZRItdzoD8prr/g6+WNIYcC4CJsGQYGsIgjXJ:sxRFR8//fUsx8N/RIt5P/5IW4msGQcj5
TLSH
T16072FA156A389D7B8CDBD219FA557F93D2F92173A1905E44AAFCCB0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0cf662f7351cd4a681de6f2068f9d9c9ff652c3e8b46c5015395aebb2a22872f
MD5 ebc7956601a2b3e50a8332b4c123a385
SHA1 32d68f545ec00688d97d9c5e8c5d874f674d669e
SHA512 cc18d9c27e2182cdc82dd72afba047e3ea8de07bc2889b4330fae48273f7ace57c108a59f4358a057c0bdf87bee92725114040ae3d0123be676ce0a256a95d97
SSDEEP 384:sxRFjqr//fUsNjN/RIt5y/5i/WNRisGQcomB:sJer//fFpWS/5YWN0sGQha
TLSH
T10E72F915AA389D778CDBD219FA957FA3D2F9217391545E44AAFC8A0C00E67ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f39b250b909935ba0758acc703eb8f35e385a7a627b0a6ca69495ac7efdc0165
MD5 dd7541ba6ea0463d90582968f9b7ffef
SHA1 813984f74284c435d791288e47e7b367495c3868
SHA512 d38a544a41a14435b3ee6f09cfe4fc63124e456de6b24a122d21c6427e2fd7ce2a612e3ea53c53833cc22d56737e4672ec8d9ca95e541dba8d9879cd1521a4e4
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpobbDwzrom49:Ob4YZnE7yTWg1NfwBu1jayobHwAB9
TLSH
T1ECE2EC3B280CCB7E4F804ADDEC29BDDA6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 ba9a6cb8147c4767523c5b5464ac9fbe880ec7874b0a690cf53003a249b2e85a
MD5 9623bb6596a58f4da46488f7ae145901
SHA1 1720d6d64c7014a182c4e8a0b161be39d7e6f2b8
SHA512 0aa0db9710b56e9e30739495264d4917fdf11be2caa64d6403919cc516ec7a3d653079386811ab0707a5437dcdab78f674a23430a365f2bc23d2e69a4e3aba92
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JV3:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRy
TLSH
T1D7B26C11713F4280387EA90C91B8D81F96C2B4637119E52F7BA802A65F67E139DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9cea423-6a68-4e6d-a399-c2536e38a6aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c9cea423-6a68-4e6d-a399-c2536e38a6aa.tmp
Size 649B
SHA256 b27dc08004f1de5d5fb58a4129eb34ef37f1ee7cb5ca2158754c5d6394e3c766
MD5 f854510c98b3e906f04a6a3a9ce482f9
SHA1 ac010ee5fca43d2baacb5dcbf1aded4fcfd82f59
SHA512 86814af0b7ad0b751f6e76d3093d37d32a646a53b87cb64b0e591502d283273dbf8eb3a667ba392b1a0c59b97474e4f096138ebaa28c5e4f524ee6f1bead092e
TLSH
T10CF02DA5DD21BC3719FD1B1860A80B47E750136B3B41985B3B3C825C4FB463B464681C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 d2bb98b6e41bebdf80badcbcc93e65ef0523186608da6e1263addd4b870007f8
MD5 e841c12204e0c661ac31e8f0b01943c6
SHA1 4561e8dfd64ed4639c21a3d85b0443d1b377f1d4
SHA512 8f6dcb14fea0e273d00e8435ccc251346ba263bb866d98c5abd6a9f4b62e86614bf1071b77d380ac0cc46d74a0e5ded88f0fab6a1f910b82cd1d81371b1d8c85
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuoReff+GGnR9nn/LwOObjI9G6w7uW8O:DF1j+9SXOwgUu1mGRRw29Mj
TLSH
T108C24B32DC95CEB7EDE74F98B24A7A4AEEE01267859C69C4DAD91D0D00C72ED0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4a17ea91dbd94ab83546d7bc45c9dc973ad134b814a6e30e385a75e30672224f
MD5 50fe49e3e2496a6251fea3d78f955c66
SHA1 62b8041778ac2d4d41e32f3934c5cf309eab2cd3
SHA512 47d9992602a2080fbde6e3773f8c75c2e0a07cda329eb2dcc650acb2ea47216d31c3c137f0181dbcb3074e03b446a9b3185b06341c239cd0e2fa9376c7d4a5cb
SSDEEP 384:nUfiFiZcIT8NL08TUNTUlIRuPvuTFunueff+GGnR9nnFLXiCBeRs9JKgqijUMUQ+:UqFQTQ0wg4uEDGRqCTjKgqmUn
TLSH
T160D26A32D8A5CAB7ECEB9EC9B6497646DEF011A3C8989ED4E5D95D0D00831DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 df42a4399b399cd80c56ab3463a51caf3e2fcec0edbb016304e79454ba14dcc8
MD5 eab0a31048ef849f13a0f6d127976b04
SHA1 dc02f804311c9b3add964f0eed4caa347991af70
SHA512 23d7bf3e684398f0b6e994e9bcac82a03d5f3ea5e3d7d0bfd43311d3e3dd77564ee2dfc0dbd3808790cfe7f1fa150641e492ca2878f4ad1d253ceb2316f1fe6f
SSDEEP 384:nuiFiZcI58NL08TUNTUlIRuPvuTNunueff+GGnR9nnFLXkCBeRs9JKgqijUMUQ3O:FFQ5Q0wg4u0DGR8CTjKgqmUn
TLSH
T1C5D26B32D8A5CAB7ECEB9FC9B6497646DEF011A3C8989AD4E5D95D0D00831DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 08d030f3e28b2dbbe2761aa0590ecc5d7c5b48eb4ccf1932db43f83c51d9e206
MD5 1216428012ae10d371522c91550d77af
SHA1 0578ec9166fb996f27ccf57a6bdbf6e98ac45445
SHA512 e263678823b5ff478def8d8f6a2ae4c849bd635db8eb7c56e214d5b2edab7af7f942b0e2fd99a62cadc5c2d9613433cac3be8063e8f8574f03cadf2a49e89269
SSDEEP 384:nUHiFiZcIF8NL08TUNTUlIRuPvuTFunueff+GGnR9nnFLUCCBeRs9JKgqijUMUQ+:UCFQFQ0wg4uEDGR5CTjKgqmUn
TLSH
T1D9D26B32D8A5CAB7ECEA9EC9B6497646DEF02163C8D89ED4E5D95D0D00831DE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 c73f1fe189c71e905c482bab84e20cad2ce251107281e7f290ebbabbc1ee462e
MD5 1ce73f920638a9e7d0faae6b1882f031
SHA1 9b6ac986aa3878ee43682b6530fca5ac7a32e103
SHA512 6db930141fcf62bf2da645fdcc4eee2c834faffae851a4c501de3a08cc650f6d5b0c225c7a192e4f85aa5bdc574bbc5b5c76414a45943a5b0a350d5e173729aa
TLSH
T1874102E05C3919D5D4FD0DBFB88B39FC95D89722F49830382898E958967D61E358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ada523f25a74c54a398124cfb0332a7d39c38c10e544601e0e1d37bd916c79f3
MD5 0f989aa48939a2ad9db3c42d157a591f
SHA1 96643fa4f3ac86a58dbd9d7d7f60e16300090c70
SHA512 c7656ca6835612a54fda263f03396a077a3a057ee3f7362f29313a4d6e31a7eb8f15e1dc848310316bdbe1e4ce517a3a33b5649ef7e288e2d6dab02f1adfba0a
TLSH
T1F44122E09C391AC1D4FE0D6FB44B29FC94E89722F89834382858E968967D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3df19836dbbdc5b1421ad8dc4f7e7e0e7a434d2617ad0282a47668f0071d5437
MD5 a3dcf738dc6e5ac7d9cf4e7251687726
SHA1 0fa66734ea4a1723e40fe030e1148e966da66236
SHA512 fb4e007caa73a0809c1153241a6cdc386c73ede299c669d8ebfb6b9e20367ab6c0a58a7a3d213c3c9260d7accb85def6356c041eac1f7d599b79602d986b1e9a
TLSH
T1984164E09C391AC1D4FE0DAFB44B29FC94D8D326F4D434382858E968963D65E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3d46ae0-d626-4b33-b129-6805a440db59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3d46ae0-d626-4b33-b129-6805a440db59.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-620-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1384-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1792-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2136-455-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2136-208-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2160-200-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2160-174-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2304-536-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-139-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4424-532-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4596-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-593-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-495-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6048-194-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6412-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6500-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6500-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6624-652-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6752-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6996-572-0x0000000000010000-0x0000000000083000-memory.dmp

Download