f43cc18b27258fc435d510a0204ebb53a174065b0e5968acd10bca190ee65b90

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260813-caewwazbme
SHA256 f43cc18b27258fc435d510a0204ebb53a174065b0e5968acd10bca190ee65b90
MD5 0e061c2d86b87d6cd78357a5e7156c4f
SHA1 719c3114c5ccdf15e3fcc7ee7ddcd3b0fc29b696
SHA512 ba7750e41a1a59cc3ac63cae46c7f0c6bd5bec5a3c05e1ad8138abfd5eaf7d99f6b0f2d15f4e14b303dc21f3fb59f1c45fbfa12df4d5e83b0b0e67d250352914
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4264	CP.exe
2900	mkczupmhez.exe
3272	CP.exe
1156	CP.exe
5508	i_mkczupmhez.exe
6752	upmhfzxrmk.sys
7000	CP.exe
6676	zwrojhbzwu.exe
3776	CP.exe
6744	CP.exe
5652	i_zwrojhbzwu.exe
4336	omgecwuomg.sys
2784	CP.exe
2132	mgeywuomge.exe
4484	CP.exe
2180	CP.exe
1372	i_mgeywuomge.exe
4440	ywqoljdbyw.sys
4260	CP.exe
6864	bywtrljgby.exe
6552	CP.exe
4768	CP.exe
6088	i_bywtrljgby.exe
5868	bytqligayt.sys
4844	CP.exe
2156	idbvqoigay.exe
2960	CP.exe
5184	CP.exe
352	i_idbvqoigay.exe
2864	gdbvtnlfdb.sys
1844	CP.exe
3260	vsnkfdxvqn.exe
2640	CP.exe
1524	CP.exe
2384	i_vsnkfdxvqn.exe
4776	icaysqkica.sys
2252	CP.exe
6272	fdavtnlfdx.exe
4148	CP.exe
1432	CP.exe
7024	i_fdavtnlfdx.exe
5584	icaxspnkfc.sys
2772	CP.exe
3256	ifdxuspkhf.exe
6644	CP.exe
4404	CP.exe
4932	i_ifdxuspkhf.exe
3384	nkecausnkf.sys
6200	CP.exe
4200	ecaupmhfcx.exe
6680	CP.exe
3328	CP.exe
6252	i_ecaupmhfcx.exe
7112	mhecxupmhf.sys
6948	CP.exe
3828	zxrpjecwuo.exe
4992	CP.exe
5220	CP.exe
1472	i_zxrpjecwuo.exe
6752	gezwrpjhec.sys
6684	CP.exe
5840	gezwrpjhez.exe
2604	CP.exe
1848	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
4248	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_846222232\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_361600875\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1782184303\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_846222232\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1995276660\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_361600875\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_846222232\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_1782184303\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4248_267160445\_locales\sv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkczupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbzwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfcausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebzxromkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkczupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtnlfdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwupjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxuspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtoljdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtnlfdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebzxromkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtoljdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecaupmhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwupjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxuspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecaupmhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfcausp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2392	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2904	ipconfig.exe
2964	ipconfig.exe
1848	ipconfig.exe
5324	ipconfig.exe
4584	ipconfig.exe
6184	ipconfig.exe
4892	ipconfig.exe
5896	ipconfig.exe
2864	ipconfig.exe
4380	ipconfig.exe
6504	ipconfig.exe
1476	ipconfig.exe
3056	ipconfig.exe
3704	ipconfig.exe
3640	ipconfig.exe
2708	ipconfig.exe
3088	ipconfig.exe
460	ipconfig.exe
7160	ipconfig.exe
4620	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310595372621497"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{3CF3C2CC-C8DB-48B4-8F30-4C1C8ACE9273}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6768	msedge.exe
6768	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe
4248	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5508	i_mkczupmhez.exe
Token: SeDebugPrivilege	5652	i_zwrojhbzwu.exe
Token: SeDebugPrivilege	1372	i_mgeywuomge.exe
Token: SeDebugPrivilege	6088	i_bywtrljgby.exe
Token: SeDebugPrivilege	352	i_idbvqoigay.exe
Token: SeDebugPrivilege	2384	i_vsnkfdxvqn.exe
Token: SeDebugPrivilege	7024	i_fdavtnlfdx.exe
Token: SeDebugPrivilege	4932	i_ifdxuspkhf.exe
Token: SeDebugPrivilege	6252	i_ecaupmhfcx.exe
Token: SeDebugPrivilege	1472	i_zxrpjecwuo.exe
Token: SeDebugPrivilege	1780	i_gezwrpjhez.exe
Token: SeDebugPrivilege	5816	i_trljhbztrl.exe
Token: SeDebugPrivilege	5376	i_ywtoljdyvt.exe
Token: SeDebugPrivilege	2080	i_dxvtnlfdby.exe
Token: SeDebugPrivilege	6128	i_igaysqniga.exe
Token: SeDebugPrivilege	3428	i_icaxsqkica.exe
Token: SeDebugPrivilege	6448	i_vpnhfcausp.exe
Token: SeDebugPrivilege	5652	i_mjecwupjhb.exe
Token: SeDebugPrivilege	4956	i_gebzxromkh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 7092	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 7092 wrote to memory of 4248	7092	iexplore.exe	91
PID 4248 wrote to memory of 4792	4248	msedge.exe	92
PID 4248 wrote to memory of 3596	4248	msedge.exe	93
PID 4248 wrote to memory of 2392	4248	msedge.exe	95
PID 4248 wrote to memory of 3596	4248	msedge.exe	93
PID 4248 wrote to memory of 3596	4248	msedge.exe	93
PID 4248 wrote to memory of 6372	4248	msedge.exe	96
PID 4248 wrote to memory of 6372	4248	msedge.exe	96
PID 4248 wrote to memory of 6516	4248	msedge.exe	97
PID 4248 wrote to memory of 6516	4248	msedge.exe	97
PID 4248 wrote to memory of 6516	4248	msedge.exe	97
PID 4248 wrote to memory of 1868	4248	msedge.exe	98
PID 4248 wrote to memory of 1868	4248	msedge.exe	98
PID 4248 wrote to memory of 1868	4248	msedge.exe	98
PID 4248 wrote to memory of 3472	4248	msedge.exe	99
PID 4248 wrote to memory of 3472	4248	msedge.exe	99
PID 4248 wrote to memory of 3472	4248	msedge.exe	99
PID 4248 wrote to memory of 2200	4248	msedge.exe	100
PID 4248 wrote to memory of 2200	4248	msedge.exe	100
PID 4248 wrote to memory of 2200	4248	msedge.exe	100
PID 4520 wrote to memory of 4264	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 2900 wrote to memory of 3272	2900	mkczupmhez.exe	104
PID 4248 wrote to memory of 4680	4248	msedge.exe	108
PID 4248 wrote to memory of 5628	4248	msedge.exe	107
PID 4248 wrote to memory of 4680	4248	msedge.exe	108
PID 4248 wrote to memory of 5628	4248	msedge.exe	107
PID 4248 wrote to memory of 3304	4248	msedge.exe	110
PID 4520 wrote to memory of 1156	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4520 wrote to memory of 7000	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 6676 wrote to memory of 3776	6676	zwrojhbzwu.exe	119
PID 4520 wrote to memory of 6744	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4520 wrote to memory of 2784	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2132 wrote to memory of 4484	2132	mgeywuomge.exe	128
PID 4520 wrote to memory of 2180	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4520 wrote to memory of 4260	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 6864 wrote to memory of 6552	6864	bywtrljgby.exe	137
PID 4520 wrote to memory of 4768	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4248 wrote to memory of 3256	4248	msedge.exe	143
PID 4248 wrote to memory of 6084	4248	msedge.exe	144
PID 4248 wrote to memory of 1208	4248	msedge.exe	145
PID 4248 wrote to memory of 824	4248	msedge.exe	146
PID 4248 wrote to memory of 824	4248	msedge.exe	146
PID 4248 wrote to memory of 2604	4248	msedge.exe	149
PID 4248 wrote to memory of 2604	4248	msedge.exe	149
PID 4520 wrote to memory of 4844	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 2156 wrote to memory of 2960	2156	idbvqoigay.exe	152
PID 4520 wrote to memory of 5184	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 4520 wrote to memory of 1844	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 3260 wrote to memory of 2640	3260	vsnkfdxvqn.exe	161
PID 4520 wrote to memory of 1524	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 4520 wrote to memory of 2252	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 6272 wrote to memory of 4148	6272	fdavtnlfdx.exe	170
PID 4520 wrote to memory of 1432	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 4520 wrote to memory of 2772	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 3256 wrote to memory of 6644	3256	ifdxuspkhf.exe	179
PID 4520 wrote to memory of 4404	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4248 wrote to memory of 572	4248	msedge.exe	184
PID 4248 wrote to memory of 572	4248	msedge.exe	184
PID 4520 wrote to memory of 6200	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 4200 wrote to memory of 6680	4200	ecaupmhfcx.exe	191
PID 4520 wrote to memory of 3328	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 4520 wrote to memory of 6948	4520	2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe	198
PID 3828 wrote to memory of 4992	3828	zxrpjecwuo.exe	200

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0e061c2d86b87d6cd78357a5e7156c4f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:7092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc611dc188,0x7ffc611dc194,0x7ffc611dc1a0
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1872,i,8152950623283869547,15676643325874782718,262144 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,12627528938625200786,7060430929527409813,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
      4⤵
      System Time Discovery
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,13749090369260219963,18119102666101827855,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:13
      4⤵
      PID:6372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,13031042566028622140,4785723326219312805,2097152 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:6516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,13546859071036839724,4020210584445748947,2097152 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4988,i,12095144145354518622,1005453509849930610,2097152 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3584,i,14337604752885793335,15051388813422233891,2097152 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,17883333804808119252,895843403488922244,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,7408476856409307110,1591153696393915571,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,4766988842327146792,2287613636032528861,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,4766988842327146792,2287613636032528861,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,16541199382406313733,6924525657811722161,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,17728696525102790295,13252929867923357317,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,1044852974730562452,2706606286216876164,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,4517939299316286855,3304709374648095983,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,14153380794076327945,16074895955669465996,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,8818092596112694885,12816693500715338106,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,15552211942006696259,2801113919817388137,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,17063675881788368687,2744917078268832880,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,4663296995500635234,771212658353132657,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5932,i,10318261473778380775,5018681985087274364,262144 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3200,i,8708938463537977425,5573052359434516665,524288 --field-trial-handle=2516,i,958786774025653670,1779843243916353044,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkczupmhez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264
- - C:\Temp\mkczupmhez.exe
    C:\Temp\mkczupmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkczupmhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1156
- - C:\Temp\i_mkczupmhez.exe
    C:\Temp\i_mkczupmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojhbzwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:7000
- - C:\Temp\zwrojhbzwu.exe
    C:\Temp\zwrojhbzwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojhbzwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6744
- - C:\Temp\i_zwrojhbzwu.exe
    C:\Temp\i_zwrojhbzwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2784
- - C:\Temp\mgeywuomge.exe
    C:\Temp\mgeywuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2180
- - C:\Temp\i_mgeywuomge.exe
    C:\Temp\i_mgeywuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywtrljgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\bywtrljgby.exe
    C:\Temp\bywtrljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywtrljgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_bywtrljgby.exe
    C:\Temp\i_bywtrljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idbvqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4844
- - C:\Temp\idbvqoigay.exe
    C:\Temp\idbvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idbvqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5184
- - C:\Temp\i_idbvqoigay.exe
    C:\Temp\i_idbvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\vsnkfdxvqn.exe
    C:\Temp\vsnkfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\i_vsnkfdxvqn.exe
    C:\Temp\i_vsnkfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdavtnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Temp\fdavtnlfdx.exe
    C:\Temp\fdavtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdavtnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\i_fdavtnlfdx.exe
    C:\Temp\i_fdavtnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxuspkhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\ifdxuspkhf.exe
    C:\Temp\ifdxuspkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxuspkhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\i_ifdxuspkhf.exe
    C:\Temp\i_ifdxuspkhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecaupmhfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6200
- - C:\Temp\ecaupmhfcx.exe
    C:\Temp\ecaupmhfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecaupmhfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\i_ecaupmhfcx.exe
    C:\Temp\i_ecaupmhfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6948
- - C:\Temp\zxrpjecwuo.exe
    C:\Temp\zxrpjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5220
- - C:\Temp\i_zxrpjecwuo.exe
    C:\Temp\i_zxrpjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6684
- - C:\Temp\gezwrpjhez.exe
    C:\Temp\gezwrpjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1848
- - C:\Temp\i_gezwrpjhez.exe
    C:\Temp\i_gezwrpjhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljhbztrl.exe ups_run
  2⤵
  PID:6060
- - C:\Temp\trljhbztrl.exe
    C:\Temp\trljhbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljhbztrl.exe ups_ins
  2⤵
  PID:6308
- - C:\Temp\i_trljhbztrl.exe
    C:\Temp\i_trljhbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtoljdyvt.exe ups_run
  2⤵
  PID:5648
- - C:\Temp\ywtoljdyvt.exe
    C:\Temp\ywtoljdyvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtoljdyvt.exe ups_ins
  2⤵
  PID:6888
- - C:\Temp\i_ywtoljdyvt.exe
    C:\Temp\i_ywtoljdyvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvtnlfdby.exe ups_run
  2⤵
  PID:5372
- - C:\Temp\dxvtnlfdby.exe
    C:\Temp\dxvtnlfdby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvtnlfdby.exe ups_ins
  2⤵
  PID:2076
- - C:\Temp\i_dxvtnlfdby.exe
    C:\Temp\i_dxvtnlfdby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqniga.exe ups_run
  2⤵
  PID:5096
- - C:\Temp\igaysqniga.exe
    C:\Temp\igaysqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqniga.exe ups_ins
  2⤵
  PID:3640
- - C:\Temp\i_igaysqniga.exe
    C:\Temp\i_igaysqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaxsqkica.exe ups_run
  2⤵
  PID:5228
- - C:\Temp\icaxsqkica.exe
    C:\Temp\icaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaxsqkica.exe ups_ins
  2⤵
  PID:1680
- - C:\Temp\i_icaxsqkica.exe
    C:\Temp\i_icaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfcausp.exe ups_run
  2⤵
  PID:2896
- - C:\Temp\vpnhfcausp.exe
    C:\Temp\vpnhfcausp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfcausp.exe ups_ins
  2⤵
  PID:2688
- - C:\Temp\i_vpnhfcausp.exe
    C:\Temp\i_vpnhfcausp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwupjhb.exe ups_run
  2⤵
  PID:6576
- - C:\Temp\mjecwupjhb.exe
    C:\Temp\mjecwupjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwupjhb.exe ups_ins
  2⤵
  PID:6264
- - C:\Temp\i_mjecwupjhb.exe
    C:\Temp\i_mjecwupjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebzxromkh.exe ups_run
  2⤵
  PID:2844
- - C:\Temp\gebzxromkh.exe
    C:\Temp\gebzxromkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebzxromkh.exe ups_ins
  2⤵
  PID:2940
- - C:\Temp\i_gebzxromkh.exe
    C:\Temp\i_gebzxromkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeywuo.exe ups_run
  2⤵
  PID:5324
- - C:\Temp\wtolgeywuo.exe
    C:\Temp\wtolgeywuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeywuo.exe ups_ins
  2⤵
  PID:5604
- - C:\Temp\i_wtolgeywuo.exe
    C:\Temp\i_wtolgeywuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1472

C:\Temp\upmhfzxrmk.sys
C:\Temp\upmhfzxrmk.sys
1⤵
- Executes dropped EXE
PID:6752

C:\Temp\omgecwuomg.sys
C:\Temp\omgecwuomg.sys
1⤵
- Executes dropped EXE
PID:4336

C:\Temp\ywqoljdbyw.sys
C:\Temp\ywqoljdbyw.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Temp\bytqligayt.sys
C:\Temp\bytqligayt.sys
1⤵
- Executes dropped EXE
PID:5868

C:\Temp\gdbvtnlfdb.sys
C:\Temp\gdbvtnlfdb.sys
1⤵
- Executes dropped EXE
PID:2864

C:\Temp\icaysqkica.sys
C:\Temp\icaysqkica.sys
1⤵
- Executes dropped EXE
PID:4776

C:\Temp\icaxspnkfc.sys
C:\Temp\icaxspnkfc.sys
1⤵
- Executes dropped EXE
PID:5584

C:\Temp\nkecausnkf.sys
C:\Temp\nkecausnkf.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\mhecxupmhf.sys
C:\Temp\mhecxupmhf.sys
1⤵
- Executes dropped EXE
PID:7112

C:\Temp\gezwrpjhec.sys
C:\Temp\gezwrpjhec.sys
1⤵
- Executes dropped EXE
PID:6752

C:\Temp\omgebwuomg.sys
C:\Temp\omgebwuomg.sys
1⤵
PID:4620

C:\Temp\wqoiytqolj.sys
C:\Temp\wqoiytqolj.sys
1⤵
PID:3704

C:\Temp\ljdbvtnljg.sys
C:\Temp\ljdbvtnljg.sys
1⤵
PID:3088

C:\Temp\nlfayvqnif.sys
C:\Temp\nlfayvqnif.sys
1⤵
PID:6988

C:\Temp\fcausnkfdx.sys
C:\Temp\fcausnkfdx.sys
1⤵
PID:760

C:\Temp\uspkicaxrp.sys
C:\Temp\uspkicaxrp.sys
1⤵
PID:5872

C:\Temp\xsmkhcxusm.sys
C:\Temp\xsmkhcxusm.sys
1⤵
PID:6980

C:\Temp\mhezwuomke.sys
C:\Temp\mhezwuomke.sys
1⤵
PID:6484

C:\Temp\trljebzurm.sys
C:\Temp\trljebzurm.sys
1⤵
PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqligayt.sys

Path C:\Temp\bytqligayt.sys
Size 141KB
SHA256 875e7660fe2d940cc65e4bcd50e22a3d9e02684c87164322d580f9414b0f2fe4
MD5 67b8eaf493f647ba44af31803fdb127b
SHA1 21b49079e76cdd965a8dc89e3a530c5d25ae535d
SHA512 f68ccacb97a779f9b3f33a8772022ee31dba48d750d2fb42a6caeeba667b44bf0e7909b51a6f28be8d18e4d5c32a5fca7eaeeb1c7bb64be76d001c6e42410218
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywtrljgby.exe

Path C:\Temp\bywtrljgby.exe
Size 226KB
SHA256 0826fe6c1a5501abd468f27d5f594d59e089aa55081dce653bb4fc9beb70d5b7
MD5 e603c3e850a5de9068a43c7e93414358
SHA1 f5b8dcc9ae10eee184938eee6c6c71a53bbf27c3
SHA512 6a79ae23b58dfef5441471d7e6c1dda11e8daf7a66462589f2cf2f046b39db11e60210e4adf94f7895a4935f254ea6e6ef924a6496412a06fdae67c2bcead3be
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtnlfdb.sys

Path C:\Temp\gdbvtnlfdb.sys
Size 141KB
SHA256 f8841be67fd8461932b5dc8cef2ac0f23ccc18e79aa43f998cd7e467620d3e4b
MD5 c8a1341d9aaf451c26c9119635d239a6
SHA1 6968328b94512a1d0c086db3923ce1bc8e1216c5
SHA512 a583a940eb3a490321b0c83e0883d6e5f7de2d6adf3fc639c8aa51a616737be31538dad7649e2cc4953f719861a1adff0afb4322167a47d73433b5fb30623050
SSDEEP 1536:ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T125E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywtrljgby.exe

Path C:\Temp\i_bywtrljgby.exe
Size 226KB
SHA256 6ffe65f733218dcbddf6a183286db1967bb3e1bcaa34d4ec6dee8822df59a2a4
MD5 df83039775c8f8499195250588ad0085
SHA1 adbe12003a497f24c7e254e8bd010125caf51651
SHA512 24c1d328dfe0ac7f6538202c6d1f24c31dfd9eaad4aa4a00faa72bb4b30d3e1ac5ff60b89f0363bb07a73f4ec0942ece44d7fac50d4d13b72a114b8e93fcf789
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1AD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvqoigay.exe

Path C:\Temp\i_idbvqoigay.exe
Size 226KB
SHA256 1b9c1992f222fa1b7d2b1d7e408e3664524e5afd83545f9c72121b5fb8e5f793
MD5 4c26d350e58db28bdfd55b911f7f1c84
SHA1 1686de3ddc0609655a80dcaa8c746385b5c785ce
SHA512 d8bb7efa7cdb21dfb0b4b8fc6c6947d61b07fe82f32cc479bbcc3e125fe89c650a49af7671decaab0413150fd29ad33f95febd96995f273f099b34078be453d1
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1C134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywuomge.exe

Path C:\Temp\i_mgeywuomge.exe
Size 226KB
SHA256 450afdcb76b4620ce7cd9e42719b680a917e69b1ceeeeb8a779db0f2f1856486
MD5 dae4db6fab5e68fa0b41e1cb413b4c8c
SHA1 1a72a41e95eeac5c40797da6207b3e11da92d444
SHA512 69fc2b54faaa6fc90acf7b01c3b82f337f22dbe9e5319958acd3b70da99f854663b6a0001204ba5c1a54b22e46c8c9b13e8839122fd61b3b5e04d2f3c7fc1585
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T14F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkczupmhez.exe

Path C:\Temp\i_mkczupmhez.exe
Size 226KB
SHA256 18e1bf050c5c04c34c747c17882a24728587fdc062e1f32a046597eee2c30832
MD5 d529b9f32d4874a58ed14c494948ad0e
SHA1 ab2cc56261333d7cd7577c0dde44e4a24b32e832
SHA512 9afe173cee8f2fcfdbb0066d4e0af03a834a73fc07450c737657c2bfc8bc3bd34cc52c85be8b06495ff6391e0325e96d95de34c0c21c4ca0c57ea6817906f1c0
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T16034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvqn.exe

Path C:\Temp\i_vsnkfdxvqn.exe
Size 226KB
SHA256 9026f17b79c70c4cceb6bcbf4e8cc2c788b9dd2e5a90acde24ae6f35f5908612
MD5 0bb33a8ec1ea921b4b1150de42877557
SHA1 05814dd0739ffa476817e5a57bdd7b565c0d5aa6
SHA512 fcbfb619e2dae9eef570671b6babac6ca47d1d7cf87871233d640a2e8d80d1081dd7d452d7a3704085913cadf8067f861f5b5e93c86f3e724ab31103db92480a
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T1C234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrojhbzwu.exe

Path C:\Temp\i_zwrojhbzwu.exe
Size 226KB
SHA256 872d11ac655f57a4f6af9864287644540565a9667b5020e5dc654a43eca3db9a
MD5 97b2492cda950068d4d1e43358a517b7
SHA1 7f2631e8640fee8b4719cfa27baf783b0e9079f0
SHA512 a83a83db2751c0170de0ca4b7e6155b1667f0b539619674daa003d5ef8e34de04b23de44eee935cce9898e3f1bbc2dc24f5228d370c7b220639299cfb2a2f4db
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T12D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaysqkica.sys

Path C:\Temp\icaysqkica.sys
Size 141KB
SHA256 647c7af14dabe9431456bd85ea85a49ef34bf8c4bdf88657c9df8976de60575e
MD5 c00660cb84ad92570b79f1e1f18c02b7
SHA1 7d2842d23120ff29757e5ad2026aad6d666e53b2
SHA512 b0fa1315eaa03ac4fb5b0c6c7e0af60dba8499e08cb7eb1a1b76315995ed0021ad52f84ff15ffe41333a27a4b1aa9638fda804364fa682dd6485ad8ee8420aed
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T179E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvqoigay.exe

Path C:\Temp\idbvqoigay.exe
Size 226KB
SHA256 4ee943f63fd61ef24f4dd00f800b12196b5b8a2ddbf1a580756bf13a9f614997
MD5 6aa91eb67d8443f45858b99a7b4bba76
SHA1 e53c867d62c7404fa3df02f990cade05b51fff2f
SHA512 647fb9b236b1c33316b4b27e496a1a90effd47a6505d46faaf8485933baea98fe4dba489aea2b2f339211faa4df9be0437b92862fb6682b2b4c3d5b2a1477a8b
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T13B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywuomge.exe

Path C:\Temp\mgeywuomge.exe
Size 226KB
SHA256 2e94d6b725447d2e7adf9c9d3c3c5416f824c28e74bbe2035bee67d240ab9925
MD5 93c4ec53ff8c2163dd1b2d320c1ca9db
SHA1 cba641a9e2f26359f1a2eb7ec0c4b5d413c35ba1
SHA512 d8525f18c7235b3fe941986b61409bd730920460946fca2ced3ce84813cd12f6c8963a723cbe7ff123fec0ad8784955b3620eeb70f1a5d82c46d4be185553773
SSDEEP 3072:pGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:YXY4LK+a3lLNngoqRttA7
TLSH
T1AA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkczupmhez.exe

Path C:\Temp\mkczupmhez.exe
Size 226KB
SHA256 ea39c4555d711fd7a743d1b2e96a65e172536281101db56c9d157a0de6ae4eec
MD5 7a30c158dfc45ece59935028e67fb8f4
SHA1 997e3680c50ef5a8293c447cab02a14be211b8ce
SHA512 74edd2173c7ef595fe29ff8ff7a2e8e81652f830c4c62f87fd1bc58ef89714b7e31bf829b36e9e541b52d93f8aed739e5cd1a78ea76d9ee58a1337e232e315e1
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1B834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgecwuomg.sys

Path C:\Temp\omgecwuomg.sys
Size 141KB
SHA256 bea87d9b0e2e17b4fdc5d4e0b87f8807ffe13c1889dc9c94ecec3d05d9713ae2
MD5 bc789e6eeefa1668f8f635b5b42ac8cb
SHA1 e5dc2f70bc9b54b5bd9e5bbca9c2a8fc01d619ca
SHA512 3e3ccba58671923c2f7c712a383df8359de40c3abb26c2defce140d49f952ea1a5d9dd549cbf9637597a60e1956dcd408b49525b559db966ddb5f0e30bd597cf
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E37D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfzxrmk.sys

Path C:\Temp\upmhfzxrmk.sys
Size 141KB
SHA256 04233fd2fa8a37e7e7fb3d2ac55e1a0e2b4bb0c5240dfa970dd787906b1327c7
MD5 e2dd5cb522f85ba03c0e1d12cd0b2338
SHA1 cd384aa366c73271df6a4bace71e18a09d252c4c
SHA512 c016222b42a49d2242bf721b1a016393cb51e0b14f658634776b7143a35a2a92fda1d4800355bdafcc4eac2cc5633c343f8362dcea1270aac7e647ad4464e94d
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T165E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvqn.exe

Path C:\Temp\vsnkfdxvqn.exe
Size 226KB
SHA256 62a0086b38ac2e998e50083442c178d6eab7b37e099c6f4cccd6d4e3a0eded76
MD5 8c06f79a6b1e5bbbbda2bd01e1d7b303
SHA1 a989e6f2f95036aef4c35af261cd8b345fb13551
SHA512 e26a8a4878078c382d4c3305c08471a24cb3baee9ffe2b304107f4b7b5db046a9aa2f293a2f7e14632140c17a47d5c70717fc3616172fcbe713a50f39828b51c
SSDEEP 3072:nGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:GXY4LK+a3lLNngoqRttA7
TLSH
T14234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoljdbyw.sys

Path C:\Temp\ywqoljdbyw.sys
Size 141KB
SHA256 8fd8c784427f37aa71a30638948cab6791270672f10c1741d7759df0f00d135e
MD5 09bcc8a83e7bbf6bb7f79194c568206f
SHA1 f6c603db9f27b8bf856e45e3c589448b6fdb8178
SHA512 452ac77f4cd3d9c4ea523db196b4edfa7aa6f9cbaa77e8927c3eab6ec18592f3ebc4130c56b47c43300e414d19ef65db3c6d2e8d53cff8b455e789a3b391e6e5
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T134E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojhbzwu.exe

Path C:\Temp\zwrojhbzwu.exe
Size 226KB
SHA256 a88bd80f04ac55a8cfd2e86d9bb70348ba36bd9ad0b2d2c93ae14c6b6945c8d8
MD5 734d83422353f3710327fe07c85ada0e
SHA1 6359fc75fa735f4abeb4dfdc5f8bd4b16b6b8e12
SHA512 ab8459bbbfb89109cc182153a4af02cfc61651588cd6724a98f96b13e80d3d131492ec681f79cad325afd4358a5fd21a545f02475c0e4502d3e60be139524f9d
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c27a060ef9538ef3f25345b7881f1a628285be05316d3b63e58808b32805121
MD5 c406fd20d6365a57f7a985671ab857c0
SHA1 d63c9cef05578f345415b30de25cb7c51a19b589
SHA512 8094084adf3ff42a5fead9afae18e2f02b914c4c438129284aba0331a2b8422e1a6e8a12f0c492ad1097687687cec96143eaf3665f0ddbf340a92c7018749bb6
TLSH
T1A7E02BB5C861BC2769FD1B197064064BE740131B3B40C94B3B3C852C4FB06374386C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

7249a0ee-4bdc-42b2-8ed0-010cd9ea4ae1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7249a0ee-4bdc-42b2-8ed0-010cd9ea4ae1.tmp
Size 2KB
SHA256 872f676289f2de332ff2e02b88774c7be0a1461949ae1214d2f915704cf8a222
MD5 459bcc77f023740065c2fb4a39c4fa7e
SHA1 34d1a0c02b72505d403360bc375843b38ccb1e31
SHA512 7053ce1582774d9faeb7aa64c0dbdc704becedc9bd67458030ad5d17d92db82376783364037790583d8ea42f6847b81f721c30b3ac3e9aaf4891e5a08f87e5a0
TLSH
T1B041BEF383F4856ECA1196F0AA186E2FCE2D0555432C7D9AC9E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59129edc288eee4882680a69380518baeb5dce8f79ebf6620433b1b6709ad563
MD5 5f00c73b2173bd3350156b70fa22bf4b
SHA1 a5838218c3c9a72693f4cbf0eef46f9411bb78e0
SHA512 30f0a1d5315c08b1c26f9f58808a2e37f78f57da555487d7fd8372e1ab20da102955892dd375b711c3697332d53889a48690e17a66e02cbca4a5da1533980514
SSDEEP 384:sxRP1R/fysq5N/RI8va/5y/Wh4sGQ4Cje:sz1R/fwbWB/5IWh4sGQ4B
TLSH
T1DE52C8166D689D3B4CCBE619BA55BF53D3F91132A0915E48ABFC8A0C14DB6DD220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 33c9b2028a73f981944f7cf8632de760870bc87a2b293c0693667abb516bb61a
MD5 6a5ee509ad51332a0834619d87f95d76
SHA1 d79604a38cd6b2ddf893b3def524c3aad262c312
SHA512 68e2f6cb9059a031534d1ac14ced5cb10a06ec483321cadbc261b9cbc9f5f603b0095c1b77f3978b5b54716a0bf9884c3950af0e75c33ec47fd9b3addd9324db
SSDEEP 384:sxRP1R/fys+5N/RI8va/5y/Wh4sGQ4Cve:sz1R/fsbWB/5IWh4sGQ4/
TLSH
T18352D9166D689D3B4CCBE619FA55BF53D3FD1032A0915E48AAFC9A0C14DB6DD220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c81fd60724fbbcf1f6cf9dc318c8c924fb4d04661546640bf7659ab2b12a6d0a
MD5 6106ed1fcf18f10d8b2631f1681fa8be
SHA1 ab62f781f1d3dfc48e546ae9d9e1a052db8667d3
SHA512 7511d5a0db457bee2f84574fc9e1c0d026d1dd755f37c7b412b5852e46739b7bbcf9d4351e1beb7ccd4d2b04d0bb476143ed484fa28396140dfd257b8da0a6f6
SSDEEP 384:sxRP1R/fys+ON/RI8va/5y/WhosGQ4C2zE:sz1R/fs8WB/5IWhosGQ4a
TLSH
T1DA52D916A9689D3B8CCBE619FB557F53D3F9103290815E48ABFC8A0C14EB6DD220390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9694d71c20310c6dff0dbd44ea54f5caed451b7ea510bcd4612226074ff751cc
MD5 5a1674459ee4cf0b0eddff3988454192
SHA1 ee12d678488b89fc3ebb6d061043e5d86a1a3abd
SHA512 fe202a00a7130fc8fa02dd9256c8dc2477d7cd8b7b5930e4635a66a54ae0217cc529962bb2fd997afcc4c68e31a4eed8fe2ef025424594823ce918f117989b5e
SSDEEP 768:O+WYbx7pLuL7+TWg1Nf9B8F1+UoAYDCx9Tuqh0VfUC9xbog/OVioDbDezro/a4m:O+WYbnE7+TWg1Nf9Bu1jaJoDHeA9m
TLSH
T1F8D2DA7B740DCB7E4F800ADDAC197A9F6DA802CB9698CD4087FE951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 911c6dd301e967d0e3d8f7991b7727d07e3d27c66977d6a307fb0743cab0d7ee
MD5 62a540079a2c3618a5c7406fbc7b0635
SHA1 d8ca5f2c9ad3b4ed8ab527bd162fafdfc4f7c0d5
SHA512 97207147e0297212e7faebeb7374c203798816454011283701fa94d2cdd8462a8a9177b2016222adbcc711e083021368fc6223d582add72e5491b93351aaf46d
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9LDg:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRB
TLSH
T1FEB25A11713F5680387EB90C91B8D82E92C2B4637519E56F7BA801A65F67E038DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b7f630c842d55cbba4ab08c1290dd8e18e5e2ed34b0222079069a909ba654b55
MD5 198dd7ff858e5e6f9a2c24cc239bd61f
SHA1 365fc5671c5a0916ab76a17e2351afede72af506
SHA512 5355cb869cf8f6653fbf399e48f4f32f559b3616b47d806cbf535f64fa21a692518cc8605868335393627ada162063646851ac2da4c593695e2fb41d6f73dc1d
SSDEEP 384:nmiFiZcIl8NLh8TUNTUlIR2PvuTvwvEqf+GGrpjBslRcyI6OOPrXLpe8C/mym8Li:NFQlQhwgIuMPGrlR6Oi9Pdyc
TLSH
T134E2C4F198E78977E8AE5B87637D2E429AFCD163B4884984B7C45D0CCC861BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b5a66b43941ed23e2b088740200359272cd0fdaf9395090427b9435d4fcd0be7
MD5 2b0632ee66ed657c5b9f8bf0e63c53b8
SHA1 783624103e93c507b8cd894049f103a493881473
SHA512 8df74636e2615424c908d8f39fb4a8772b01ec4ee6e5d95110d4aaf8d6d5f87555920880275c57c9835e0a93eea401aedb469b36a637574e2df139d950369eea
SSDEEP 384:nwiF1tNn/s3n9Sn8NgX8TUNTUlIRiPvuTuDREqf+GGrpjBslRYLzOObjI9G6w7hq:LF1j+9SXXwgUu2ZGrTz29M4
TLSH
T12BC24A36EC55CEB7EDE74F98B34A7A46EEE01267849C59C8EAC85D0D00871ED0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 44e7a7ebed0586e2843849c56d06c5c4af5839ffbf1c307387b44480ff921442
MD5 ec999455c840e2b7f726ea3d8a0d5a58
SHA1 654978172f94129aba1576f1f7321a80ccbf8474
SHA512 462b3cb3ccc83d41ebb56cedcbfddca3b743fcce5bb4b70f07f48f85c6248da1cf5714f8ef25b33df9899a4e68d11d0b137ad7549326a5bd78f3d0458fe045ac
SSDEEP 384:nMiFiZcIg8NLh8TUNTUlIR2PvuTvcvEqf+GGrpjBslRcoA6OOPrXLpe8C/mym8Li:3FQgQhwgIu4PGrl76Oi9Pdyc
TLSH
T164D24C32D8A4DDB7ACEA9FC5A7497643EEF41163D48C99D8E6D89D0D00C71AE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 cc5cbee446b66b96d8746966f208c64602b0628ce88e66c9d57d9b23c795b218
MD5 807d077259a40cd4f7d7fb8da224e11d
SHA1 ebb661e6f1d6b1a97ed9873b952dcc59ac91df4d
SHA512 e3a5d8aaf0811337b92a1fc8ed054d966ade8292459340722776245d66102c62c9e104aeb63785ef069c7eb239c26a7afa172aef73ad0c21fb1cabf0098d11c3
SSDEEP 384:nsiFiZcIz8NLh8TUNTUlIR2PvuTBcvEqf+GGrpjBslRcoA6OOPrXLpe8C/mym8Li:XFQzQhwgIuSPGrl76Oi9Pdyc
TLSH
T1BAD24C32D8A4CDB7ACEA9FC5A7497643EEF41163D48C99D8E6D49D0D00C71AE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cea5d2b430790ce80094fbed345133573f13530148672ecdd26d21c2e8b87934
MD5 f42791a20c27a7f1745607fefcd5cd0a
SHA1 0a7fad2dc7aaf325b7c019d9569c98a28d58af3d
SHA512 7f76face5bd752b6fe1cbbd6730b715b5c6affb4a932b2959d7a24d676ca857fa0ce29ff2dbe8236bd00303818c1c5425404722bede46f380b2c8e1afab2a77a
SSDEEP 384:nGiF1tNn/s3n9Sn8Ngh8TUNTUlIRiPvuTBnvEqf+GGrpjBslRcok6OObjI9G6w74:tF1j+9SXhwgUutPGrlh629M4
TLSH
T111C24B36E855CEB7EDE74F94B34A3A87EEE012B3849C5AD8E6C85D0D00871AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e1f342803311987fe0d84716eab82fd836a99b3a8b5aeafc98164235a5b03b70
MD5 3fec6b34092513b3ad12153c60829d9d
SHA1 c5ebb90f27eade4df39437b73dd29cc96466f29f
SHA512 eb3356dddf6d47a52487e29020cc7f6c2a4c28e4fd81b52267a4acadaec044ae295085955acc35af957b79b69a6c57e90bc82f468b2a70627bc9f5ed0a6f0a5f
TLSH
T15A412FE04C3929D1D0FD0E7E748739FC95EC9722F8A4343828A9E958957E21D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/760-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2864-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3704-587-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3832-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-174-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4336-209-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4776-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4776-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5584-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5584-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5872-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6484-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6752-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6752-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6752-147-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6980-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6988-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7112-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download