e938137d9ffce213ba231532e8033799812f40fb2930c1c2514c551518d83bba

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260809-mfdacay1ez
SHA256 e938137d9ffce213ba231532e8033799812f40fb2930c1c2514c551518d83bba
MD5 0ff244a3fba07a5c581e4f75c44e2848
SHA1 ae4af3b118a82b67d1c9602a5c0e36ea9ecb8391
SHA512 4c810744b907cd11961717e36608e62c15070ab96af5c1cb4befeed47f32e59f8868d62dfc09ff5dd680dfe7f37162e389993b14a17558ee40d4cf50e992e549
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T12834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1788	CP.exe
3172	rpmhfzurpk.exe
4492	CP.exe
4452	CP.exe
4972	i_rpmhfzurpk.exe
5624	ecwuojhbzt.sys
4596	CP.exe
4716	wrmjecwuom.exe
2340	CP.exe
6120	CP.exe
2500	i_wrmjecwuom.exe
1968	omgebwurmj.sys
552	CP.exe
3212	gbytromgey.exe
5436	CP.exe
5560	CP.exe
1252	i_gbytromgey.exe
5044	jgbztrljdb.sys
4608	CP.exe
3420	gbztqljdbv.exe
4684	CP.exe
2552	CP.exe
5624	i_gbztqljdbv.exe
4204	igdbytqlid.sys
3788	CP.exe
3576	gaytqljdbv.exe
2500	CP.exe
628	CP.exe
1112	i_gaytqljdbv.exe
4728	tnlfdxvtnl.sys
4660	CP.exe
4316	qkifaysqki.exe
2604	CP.exe
2356	CP.exe
4724	i_qkifaysqki.exe
3560	axsqnlfday.sys
1884	CP.exe
824	xvsqkifaxv.exe
4172	CP.exe
3468	CP.exe
6080	i_xvsqkifaxv.exe
3320	pnhfaxsqki.sys
6108	CP.exe
1192	pnhfaxsqki.exe
4192	CP.exe
1396	CP.exe
2660	i_pnhfaxsqki.exe
6140	spkhczxrpm.sys
4480	CP.exe
5660	usmkezwrpj.exe
2244	CP.exe
2016	CP.exe
1420	i_usmkezwrpj.exe
4544	mkhbzxrpjh.sys
6080	CP.exe
2704	jhczurmkec.exe
3320	CP.exe
5708	CP.exe
4256	i_jhczurmkec.exe
5844	wuomhezxrp.sys
1600	CP.exe
4600	omgeywqomg.exe
4348	CP.exe
240	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_972571824\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping936_369041835\_locales\cy\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qndauspnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqkifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qndauspnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqkifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcausmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytromgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtoljgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkezwrpj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1656	ipconfig.exe
1164	ipconfig.exe
5772	ipconfig.exe
4952	ipconfig.exe
3916	ipconfig.exe
2460	ipconfig.exe
4724	ipconfig.exe
2828	ipconfig.exe
5656	ipconfig.exe
4412	ipconfig.exe
4776	ipconfig.exe
2156	ipconfig.exe
2816	ipconfig.exe
1500	ipconfig.exe
1736	ipconfig.exe
5664	ipconfig.exe
4672	ipconfig.exe
548	ipconfig.exe
4204	ipconfig.exe
4204	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307446554024159"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{04269C57-BE35-424B-8BBB-99A57C80093B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
600	msedge.exe
600	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	i_rpmhfzurpk.exe
Token: SeDebugPrivilege	2500	i_wrmjecwuom.exe
Token: SeDebugPrivilege	1252	i_gbytromgey.exe
Token: SeDebugPrivilege	5624	i_gbztqljdbv.exe
Token: SeDebugPrivilege	1112	i_gaytqljdbv.exe
Token: SeDebugPrivilege	4724	i_qkifaysqki.exe
Token: SeDebugPrivilege	6080	i_xvsqkifaxv.exe
Token: SeDebugPrivilege	2660	i_pnhfaxsqki.exe
Token: SeDebugPrivilege	1420	i_usmkezwrpj.exe
Token: SeDebugPrivilege	4256	i_jhczurmkec.exe
Token: SeDebugPrivilege	4604	i_omgeywqomg.exe
Token: SeDebugPrivilege	2948	i_ebwtoljgey.exe
Token: SeDebugPrivilege	4964	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	3776	i_gdbvtnlida.exe
Token: SeDebugPrivilege	1592	i_qndauspnlf.exe
Token: SeDebugPrivilege	3940	i_sqkicausnk.exe
Token: SeDebugPrivilege	2268	i_hfcausmkhf.exe
Token: SeDebugPrivilege	2428	i_xrpjhbzuom.exe
Token: SeDebugPrivilege	3008	i_bztrpjztrm.exe
Token: SeDebugPrivilege	5368	i_bwuomgeywu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 932	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 932 wrote to memory of 936	932	iexplore.exe	90
PID 936 wrote to memory of 2276	936	msedge.exe	91
PID 936 wrote to memory of 5668	936	msedge.exe	93
PID 936 wrote to memory of 5396	936	msedge.exe	94
PID 936 wrote to memory of 5396	936	msedge.exe	94
PID 936 wrote to memory of 4260	936	msedge.exe	95
PID 936 wrote to memory of 5396	936	msedge.exe	94
PID 936 wrote to memory of 4260	936	msedge.exe	95
PID 936 wrote to memory of 5128	936	msedge.exe	96
PID 936 wrote to memory of 5128	936	msedge.exe	96
PID 936 wrote to memory of 5128	936	msedge.exe	96
PID 936 wrote to memory of 4404	936	msedge.exe	97
PID 936 wrote to memory of 4404	936	msedge.exe	97
PID 936 wrote to memory of 4404	936	msedge.exe	97
PID 936 wrote to memory of 916	936	msedge.exe	98
PID 936 wrote to memory of 916	936	msedge.exe	98
PID 936 wrote to memory of 916	936	msedge.exe	98
PID 936 wrote to memory of 2316	936	msedge.exe	99
PID 936 wrote to memory of 2316	936	msedge.exe	99
PID 936 wrote to memory of 2316	936	msedge.exe	99
PID 936 wrote to memory of 2984	936	msedge.exe	100
PID 936 wrote to memory of 2984	936	msedge.exe	100
PID 5048 wrote to memory of 1788	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3172 wrote to memory of 4492	3172	rpmhfzurpk.exe	105
PID 936 wrote to memory of 5700	936	msedge.exe	108
PID 936 wrote to memory of 5700	936	msedge.exe	108
PID 936 wrote to memory of 6140	936	msedge.exe	109
PID 936 wrote to memory of 6140	936	msedge.exe	109
PID 936 wrote to memory of 4940	936	msedge.exe	111
PID 936 wrote to memory of 3320	936	msedge.exe	113
PID 936 wrote to memory of 3320	936	msedge.exe	113
PID 936 wrote to memory of 4216	936	msedge.exe	115
PID 936 wrote to memory of 4216	936	msedge.exe	115
PID 5048 wrote to memory of 4452	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 936 wrote to memory of 2500	936	msedge.exe	128
PID 936 wrote to memory of 2500	936	msedge.exe	128
PID 936 wrote to memory of 3560	936	msedge.exe	119
PID 936 wrote to memory of 3560	936	msedge.exe	119
PID 5048 wrote to memory of 4596	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4716 wrote to memory of 2340	4716	wrmjecwuom.exe	124
PID 5048 wrote to memory of 6120	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 5048 wrote to memory of 552	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 3212 wrote to memory of 5436	3212	gbytromgey.exe	133
PID 5048 wrote to memory of 5560	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 5048 wrote to memory of 4608	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3420 wrote to memory of 4684	3420	gbztqljdbv.exe	142
PID 5048 wrote to memory of 2552	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 936 wrote to memory of 3320	936	msedge.exe	148
PID 936 wrote to memory of 5612	936	msedge.exe	149
PID 936 wrote to memory of 5708	936	msedge.exe	150
PID 5048 wrote to memory of 3788	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3576 wrote to memory of 2500	3576	gaytqljdbv.exe	155
PID 5048 wrote to memory of 628	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5048 wrote to memory of 4660	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4316 wrote to memory of 2604	4316	qkifaysqki.exe	164
PID 5048 wrote to memory of 2356	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 5048 wrote to memory of 1884	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 824 wrote to memory of 4172	824	xvsqkifaxv.exe	173
PID 5048 wrote to memory of 3468	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5048 wrote to memory of 6108	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 1192 wrote to memory of 4192	1192	pnhfaxsqki.exe	182
PID 5048 wrote to memory of 1396	5048	2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 936 wrote to memory of 1636	936	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0ff244a3fba07a5c581e4f75c44e2848_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x304,0x308,0x30c,0x300,0x32c,0x7ff8e1dec188,0x7ff8e1dec194,0x7ff8e1dec1a0
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,12431502273302207859,306956977396766036,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:11
      4⤵
      System Time Discovery
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1409930087823525069,9816324761838259290,262144 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,6710763751355292453,12916273903159501792,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,8107682577400438052,7029793510098574923,2097152 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,17644581996381529180,1614797862133228809,2097152 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,1711795649712193120,13596254654728548952,2097152 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,5063928156722272470,15596917110533635375,2097152 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
      4⤵
      PID:2316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,8764256107651103657,5030752277325890888,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,13346059297083917880,17655771261171067471,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,2074513194980978060,11297743481990217033,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14711937803388254211,14665132499393637249,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,14711937803388254211,14665132499393637249,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,17946486197779375818,7239508947832165924,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,13740283062590495450,7015698004411819745,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10591748419832926547,3457755895785135340,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,299352086843294889,8481590801726797865,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14840423679106798182,12155746613907869662,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,7177767132390843867,3000348045465399699,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:14
      4⤵
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,5865013902938607087,5273734104880461217,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,8663477514674168892,1906826963726047317,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:14
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,4840716749774246905,14648314863604774674,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6284,i,15380518499289042906,2505015472022946445,262144 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,4125226556277683972,12417681916932329231,524288 --field-trial-handle=2636,i,13486811131653729849,11592702465914348978,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:5316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhfzurpk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1788
- - C:\Temp\rpmhfzurpk.exe
    C:\Temp\rpmhfzurpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhfzurpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Temp\i_rpmhfzurpk.exe
    C:\Temp\i_rpmhfzurpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\wrmjecwuom.exe
    C:\Temp\wrmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\i_wrmjecwuom.exe
    C:\Temp\i_wrmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytromgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:552
- - C:\Temp\gbytromgey.exe
    C:\Temp\gbytromgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytromgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5560
- - C:\Temp\i_gbytromgey.exe
    C:\Temp\i_gbytromgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\gbztqljdbv.exe
    C:\Temp\gbztqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Temp\i_gbztqljdbv.exe
    C:\Temp\i_gbztqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\qkifaysqki.exe
    C:\Temp\qkifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2356
- - C:\Temp\i_qkifaysqki.exe
    C:\Temp\i_qkifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsqkifaxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1884
- - C:\Temp\xvsqkifaxv.exe
    C:\Temp\xvsqkifaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsqkifaxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3468
- - C:\Temp\i_xvsqkifaxv.exe
    C:\Temp\i_xvsqkifaxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6108
- - C:\Temp\pnhfaxsqki.exe
    C:\Temp\pnhfaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1396
- - C:\Temp\i_pnhfaxsqki.exe
    C:\Temp\i_pnhfaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Temp\usmkezwrpj.exe
    C:\Temp\usmkezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2016
- - C:\Temp\i_usmkezwrpj.exe
    C:\Temp\i_usmkezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6080
- - C:\Temp\jhczurmkec.exe
    C:\Temp\jhczurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5708
- - C:\Temp\i_jhczurmkec.exe
    C:\Temp\i_jhczurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1600
- - C:\Temp\omgeywqomg.exe
    C:\Temp\omgeywqomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:240
- - C:\Temp\i_omgeywqomg.exe
    C:\Temp\i_omgeywqomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtoljgey.exe ups_run
  2⤵
  PID:3916
- - C:\Temp\ebwtoljgey.exe
    C:\Temp\ebwtoljgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtoljgey.exe ups_ins
  2⤵
  PID:2088
- - C:\Temp\i_ebwtoljgey.exe
    C:\Temp\i_ebwtoljgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run
  2⤵
  PID:5376
- - C:\Temp\dbvtolgdyw.exe
    C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
  2⤵
  PID:6136
- - C:\Temp\i_dbvtolgdyw.exe
    C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbvtnlida.exe ups_run
  2⤵
  PID:1344
- - C:\Temp\gdbvtnlida.exe
    C:\Temp\gdbvtnlida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbvtnlida.exe ups_ins
  2⤵
  PID:4644
- - C:\Temp\i_gdbvtnlida.exe
    C:\Temp\i_gdbvtnlida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qndauspnlf.exe ups_run
  2⤵
  PID:2788
- - C:\Temp\qndauspnlf.exe
    C:\Temp\qndauspnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qndauspnlf.exe ups_ins
  2⤵
  PID:2840
- - C:\Temp\i_qndauspnlf.exe
    C:\Temp\i_qndauspnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  PID:3636
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  PID:5944
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcausmkhf.exe ups_run
  2⤵
  PID:2756
- - C:\Temp\hfcausmkhf.exe
    C:\Temp\hfcausmkhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcausmkhf.exe ups_ins
  2⤵
  PID:4664
- - C:\Temp\i_hfcausmkhf.exe
    C:\Temp\i_hfcausmkhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbzuom.exe ups_run
  2⤵
  PID:2516
- - C:\Temp\xrpjhbzuom.exe
    C:\Temp\xrpjhbzuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbzuom.exe ups_ins
  2⤵
  PID:5320
- - C:\Temp\i_xrpjhbzuom.exe
    C:\Temp\i_xrpjhbzuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrpjztrm.exe ups_run
  2⤵
  PID:4084
- - C:\Temp\bztrpjztrm.exe
    C:\Temp\bztrpjztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrpjztrm.exe ups_ins
  2⤵
  PID:1848
- - C:\Temp\i_bztrpjztrm.exe
    C:\Temp\i_bztrpjztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeywu.exe ups_run
  2⤵
  PID:884
- - C:\Temp\bwuomgeywu.exe
    C:\Temp\bwuomgeywu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeywu.exe ups_ins
  2⤵
  PID:5584
- - C:\Temp\i_bwuomgeywu.exe
    C:\Temp\i_bwuomgeywu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1396

C:\Temp\ecwuojhbzt.sys
C:\Temp\ecwuojhbzt.sys
1⤵
- Executes dropped EXE
PID:5624

C:\Temp\omgebwurmj.sys
C:\Temp\omgebwurmj.sys
1⤵
- Executes dropped EXE
PID:1968

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
- Executes dropped EXE
PID:5044

C:\Temp\igdbytqlid.sys
C:\Temp\igdbytqlid.sys
1⤵
- Executes dropped EXE
PID:4204

C:\Temp\tnlfdxvtnl.sys
C:\Temp\tnlfdxvtnl.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\axsqnlfday.sys
C:\Temp\axsqnlfday.sys
1⤵
- Executes dropped EXE
PID:3560

C:\Temp\pnhfaxsqki.sys
C:\Temp\pnhfaxsqki.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\spkhczxrpm.sys
C:\Temp\spkhczxrpm.sys
1⤵
- Executes dropped EXE
PID:6140

C:\Temp\mkhbzxrpjh.sys
C:\Temp\mkhbzxrpjh.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\bwtrljgeyw.sys
C:\Temp\bwtrljgeyw.sys
1⤵
PID:2756

C:\Temp\igdyvtolge.sys
C:\Temp\igdyvtolge.sys
1⤵
PID:2752

C:\Temp\idavtnlfda.sys
C:\Temp\idavtnlfda.sys
1⤵
PID:1492

C:\Temp\sqkigdxvtn.sys
C:\Temp\sqkigdxvtn.sys
1⤵
PID:716

C:\Temp\spnhfaxsqk.sys
C:\Temp\spnhfaxsqk.sys
1⤵
PID:3008

C:\Temp\pkhfzxvpmk.sys
C:\Temp\pkhfzxvpmk.sys
1⤵
PID:5656

C:\Temp\hczukecwup.sys
C:\Temp\hczukecwup.sys
1⤵
PID:904

C:\Temp\czurmjhecw.sys
C:\Temp\czurmjhecw.sys
1⤵
PID:5088

C:\Temp\zwromgbztr.sys
C:\Temp\zwromgbztr.sys
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuojhbzt.sys

Path C:\Temp\ecwuojhbzt.sys
Size 141KB
SHA256 3a07befc85d6ce8e2109365fd25e89744244cbc34ef00793adff418f4ff2e684
MD5 9b33f7eb2c98fcaf6ad4238d0833b2a1
SHA1 b1dd4e6c3356697f6eb1609e1f1b28d4d2b1c533
SHA512 f04dcc5795ae13f4434ccd7fec4a7f591038579d3f755ed172ba6d3515cad25d7ea87b4966b765a5e21880f9de72cda9145f85eb0a62b200c2dd06ff3d310085
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T167E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.exe

Path C:\Temp\gaytqljdbv.exe
Size 226KB
SHA256 5b2b7aa91ce5d98704234468d7cd976e424bbd6a17d21766bf35e988db6cec37
MD5 299bb68ea33ea044ce5fba8ac575a04f
SHA1 74d07faa1a9cc1772ab37c2a87535808ecc13c3e
SHA512 ab7bef51bf6106fd267e91d729fa9fa07672b60c920e401e3ce60014f76d55cfb27fad8a3888627481486d783173b1ed9cf614fa90eb261bc861b6d640ddd875
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T14E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytromgey.exe

Path C:\Temp\gbytromgey.exe
Size 226KB
SHA256 98baa49e424f2234857ae3906875dccc300f23948c0d0eb321357794bf498051
MD5 fddeec496720cef941fee97e311b2fb6
SHA1 0c47f6200ae62cce7b377558daa457abda725875
SHA512 c5e5ecbdbfdda2256bd6ce388d125b27c4c481aca9f509f89b8e1681aa748575a9b3e41ebd6fd20eccb4a5b9c6c381fc8760b4285c0194a9d8d5621abdb310fd
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztqljdbv.exe

Path C:\Temp\gbztqljdbv.exe
Size 226KB
SHA256 2ed0886f6b9bcc11c652b7cb86327b037b078cde2cb7db032498f4c6880a6aca
MD5 a4e2407ef6a73e4ad4096e789f7eadf5
SHA1 a52ca8c56f057ea5d08a63e667ce0a4fcab3c095
SHA512 a70833e95a68fe49c3f859e45cd4b04677c71d0dcbd9acfd338a4aeed971573c9c76e34bee9b05ff9a8cf28f96bf0894e7d87c9574f0f3126eceec74644b6a99
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqljdbv.exe

Path C:\Temp\i_gaytqljdbv.exe
Size 226KB
SHA256 ad89a9081022ca4ccdd63d57c963350254a201734ff7409b20e7b11596fc0c01
MD5 e9d07205f405c33cac26929bc619fdef
SHA1 29df00b0eff7dd701a87870907c7590ff45ebd90
SHA512 f2be484a42c81d98cf71a7e6330f4789ac5271c5e44bd0089ab3221fafb084c8a08377a45c70eeeadeaa7b2a2ee5e98d7d0171d2f1e0efd52dc63f814d4534fd
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1E434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytromgey.exe

Path C:\Temp\i_gbytromgey.exe
Size 226KB
SHA256 457c42bc52a9eed78042eeca182c9ca6af0dca4ff5dc8c1eba7a7ef6e65d0586
MD5 73483080dc921943109f70b9c9f37cfd
SHA1 b67de4007325fd68f08e0859053a5cdc35371401
SHA512 61c2e11dfa8b338ad1410c852541ffbf2fd109d66794da89cc257545cf950b059e69426d0d93c9fb1940e305162b55a6b0eabe94e1ffbd3d7bccda4d6365a92d
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T11E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbztqljdbv.exe

Path C:\Temp\i_gbztqljdbv.exe
Size 226KB
SHA256 3aabc86cba80c2396911657ad05ab910390973a17bbb9e7a0dea0b71cfebe774
MD5 c63b80ca73696c010497aa1b0e3edc9d
SHA1 f193667e8b8cd5039e1e76d400d0eb775a707062
SHA512 d2a3737bf316944869435591f392bf70c613e546660e5bd9f947e14e9a963f13a54be1cbc8f52b74b65a93c2cf0756721db44e7ecb944a5e7319194daae5a883
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T1CC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifaysqki.exe

Path C:\Temp\i_qkifaysqki.exe
Size 226KB
SHA256 6dc1f0a9bc577f4883d948d73001a3656b18bdc07961f77e9b5b964db1d919c4
MD5 5bf20ebdeba97d8aab70f32b53c4c6c9
SHA1 06371fc8253764078efa6c8355979ceb0a89257f
SHA512 9823e315021ea45b838b50300e4951626726a0b5f7388793b9c254c8d90124b22c4dfe2faf3293f4af9f63b6c337fd9197679f561bd58e43fae93cfd272fbf81
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T18834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhfzurpk.exe

Path C:\Temp\i_rpmhfzurpk.exe
Size 226KB
SHA256 119763ac0efad640b80434fda3adb8747f653fdeb6b40481a20fc5e649c24fa0
MD5 5b31f55f5e7f87eae270676a520ac602
SHA1 7a7363564b93156a2cc21331855b3a357f001f25
SHA512 13d905b5711593e6c4d7233404203cc13599885b40faeed530458ba2db37caf6752c31f2f1141e695e50c53a6f35d42df2fcefb78bff89ed0a15c0d891c8ced9
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T1C934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrmjecwuom.exe

Path C:\Temp\i_wrmjecwuom.exe
Size 226KB
SHA256 4d5b5dda2f8522bafd1165b9c3974d00fc81ae6902fb8fbcf401c2c334fae539
MD5 ffa133b92c62841009fa1702e81b88dd
SHA1 7b639020ff599e51d6d8102dfe42e8952da6c32a
SHA512 3492ae6df322dfa91739522faf73752780f8333fd5929a19a6abd40ab5b508f2e75342e2731cb08a957abf3a6b1511a023b0a360ba2c9ad48418452d6b89df27
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1AA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdbytqlid.sys

Path C:\Temp\igdbytqlid.sys
Size 141KB
SHA256 f844a7839a79518ec7a9297833ffac02d79ee6052914d5e6563d492c4159b51f
MD5 0ddd9b97fd1149d2ec6e2e3d1f7959ef
SHA1 f026b7df8407cc5ca01a46eceae61fbb66f1873c
SHA512 692d1fc67ec735b0ea578f2505e5b2fa07b3b44eaa2e9a84475310cae259d7347e73ddaa94742adbde1c37623fc0dfaf62f5ffbc1905df84759678cbc9b6a9db
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T133E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.sys

Path C:\Temp\jgbztrljdb.sys
Size 141KB
SHA256 b34c72f5738bb83d0309fcae24e2af88b123b903984557ac7c3cf2fdf4780680
MD5 2e2c13f7c1b48bf89cc74c1b4d9bdd6f
SHA1 b998865849e6aa5180dfa5fca5dd02f3a77ef9f6
SHA512 65ae131aafd2cfe7bef84c1d66cba9734914c626fccdf290d99ed4df3940cfa4c13245cebd7c69ee8de6a27fad4aff8937efab05e47f37531823b69a1e5ccd27
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T111E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwurmj.sys

Path C:\Temp\omgebwurmj.sys
Size 141KB
SHA256 79da9e9d44a86019fc65ae0b225bb6190112d19e377b633a6d40a9890d1d4db3
MD5 e2d2a803766b70a3c28dd5e8afab1ed6
SHA1 f23a205442c9e40414f8c9c07bd8b0e967d5a59c
SHA512 05718809c63bb03509df3b47502b2dbfb1fbf1c4585fe527cca54e51d98e5da45683e5fcd0e41e8db4f5f19036c941e9218e8e2865b42fa7d2d83723ba49e726
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T107E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaysqki.exe

Path C:\Temp\qkifaysqki.exe
Size 226KB
SHA256 5841a6086832c0f66f060bbd9ba7557d463b0eea3b05d232eb288df53c8478f0
MD5 f87400e4d935e8f4102aa84a6732c9b2
SHA1 d70ac116ffb0a40ad1798e4042efdbeb2b653085
SHA512 ec6e83c3e511c0269f19149871b045ab830533b3caade00d19e0c1acb062869421de19fc17e94b7c3c22b1b0d5b02546cec4aeb3914dbdd3b04dafc24cc82653
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T17A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhfzurpk.exe

Path C:\Temp\rpmhfzurpk.exe
Size 226KB
SHA256 559847ea5740d92acaf6701bd269e355c4e6ddb4500c69ddf0e3377521a1c709
MD5 5a9e936a1567b1187ae1f033b6383d76
SHA1 327afae31263b6a043978f2d4095e13cd3bb2934
SHA512 98e995926fd30c94239465e0d4dcf863eead02ec4bdc27e4af79337eaaad6b11d9f369ea41557fb5d252d64e19c91dbb19b6010abd1710a7903b176ce1eed305
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T14B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvtnl.sys

Path C:\Temp\tnlfdxvtnl.sys
Size 141KB
SHA256 4172e97d96ad538456da3304d8cc529f4048f245e52f8ab87b85f8fedee45930
MD5 4f16b897cd0b4c36ad5b4333aa250d95
SHA1 0146c8266ef6218659f7c265e4bb8d8b1c36477a
SHA512 408968343b58fd6013dc67d3f825310ed64dac0bc3022ed7366785a4962771d2982b8fc89f1e121cd86f2746d46708f87a4629e3b2bd646b44bd9f36f64801c0
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T152E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrmjecwuom.exe

Path C:\Temp\wrmjecwuom.exe
Size 226KB
SHA256 e15006ee49c7bd215eb6ed21d1711078ea4cf85e07f7bc3715b70a4b772cac91
MD5 b83e260dd363d97bde67ace74b907c0a
SHA1 4eb3936cdbe0cbd0a09f81793f03be055f9af2b7
SHA512 f3ad7f385db4f756efc4b6245e6762c44946ed70759c82ff1b25deb436d78901fce7c032de0196fbece43559736f9eb9839367f6bed09a59434ab3ec2cfee4c0
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3428eda8703bc32ee417786f4aa2fd7d1b74f7961ecab507ab55264ae36f0b82
MD5 cf4e4a5b7065b16dc897ed35b883b203
SHA1 05feea485df07b291a22ae54961287d2131760ba
SHA512 fe0bea2bb159d78a56a1a0c3fae425771fb1ecfa5d7833338bdf70e95f9937d12633fcb4ff023bfa38d3f2993db66f19bdb903132e1d5afe6eb1db07f53070b3
TLSH
T1D541D65063280DD1EFA2B1BBA8FC560932F7FC5D09076ED07644AE754A06F710DD1A63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596e70.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596e70.TMP
Size 2KB
SHA256 8bc58f6003d1258069dccc141359146418c232b495169d6572e26380dee53865
MD5 1e335cfb07a303cbbf57f605d919013b
SHA1 3c883f2c13d7ab4eded01f4b1dc40365d78c3fcf
SHA512 bed5bbaf920c1a69f0616430820f493f0aa69b3b89b1598d0aa110fd0d0b1f31f33e9a0cf15b0b1f7e1c15f21b798971bd8bea48630c1b0f26811beef0bcff02
TLSH
T16241D55067280DD1EFA2B1BBA8F8460932F7FC9D08076ED07644AE754A06F710CD1A63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 94ace4dc336652bc3708270cefe35c1777dbc1bbef6a5245f0326e7e10cdf3ad
MD5 bebec559de56ec4337a622b54e2a1e05
SHA1 a4751805397c8469cf44533fe796bda00805b3cf
SHA512 fef86e76e6e1eb94c3b9e75628d46937e0eef2c3fff6cdf9934569fabbd9cf8558e5f6fcf458f1fe75c460cff7e21b7654c5a033c928e75dae7f4ef0ee40cc47
TLSH
T1FA41CEF3C7E8857E890156F0AB146E1FCE2D0915832C7D5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fec021a1bba252a3dee8e6b96f7d3e20f471ed9e71c4ea36994562971b818a95
MD5 52564c4442652405e52b818e4296deee
SHA1 acfd716f7cfc018971635d641c2a343151719408
SHA512 669eb3f51e3dbc54ff43372332f2478c373da8f088caf0b13fa75016a848b50a44c1e9ec4e11d7ae51e405fb5d2a473b5b425d3734720a1d32a676f5b454e014
SSDEEP 192:sxRHR+yM/jK1Ml8wCk/f7sdbw6ZD06ozoD8p9s/g6+WNC5W/Y382daGtIgVlV6J:sxRH88k/f7sdbwsaK/5R/zow
TLSH
T14E62E915AA24597BCDDBD20CF9557F53D6F81573A1902E44AAFC9A0C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c7c88449fb57103f807d44ab5ada9bb6811019dcec934ff7ef20a0658c97de3f
MD5 4cd88b032d28a8834baf78a3dcce510a
SHA1 b8312d40b3cd792ee89b352f92b14ec7df0b8b2e
SHA512 2da3db2885db605d9847e82081b9e70989afc1f31c2d697110f65af8a6ecc61e8e3478cd0d1f0ef13a46d7b8c23dceb76ba0b920019d26f5f61c6e19c70cc9e5
SSDEEP 192:sxR0R+yM/jK1Ml8UQ+Ck/f7sPbE6ZD06ozoD8prs/g6+WNC5W/Y35haGtIgDflV2:sxR08qJk/f7sPbEsaQ/5R/ka
TLSH
T17862D715AA24597BCDDBD208FA95BF53D6F8557291902E44AAFC9A0C00E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca7e4c5063e1dfafb849b8309d006596d3b249200ecb19180ff06ebef8750646
MD5 8b968599b0b64772273154a89e190bdd
SHA1 f43c301896850d89ad28b1aa23931c9703d99d5e
SHA512 4f00d23f1a2738054f456cb6dcd111868814a61dedbe462253d97afeaf89446dda7d36f574074d1e1c0081ed6ab1bb20dbf8673d1355b9781f092f6924e75643
SSDEEP 192:sxR0R+yM/jK1Ml8wCk/f7sPbw6ZD06ozoD8p9s/g6+WNC5W/Y382daGtIgDFlV6J:sxR088k/f7sPbwsaK/5R/zoc
TLSH
T17762E915AA24597BCDDBD208FA557F53D6F81573A1902E44AAFC9A0C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 737e7e7ba3609a0a2c98bb66126dbd39e188be08dd9d7ea2142750ceefcd4cca
MD5 8fb49b7ec73be9378f14cfcb80cdf860
SHA1 49941f6c4f8456dc7afc4d9110e7f76eea26f88c
SHA512 af03bc707512e3766c180d0fa461722901aaa6eb879f04ba1bbe16603045e49f0f70b2bc7d66af0a49e67558b57e454d8e18acdef1d8a172ea5275633619d3b8
SSDEEP 768:Giqb8Q7pLuLf7kWg0CfDs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJGoMW6MroPYiA:Giqb8cEf7kWg0CfDsu1jaiGoF6XPXA
TLSH
T154E20C7B280CCB7E4F80499CEC29BE9B6DA801CB9698CD5447EA881C03C67FB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 35ab2c3b23f9be36319b074939b4464c7fd996c6ee0912a549d68efcb365346e
MD5 5ae8abe27f661db81095f5b625f6d01c
SHA1 bc3af9699c286dd95080e689ef819455c8180c2a
SHA512 3a8e9900acf887a612046e7bd9e11c5e642bf043633fc4785635f37c5e5acfee7454abf478c2888507654956b0fa0bd816f2d92b8bd77081d7d3d256aa07d0a4
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHbEBVj5J1WdSIg91K4EgT1c7j6dJOHJGXt:C1i7PF/DWrwfX9mgpct1o7zsHbEBVj5X
TLSH
T184910205303E1291397EA90C9179882EC6C274E33499E56F7BA815A61F77E038CFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a971e8f5-9353-4438-8dff-2ef96c95b321.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a971e8f5-9353-4438-8dff-2ef96c95b321.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ad36f96b43bfbb33dcd26eb8231065795f52e5e3665767babab9ea4212a3bce
MD5 28ce3ccdc1301082c9d45c2e4f370856
SHA1 0154e250866353b5d9e113748f2dba282027c800
SHA512 8d9015dc6781ee961778725ebb94e3df75f117336330b8366e1678d9557f255cb6458ce395d07d9b68dc2ee0d4704a3004c0200bb37ca08a1d2f0e3dc8abd56c
SSDEEP 768:VU3FDndc+wfZOXfjHufj+vShCQRJ2ewBKZOZb:VU35wfofDufyvS92evZQb
TLSH
T1ABF2BE70DC7469738EE2A649B60A7B03BEE56133D4C42A58DEDD5F0C018375E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2f2611f0013c1a73fc1b2ba8f014741fa25bf65ff721eaad16836d2a8b45c729
MD5 00a319268a14e78a5d6331c219b45891
SHA1 9a66cc3daf2034e35b71cf20b150f1be412e8053
SHA512 a1bc45e506eb336e2020ac5d43b50190524911705c5265b1b93fb6afca9a6986728954c4f298715d508e2ed654a7e6ff92b0fffa366d19f701fd85586230a626
SSDEEP 768:Jrv+4UNbdr3oSndc+wfZOXfjHufjovShCQRJoc:Jbsbt3ZwfofDufsvS9oc
TLSH
T17B03CF31E87869738EF29749B20ABB13BEA5612384C51A54DDDC5F0D028769E230BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea60beefc90e2d31ccb78cfc061d3321560eb3767cf336001e5b13224933a807
MD5 75e8305eb4b9efbfd6d872abe36cc567
SHA1 3932edbd92643686026dbc66574d238d08e69458
SHA512 d2f13594edfb87fd97ae1cdc27c79e16677d45238591b2d121291a565b21c588dd9d60b6baf27127e3d79246fe05ab95e9bc3e1682cab569423b69dda93a6904
SSDEEP 768:Rrv+4UNbd43rnkc+wfZOXfjHJvShCQto2bwWV:RbsbO3r+wfofDJvSc0wO
TLSH
T1FC03CF32E868A9339EE79248764ABB637EB46173C8C54744DACD4B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a2dc5d0f347b3d1bcc6e487db0e59cdd30c6ee8a07ff30df916a9ee648c26840
MD5 6fd333c3ce0df20ded4bedff8904bd95
SHA1 4a1526d3646c8bd0fb77a7b4b87583da7f830d2f
SHA512 478466d3219adbb9605ca2ee9d90a28928be1d23533250bf77dafe69c8bf30b6872c260340e1a0f4672c2036611794b1e05e056076147a739628702553e8c7b6
SSDEEP 768:4FQk3qwgohntAtfZOXfjHufjFvShCQRJ2ewBKZOZb:bk3MfofDuf5vS92evZQb
TLSH
T1661339F188E79937D9AE5787A73D6E02ADBCC163B4885594BBC85D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1def62f08e678d1e4fa214d7647e84d808e867d4c2ba98eb5d47e69e4e803681
MD5 36b9314f3a276eaec848b274a09c60bc
SHA1 e4b574121eb6e83cd507343e18dbe61a97c41024
SHA512 46e0f66c1f2e82edf012c4737db8515b17fb2f4f8ae7f34625e43ee21da1de8c8c4cfaf5502aa5390730ac41fb9fe01bac0b1175031eb88d335c1d215d1cc9ad
SSDEEP 768:/U3oDndc+wfZOXfjHufj+vShCQRJ2ewBKZOZb:/U3+wfofDufyvS92evZQb
TLSH
T18CF2AE70DC7469738EE2A649BA0A7B13BEE56173D4C42A58DEDD5F0D018375E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 bc45ae57e7c6640edbf469cca398d601dd424abb586f7b0416cc730ce99ce092
MD5 874ed8317c9d71ecbea75366ff438f20
SHA1 c99d00c796081f5960b3e739efa63d4e45f084f6
SHA512 d180e19daabc74b42b01e8640b3242ba52a2898ac6dfb589fe29b1c266ecff256b522dad9032407ed1c30d1e25bd59fb9c38d34adcc83d06f24536d39642cde0
SSDEEP 768:Grv+4UNbd43anDc+wfZOXfjHufjavShCQsJ2bwWV:GbsbO3wwfofDufOvSG0wO
TLSH
T1B203BF31E97869739EF39648B60ABB13BEA5A163C4C54744DADC1F0D018769F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f70d93a0-5fe1-4d2d-8f66-a35ae684f248.tmp

Path C:\Users\Admin\AppData\Local\Temp\f70d93a0-5fe1-4d2d-8f66-a35ae684f248.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir936_1461891364\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/716-646-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/904-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/904-681-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1908-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1968-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-608-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2756-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3560-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4204-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4544-567-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-518-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5044-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5624-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5656-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5844-592-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6140-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download