8b9d86887cb9780e725f5794d4024cf58ab107ecc4231c81766f8b7762411b29

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-3nefdaxemb
SHA256 8b9d86887cb9780e725f5794d4024cf58ab107ecc4231c81766f8b7762411b29
MD5 a35a1e329180f7dcbaff75be3f4d338c
SHA1 9312d2781adae6e6933fcb435cfee50fadbc02b6
SHA512 4dab65d7ad129ff2f4b0b4affcc1e68a450e72b2f779e3636228bdc062a218f804a0a254990113613c51e9bdbfebe7dd8ce28a7ca8f0035f544add72510505cd
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1E534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2168	CP.exe
2864	hfcxvpkhzx.exe
3464	CP.exe
2152	CP.exe
5616	i_hfcxvpkhzx.exe
4520	jhczusmjhb.sys
360	CP.exe
2968	hfzxrpmkec.exe
1772	CP.exe
3392	CP.exe
6008	i_hfzxrpmkec.exe
2008	ywuomjecwr.sys
2500	CP.exe
4252	wromgeztrl.exe
2708	CP.exe
1848	CP.exe
4316	i_wromgeztrl.exe
2484	rojgbytrom.sys
4552	CP.exe
5392	qoigeywqom.exe
3868	CP.exe
4344	CP.exe
3344	i_qoigeywqom.exe
1252	vtoljdbwto.sys
760	CP.exe
3020	jgbytqlida.exe
2320	CP.exe
3664	CP.exe
1664	i_jgbytqlida.exe
2380	qljgaytqlj.sys
2444	CP.exe
5444	oigaysqlid.exe
792	CP.exe
3932	CP.exe
5952	i_oigaysqlid.exe
5892	lfaxvtqlid.sys
4508	CP.exe
1200	igaysqkica.exe
4168	CP.exe
5596	CP.exe
3084	i_igaysqkica.exe
2580	kfdxvpnhfd.sys
4352	CP.exe
4784	kfcausnkfd.exe
4480	CP.exe
3404	CP.exe
3864	i_kfcausnkfd.exe
2148	mkfcaxspnk.sys
4740	CP.exe
6132	causmkecxu.exe
5044	CP.exe
564	CP.exe
5900	i_causmkecxu.exe
4520	hcaurpkhca.sys
3980	CP.exe
5000	fzxrpkhcau.exe
4228	CP.exe
4124	CP.exe
1516	i_fzxrpkhcau.exe
1788	wuomhezwuo.sys
4188	CP.exe
2388	zxrpjhbzur.exe
3636	CP.exe
2148	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_242989555\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5288_661356304\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_1445992772\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_1445992772\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5288_74254640\_locales\zh_TW\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtombytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxromhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxvpkhzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtombytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxromhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxvpkhzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigeywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgdbytrl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5848	ipconfig.exe
3980	ipconfig.exe
3244	ipconfig.exe
2032	ipconfig.exe
1712	ipconfig.exe
2112	ipconfig.exe
4712	ipconfig.exe
4244	ipconfig.exe
5472	ipconfig.exe
3032	ipconfig.exe
1980	ipconfig.exe
5092	ipconfig.exe
4340	ipconfig.exe
1344	ipconfig.exe
5856	ipconfig.exe
3276	ipconfig.exe
3084	ipconfig.exe
2476	ipconfig.exe
5000	ipconfig.exe
2472	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317427662147917"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{113D76B7-C966-44F9-AEEC-F02064B299D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	i_hfcxvpkhzx.exe
Token: SeDebugPrivilege	6008	i_hfzxrpmkec.exe
Token: SeDebugPrivilege	4316	i_wromgeztrl.exe
Token: SeDebugPrivilege	3344	i_qoigeywqom.exe
Token: SeDebugPrivilege	1664	i_jgbytqlida.exe
Token: SeDebugPrivilege	5952	i_oigaysqlid.exe
Token: SeDebugPrivilege	3084	i_igaysqkica.exe
Token: SeDebugPrivilege	3864	i_kfcausnkfd.exe
Token: SeDebugPrivilege	5900	i_causmkecxu.exe
Token: SeDebugPrivilege	1516	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	5200	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	2848	i_wtrljebwuo.exe
Token: SeDebugPrivilege	3400	i_ywtombytrl.exe
Token: SeDebugPrivilege	2052	i_qnlgdbytrl.exe
Token: SeDebugPrivilege	1720	i_qoigaysqli.exe
Token: SeDebugPrivilege	5068	i_kfcavsnlfd.exe
Token: SeDebugPrivilege	5200	i_nkfcausnkf.exe
Token: SeDebugPrivilege	5644	i_khfzxrpnhf.exe
Token: SeDebugPrivilege	4264	i_ezxromhezx.exe
Token: SeDebugPrivilege	1456	i_jgezwrpjhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 5164	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5164 wrote to memory of 5288	5164	iexplore.exe	90
PID 5288 wrote to memory of 3080	5288	msedge.exe	91
PID 5288 wrote to memory of 1112	5288	msedge.exe	92
PID 5288 wrote to memory of 1112	5288	msedge.exe	92
PID 5288 wrote to memory of 1112	5288	msedge.exe	92
PID 5288 wrote to memory of 4608	5288	msedge.exe	94
PID 5288 wrote to memory of 1476	5288	msedge.exe	95
PID 5288 wrote to memory of 1476	5288	msedge.exe	95
PID 5288 wrote to memory of 1172	5288	msedge.exe	96
PID 5288 wrote to memory of 1172	5288	msedge.exe	96
PID 5288 wrote to memory of 1172	5288	msedge.exe	96
PID 5288 wrote to memory of 6024	5288	msedge.exe	97
PID 5288 wrote to memory of 6024	5288	msedge.exe	97
PID 5288 wrote to memory of 6024	5288	msedge.exe	97
PID 5288 wrote to memory of 2232	5288	msedge.exe	98
PID 5288 wrote to memory of 2232	5288	msedge.exe	98
PID 5288 wrote to memory of 2232	5288	msedge.exe	98
PID 5288 wrote to memory of 5988	5288	msedge.exe	99
PID 5288 wrote to memory of 5988	5288	msedge.exe	99
PID 5288 wrote to memory of 5988	5288	msedge.exe	99
PID 5288 wrote to memory of 2948	5288	msedge.exe	101
PID 5288 wrote to memory of 2948	5288	msedge.exe	101
PID 5288 wrote to memory of 3364	5288	msedge.exe	102
PID 5288 wrote to memory of 3472	5288	msedge.exe	103
PID 5288 wrote to memory of 3364	5288	msedge.exe	102
PID 5288 wrote to memory of 3472	5288	msedge.exe	103
PID 5288 wrote to memory of 3388	5288	msedge.exe	105
PID 2764 wrote to memory of 2168	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 2864 wrote to memory of 3464	2864	hfcxvpkhzx.exe	111
PID 5288 wrote to memory of 5760	5288	msedge.exe	114
PID 5288 wrote to memory of 5760	5288	msedge.exe	114
PID 5288 wrote to memory of 1768	5288	msedge.exe	115
PID 5288 wrote to memory of 1768	5288	msedge.exe	115
PID 2764 wrote to memory of 2152	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 2764 wrote to memory of 360	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2968 wrote to memory of 1772	2968	hfzxrpmkec.exe	122
PID 2764 wrote to memory of 3392	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2764 wrote to memory of 2500	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4252 wrote to memory of 2708	4252	wromgeztrl.exe	131
PID 2764 wrote to memory of 1848	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5288 wrote to memory of 5156	5288	msedge.exe	136
PID 5288 wrote to memory of 5156	5288	msedge.exe	136
PID 5288 wrote to memory of 2680	5288	msedge.exe	137
PID 5288 wrote to memory of 2680	5288	msedge.exe	137
PID 2764 wrote to memory of 4552	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 5392 wrote to memory of 3868	5392	qoigeywqom.exe	142
PID 2764 wrote to memory of 4344	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5288 wrote to memory of 3204	5288	msedge.exe	148
PID 5288 wrote to memory of 1388	5288	msedge.exe	149
PID 5288 wrote to memory of 708	5288	msedge.exe	150
PID 2764 wrote to memory of 760	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3020 wrote to memory of 2320	3020	jgbytqlida.exe	155
PID 2764 wrote to memory of 3664	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 2764 wrote to memory of 2444	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 5444 wrote to memory of 792	5444	oigaysqlid.exe	164
PID 2764 wrote to memory of 3932	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 2764 wrote to memory of 4508	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 1200 wrote to memory of 4168	1200	igaysqkica.exe	173
PID 2764 wrote to memory of 5596	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 2764 wrote to memory of 4352	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 4784 wrote to memory of 4480	4784	kfcausnkfd.exe	182
PID 2764 wrote to memory of 3404	2764	2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5288 wrote to memory of 5580	5288	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_a35a1e329180f7dcbaff75be3f4d338c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff84354c188,0x7ff84354c194,0x7ff84354c1a0
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,13849754439504685607,12959923666753098640,262144 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,9133983082078551552,12709191234562141279,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,14421434396581399850,12026086294566469521,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,8057249621869053601,16396857740244043968,2097152 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,15502573074850870240,12142915143783033134,2097152 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,5469691466901956209,2241448350744597519,2097152 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,15775167345236445573,8514899229918172330,2097152 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,17246184659540984821,3226487717368635727,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,11699027974542666165,16453495165311366104,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,16290957821977441417,12933365478919354196,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,11522183600669467522,2054821230718528324,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,11522183600669467522,2054821230718528324,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12098996115990911234,16488893581227216949,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,4908694847998803385,11039834069768553177,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,757137637206726172,5846234109280483862,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,10755509390848784978,206020668846584459,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,14848052579722247340,8253023116062311094,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,17612654488650938781,15919256483681003065,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8765612658874343211,9626416954529589870,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,8097950573501072798,14582461716242911355,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,260901154235772474,9208484787303650030,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,14037643141495628914,10712330685682036215,262144 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17629313897518913730,6836145189385022681,524288 --field-trial-handle=2032,i,8330255014414325080,697785942109307526,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcxvpkhzx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2168
- - C:\Temp\hfcxvpkhzx.exe
    C:\Temp\hfcxvpkhzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcxvpkhzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Temp\i_hfcxvpkhzx.exe
    C:\Temp\i_hfcxvpkhzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:360
- - C:\Temp\hfzxrpmkec.exe
    C:\Temp\hfzxrpmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\i_hfzxrpmkec.exe
    C:\Temp\i_hfzxrpmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wromgeztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2500
- - C:\Temp\wromgeztrl.exe
    C:\Temp\wromgeztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wromgeztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1848
- - C:\Temp\i_wromgeztrl.exe
    C:\Temp\i_wromgeztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigeywqom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4552
- - C:\Temp\qoigeywqom.exe
    C:\Temp\qoigeywqom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigeywqom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\i_qoigeywqom.exe
    C:\Temp\i_qoigeywqom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytqlida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:760
- - C:\Temp\jgbytqlida.exe
    C:\Temp\jgbytqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytqlida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3664
- - C:\Temp\i_jgbytqlida.exe
    C:\Temp\i_jgbytqlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2444
- - C:\Temp\oigaysqlid.exe
    C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3932
- - C:\Temp\i_oigaysqlid.exe
    C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\igaysqkica.exe
    C:\Temp\igaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5596
- - C:\Temp\i_igaysqkica.exe
    C:\Temp\i_igaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcausnkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\kfcausnkfd.exe
    C:\Temp\kfcausnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcausnkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3404
- - C:\Temp\i_kfcausnkfd.exe
    C:\Temp\i_kfcausnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:564
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3980
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4124
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4188
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljebwuo.exe ups_run
  2⤵
  PID:2304
- - C:\Temp\wtrljebwuo.exe
    C:\Temp\wtrljebwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljebwuo.exe ups_ins
  2⤵
  PID:5900
- - C:\Temp\i_wtrljebwuo.exe
    C:\Temp\i_wtrljebwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtombytrl.exe ups_run
  2⤵
  PID:5612
- - C:\Temp\ywtombytrl.exe
    C:\Temp\ywtombytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtombytrl.exe ups_ins
  2⤵
  PID:4528
- - C:\Temp\i_ywtombytrl.exe
    C:\Temp\i_ywtombytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlgdbytrl.exe ups_run
  2⤵
  PID:5760
- - C:\Temp\qnlgdbytrl.exe
    C:\Temp\qnlgdbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlgdbytrl.exe ups_ins
  2⤵
  PID:5080
- - C:\Temp\i_qnlgdbytrl.exe
    C:\Temp\i_qnlgdbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:800
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:2620
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcavsnlfd.exe ups_run
  2⤵
  PID:1052
- - C:\Temp\kfcavsnlfd.exe
    C:\Temp\kfcavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcavsnlfd.exe ups_ins
  2⤵
  PID:2884
- - C:\Temp\i_kfcavsnlfd.exe
    C:\Temp\i_kfcavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcausnkf.exe ups_run
  2⤵
  PID:4676
- - C:\Temp\nkfcausnkf.exe
    C:\Temp\nkfcausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcausnkf.exe ups_ins
  2⤵
  PID:3032
- - C:\Temp\i_nkfcausnkf.exe
    C:\Temp\i_nkfcausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfzxrpnhf.exe ups_run
  2⤵
  PID:5476
- - C:\Temp\khfzxrpnhf.exe
    C:\Temp\khfzxrpnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfzxrpnhf.exe ups_ins
  2⤵
  PID:700
- - C:\Temp\i_khfzxrpnhf.exe
    C:\Temp\i_khfzxrpnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxromhezx.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\ezxromhezx.exe
    C:\Temp\ezxromhezx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxromhezx.exe ups_ins
  2⤵
  PID:2332
- - C:\Temp\i_ezxromhezx.exe
    C:\Temp\i_ezxromhezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgezwrpjhb.exe ups_run
  2⤵
  PID:5976
- - C:\Temp\jgezwrpjhb.exe
    C:\Temp\jgezwrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgezwrpjhb.exe ups_ins
  2⤵
  PID:3316
- - C:\Temp\i_jgezwrpjhb.exe
    C:\Temp\i_jgezwrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:764

C:\Temp\jhczusmjhb.sys
C:\Temp\jhczusmjhb.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\ywuomjecwr.sys
C:\Temp\ywuomjecwr.sys
1⤵
- Executes dropped EXE
PID:2008

C:\Temp\rojgbytrom.sys
C:\Temp\rojgbytrom.sys
1⤵
- Executes dropped EXE
PID:2484

C:\Temp\vtoljdbwto.sys
C:\Temp\vtoljdbwto.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\qljgaytqlj.sys
C:\Temp\qljgaytqlj.sys
1⤵
- Executes dropped EXE
PID:2380

C:\Temp\lfaxvtqlid.sys
C:\Temp\lfaxvtqlid.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\kfdxvpnhfd.sys
C:\Temp\kfdxvpnhfd.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\mkfcaxspnk.sys
C:\Temp\mkfcaxspnk.sys
1⤵
- Executes dropped EXE
PID:2148

C:\Temp\hcaurpkhca.sys
C:\Temp\hcaurpkhca.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\wuomhezwuo.sys
C:\Temp\wuomhezwuo.sys
1⤵
- Executes dropped EXE
PID:1788

C:\Temp\hbzwjhbzwr.sys
C:\Temp\hbzwjhbzwr.sys
1⤵
PID:1824

C:\Temp\ywqojgbytr.sys
C:\Temp\ywqojgbytr.sys
1⤵
PID:2552

C:\Temp\wqoigdywqo.sys
C:\Temp\wqoigdywqo.sys
1⤵
PID:4212

C:\Temp\tnlfdyvqni.sys
C:\Temp\tnlfdyvqni.sys
1⤵
PID:6104

C:\Temp\sqkigaysqc.sys
C:\Temp\sqkigaysqc.sys
1⤵
PID:2896

C:\Temp\vpnhfaxspk.sys
C:\Temp\vpnhfaxspk.sys
1⤵
PID:5816

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:1756

C:\Temp\hczxrpjhbz.sys
C:\Temp\hczxrpjhbz.sys
1⤵
PID:2752

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxvpkhzx.exe

Path C:\Temp\hfcxvpkhzx.exe
Size 226KB
SHA256 281bc34368aef05e6dc28eec48336e9b81be66de960bef090bd6bc67084f9904
MD5 27abd9e37b0ad47d8f8ca690802d4624
SHA1 d20a1538fb1918f2b20249bd3c21c7c0a10cd54a
SHA512 8d8f8c9b6214c13e896aaf3fae45a42754657a666d8a20a155f8f3ad00afb9c90733c5a63ad7ef531246cbaa0cfd3db630f6ec46e7484343f23e860e9646afcd
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T16734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpmkec.exe

Path C:\Temp\hfzxrpmkec.exe
Size 226KB
SHA256 ed64dd91127d918a5ceb7b51966bb4a966241542f7e51c700e3535583c855f03
MD5 6a385b5f011a18385af56b485c8c1216
SHA1 d98a18e75cb6ca6b1d2cfe5c69e3c1eb43aa37e1
SHA512 b6b6a9b3c5e1cdab56e99fbc336107feba5c09c45a6a9d007eafd15ccc3c7244fff66906c55cf858741c63540a6a7f04c76ab5c96399f308b5b47667aadaf611
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T16234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfcxvpkhzx.exe

Path C:\Temp\i_hfcxvpkhzx.exe
Size 226KB
SHA256 85b5994b8918958a7a22a0f7dba4311669bf891b02fb8e68c2f13337aea7092a
MD5 81b287b2f43a425f6efad8b1f875c914
SHA1 0ad1acdc771600505127ee219c65a2612ab04ae1
SHA512 628e97e75936b50e0cf69c8bbfec0bafc20aaf3ebaaa4462e8016dffdd5311288761d8c9d842c81f6a49042ac4e94f685b7f17c6f141517c0d81faa1f2ef9928
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1AA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpmkec.exe

Path C:\Temp\i_hfzxrpmkec.exe
Size 226KB
SHA256 d404576c46f403fb14e956e17e62311208f755814f8bd1290bd753a394a5b186
MD5 63e67db693852bd3ca6729fa6887c192
SHA1 6bf8e5a749774d412cdf8658506e467e73089d5a
SHA512 cc22f60e5ae39bec10cb59fb1544e58a973b332191e3d9d0515b7ba03c6be268b7a5a5e9dba0c42619939886a891738174991b5e886544cc37ee7fae5856405d
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T15B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytqlida.exe

Path C:\Temp\i_jgbytqlida.exe
Size 226KB
SHA256 5165122312b0373500e19efcb9e421563df9ae9f76fc1352267437ad81a5a540
MD5 904b8da24db8a10f5d00ad0907916432
SHA1 df9ec1487bafabce1899d9bdc5f5aa3227ce836f
SHA512 bcf38a20ba8c6e70f97c30665c336bef0879deeb4062256acf29b052cfb1b064c7afbbf33eaba3940832329691b041eecb034705fea15fec4b170c603de2cd88
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigeywqom.exe

Path C:\Temp\i_qoigeywqom.exe
Size 226KB
SHA256 93afd349dc30e01ef5044b5ec3cb521a6d4248f4128fc96606e2049df03470c4
MD5 8680005bec8147c196712ecd7035181f
SHA1 d5281e7a5f29d88b33ebcd4a8d5145e53b9dff15
SHA512 0bbf2d507aa10e3906a100ecac82875ae9bf925219201b275bc32ff7d77d942ad201d455419fffa251abdea68fcd47c334d747858f48b0eea4e6a24fe638bd78
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T17734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wromgeztrl.exe

Path C:\Temp\i_wromgeztrl.exe
Size 226KB
SHA256 3517bef7f3702a200cbbfacca29810ce17b811a4f76e45beecd483edd70c2360
MD5 b57b010b93f8565148dd3aaed8bd7a98
SHA1 c12fe588d534bf2c2222daf974d537b6a0fcf985
SHA512 ec30f58fdef24efdb561beab8cefc3a7ddcde1d5fc5ca8e62fdb5b1a8d6b9d464f9d93b9c1b30451e18c943c5f8ebe61ebc58f713587ce8756aab26a28d850f3
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqlida.exe

Path C:\Temp\jgbytqlida.exe
Size 226KB
SHA256 26644acaba046955adcacdc2a3b955942d3751d6f3709f17915b60a535663ac7
MD5 91bf383960b4efe94f1f9bdd9f67519e
SHA1 25565a3a12af6ed8f528abce5eddbbc70c861ea4
SHA512 6b6e2ffef5a4c953b1ec193f49ce8eb31abea5a946a7209bee23fc42b66c8af79d3576708ca04108322e81f63388cd6a76373c42d5cb8ca2cb6ab16663e60ea6
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmjhb.sys

Path C:\Temp\jhczusmjhb.sys
Size 141KB
SHA256 f5ddf15c979975ae73dcb8fa9b4c7bf4d68b408b3b322b237f9110d4012cc86d
MD5 d122cefa9a32b024add8b056a106886a
SHA1 3594e1834afcaedf865044153eabff8a3a9236ff
SHA512 b3a6f378bb81d857f336f9f84ed561cb9a181c4fa6a8b2aa020e90ac7d9349ae0ccbc7cab2a28abd3c0642b20480548c365eba9a3afddc2b641be5e4df039b16
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C9E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.exe

Path C:\Temp\oigaysqlid.exe
Size 226KB
SHA256 fbae1a845b4ffd021ef065fa5f79aa3f4bcfcde28bcc59f7c52c4fa8e7cc9741
MD5 99c4d6bfb344a97001ad5399211172fd
SHA1 a3a2462e7df20089879a7f15d3a85a2d3b00d850
SHA512 a8c85fe96b2537945bf506a4dbc516b4b8a4b91075d32555c3f6357dae8269f6bcb22f098538dbcb94598a6e1d01b398d96e3c44d0120e261ff6b046ab1b5f89
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T10934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljgaytqlj.sys

Path C:\Temp\qljgaytqlj.sys
Size 141KB
SHA256 05a9a46cbcccd7d1200571c4f975b6f2da8aa5749a03ac54b7f57ac02d514b4a
MD5 0f3a1374867371002a480e9ad3a3de7b
SHA1 9f0cce9412904df194f5b7c0ef437182750d0aab
SHA512 99317cfd8443b8c3ef904c46e883ce8d23c0d452c61c5411b983aa8ab0615f55ff7eb2a28af4832da5069c53dc5fa50e2ed23352533d09149076d394ef8bedcc
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigeywqom.exe

Path C:\Temp\qoigeywqom.exe
Size 226KB
SHA256 55aacaa936f4b794d3e8c599fdf972e8cfe3c716c7faa390479675dbf8a8468b
MD5 ca7315ffee1d6fa4224cea9b8990047f
SHA1 fe383fac7ee657e0815cc8bb149ac0058b0cc40f
SHA512 0eaacd46d63cce1e889fdee34a742d086f44e874ef6cefe6707cb222fc360df83d4be3428fabaab1f3730113f2531fd99befac1d74c4b3164f9556afc22ce950
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbytrom.sys

Path C:\Temp\rojgbytrom.sys
Size 141KB
SHA256 4f86f74485eb010d3fe5be24fd6692db097a5dc8bd6c1b5eee9c006bfa8d3e33
MD5 1caef6e6e3a19a97e50338b35215a58e
SHA1 ec549f0a91047e45c8d73e661df5d8e4bfcca40d
SHA512 1a4bb2df0c483acfc779a6b1a5bc186c12b93c6a857d8511c16fd2284b91a5a9cc45e816afad9b60bad7da9f638a9d7a8fd89cd6401f4ca1220176b5823dda16
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D5E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtoljdbwto.sys

Path C:\Temp\vtoljdbwto.sys
Size 141KB
SHA256 ab9b9794c7b659ee3723dcbdde3479b107f45b65511ebdfbc3238ac5775bab6e
MD5 6044a951036283e647757373b487c168
SHA1 95e0807b570e47b86c04e4e7b9d65b2fe9aed4fc
SHA512 1a36a1745c8fc9e6fdacac9a9bf8fba4de87f1281ca5e2e07de4536599f00b9b4fd1e764ef7aee8d69e238c4c99a151a1c6cebda629aa9d8304e08afeb861575
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T140E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wromgeztrl.exe

Path C:\Temp\wromgeztrl.exe
Size 226KB
SHA256 31a9ddf935c3bbda72e3eb1beb79cc9117467dd4781588aba769dee2740f28d7
MD5 a20f05263e38c1d77201ecb6d5c0af96
SHA1 187b5c7bb350330fa8258d36fe6e9d6426fc76ed
SHA512 4e0db250d1622f9e03bb91a0e34406046e1a3f939073f9d48656359cb8b931f740635e233870dcaedfccb36a289e68138e28d496a0d3375cd170bd16968da04c
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywuomjecwr.sys

Path C:\Temp\ywuomjecwr.sys
Size 141KB
SHA256 7ff757822d694e8b4e16a1b213a605a8543abc620965b101e33f525df53e9b90
MD5 df21674fc23c2b13bc0ac6b86d26196c
SHA1 7cdec74b935cf6d1df8d6a318ad4392aa4bc709c
SHA512 ceb5cd3f40b08a5cf87a98fbeb147b87bec900ed61e55ec06b6d40f6e4329125822ae1ab77a821bc3b70cff29009250f95cf888101a53e33a6ab56ab92f84f8c
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e5678437e8125d113684b2827f5e85158ac6e9975d7e9a6b978249f92cf6bf9e
MD5 d0097cfe412815d624c831a6b931b3dd
SHA1 de3fe52356b6cc724f74367791a4531f5becac14
SHA512 3b47ed37d1c85880c3254d075641ce28d0de0bdf51ba2c8bd360a02fe1c7d5e4bab8186ca6b595fb22e7b8f03e10fea40ff943f2cee1ea4e137c5365038224a6
TLSH
T1A8419382532417D1D7A14EB261E1B65832FDD4BD8607AECA7A002D7CAF05F289AD1463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59528b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59528b.TMP
Size 2KB
SHA256 43487ed5a43c0b82c5dfe56789d0afb5c36ffc5c1c716216e84f12fe5942bc5f
MD5 2477b5da23b72cf5783ee1ee2b3b3119
SHA1 a167c160807c45e75766b67cc5f5cc20388237a0
SHA512 f5ab757cad13d788fac3b1e287457f7aa064b26bc170c430e8e2d62287cd2a1819008fb762d5e4b2943b80122f3fb7c8a131c0bbc19eddeb4eecb73bc79e1670
TLSH
T1E541A482532417D1D7A14EB365E1B65832FCD4BD8607AECA7A002D7CAF05F389BD14A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6febe41e731a27e2b9dd968030ba2daba263175f2a9e586c2301c74a23638f8e
MD5 47f27d6b1e7b1f9d2583851d8669a97c
SHA1 610ecb487373f42ba6fe48e98b64a97472a71e63
SHA512 c3d49d821140ae1cb5c7beefb133c2bb495923bf9d290f4fbce0f3bb16a4c910899ce70b26c8b7fa11c6038b539a54d66879e8d11acea5bb11b13d9ec8f47688
TLSH
T14D41CDF783F8853E8A1146F0EB146E1FCE2D0911432C7D9688E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d50f49223a825bd7537d6632d4df1ea54785f16f8cc4bedc6942da167254f947
MD5 d09a43a7284911bf53be7cf3c3ca0d7c
SHA1 05ca90000adf48a83bcd015f0a475f22321a13b3
SHA512 f485c194c175c1850db5ef10d912fbbd9e52dfb3335fa39fcc118b56d6001d9bc6c289fc9e31320d337030be55a75da7690be76740014ca75d16f56c16d036c9
SSDEEP 192:sxROrCp/f4sjyDde5lSqzoD8p9+/g6+WNC9p/YCmPuOeGOLIgVTLyBJ:sxROep/f4sjyc5lvw/5i/2cA
TLSH
T1CE42B8166A28AD3B4CC7E21DBB55BF53D3F95132A1915E48ABFC8A1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7e3d07f37560d9915e134b58e2f3618bba9ee1fd880eb5e04a6c109de8a40168
MD5 96fb6875b55846b59e88015351ff0af2
SHA1 462316920a4501ff15ae0f7bb156c31c90406300
SHA512 6b02b0a4604eceb2365cb4a89b2ff430751350a8d594bb5b1ffd30a996489c8b6bcd00344c2810babf8cbd00517f999438217e2dfee581ded543f6c568cdef0a
SSDEEP 192:sxRlrCp/f4s9HDde5lSqzoD8p9+/g6+WNC9p/YC4luOeGOLIgDETLyBJ:sxRlep/f4s9Hc5lvw/5i/oct
TLSH
T1B342C915AA28AD3B4CC7E21DBB55BF53D3F95072A1915E48ABFC8A1C04EF6CD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2c5d0284ec868ce15891e8b5e17b6793937f1f17f5e508e2c5a6d926455b56d9
MD5 354b28ea10b1e0cb7207eb9a003d3dee
SHA1 7322c260458d1cd549eaf9e84ad6afcc843300a8
SHA512 99ac129f4ed6c5ca97f04cb4b60ea8d371d0122c0ceec25b61055a698b2fb73c6ed329ee93b5518bd21f9b25d751e7d34caec9731bab813d444ae98a6c2a1a2c
SSDEEP 192:sxRlrCp/f4s9HCZN0ozoD8p9+/g6+WNC9p/YC4luOeGOLIgDETLyBJ:sxRlep/f4s9HEvw/5i/oct
TLSH
T1FF42DA159928AD3B5CC7E21DBB55BF53D3F95072A1915E48ABFC8A1C00EF6CD221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 30c78d3ecb9992370da4b478aba9a20cd4140081fbe50bf0d6d4cc48f5531fb8
MD5 89af061f549fec7a758cd19ca06f5723
SHA1 ec0f147bdb5fab605cbf42b02d3652e6084d1075
SHA512 2816562f5f16e6b38fa0d1385f492869e77e6e063faf86dedd2a55a210c8477a8755f9208e62d446e5d4e7e69ea045387a3d6f0d137ba5ba315668a1621aad48
SSDEEP 192:sxRlrCp/f4s9yDde5lSqzoD8p9+/g6+WNC9p/YCmPuOeGOLIgDeTLyBJ:sxRlep/f4s9yc5lvw/5i/2cf
TLSH
T1D342C815AA28AD3B4CC7E21DBB55BF53D3F95032A1D15E48ABFC861C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6ded442704759af89f1e4b0ed68605a40b6c837962a3cb8a60183f06f8cff107
MD5 8a457ef33c5a18598df57920a20197bf
SHA1 c0972e35f854ac7f81c8d97d0e39582e5428b0d3
SHA512 eb67ef8c7adae4ff626ea3fe66f6e2f757f00861884232ff47ebc44ac7b83fd3ca2ca7c950bd61bf990b1663e8e951c1b1fc331376b108afe299868bf6b5177b
SSDEEP 768:jC+vHK7pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmQqctroZG:jC+vHiEzDQWgQ+f4+u1ja3VcG0
TLSH
T128C2EA7B740CCB7F4F804ADDEC197E9B6DA802CB5698CD5047FE941C02C6BEA92194DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2245d7e6060b0634b064083f504a584f400b174c9d966651e4820f84d7065990
MD5 3b2e3cbd74376c5e6dae103ba555b3d8
SHA1 e3fab5829dbf43a7fc6171ed372ea1d5e9e1bffe
SHA512 5519c0f17b4c6a2d73c35c82066633664ed91c5f3997b6446da0d7c6f5d2e5e67dff7508035bb281a01a98ab6fb91f5b0c36fe2adb2fe619770b293a4fb85d4a
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHyX+SkE0SWcJhgCSK4Xg4ScCqRwSbHYp8C:CbEBVj5JAdSp9/EgTK7j6dJOHyX+SkEP
TLSH
T17A914610313B02C0383EBA4CC1B99C6E86C174727416E56B3FA945AA4F67E479EFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43080bf6-7db2-4a12-886b-7f7ffdcd96d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\43080bf6-7db2-4a12-886b-7f7ffdcd96d6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 8a98f220b033172a2d07a16de4556f144c205f61af0a2bc193f0a0c8bbaaab3c
MD5 a9d20d0c2e073772f28dbe62b914207d
SHA1 fcc071b3f39bd3c594e5a91fb582e797af247316
SHA512 c32dd971f84ee4c45703bc175db206e68cd5a1c675017cea4ce5b44776246ba2c08db5967ae0ecd6f8d36fe33a2bbc45cac7d1440514f138bcf763508bbb1b8e
SSDEEP 768:Xr3wc9gR4oUp8+p3bd66j+4BRv86aLIWo5/ca:Xr3Byi8+p3Z6n4ym5Ua
TLSH
T184E2AFB1D8A99D378CF6D744B6463743AFF411A399C05E94D8E96B0D048726E270B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 ec390b731867e16a5628e309b58de95af43a522854af8af9e694552c16ceab73
MD5 5202db417bc1df61652c7806714bc022
SHA1 a56d7c629ed9c0bca11df996b0c589a1859ff725
SHA512 23e4cc62f32d1a9e5b3d5000b234949edcfdb733eb51f6fb4fccf40a90bfa8e55d1701889a89efe2ed6b1d990687ed8baf8cd032ce9100d396228d9710113d86
SSDEEP 768:PFQT3RwgGc9bStUp8+p3bd66j+4BRv86aLIWo5/ca:ST3Tz8+p3Z6n4ym5Ua
TLSH
T1951307F298D78936D8EE8747A37D2E429EBCC163B5845984BBD45E0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b195f88519794d2543cf55a511442cdee6aedc725a473bd6ca222f7a184221f6
MD5 7f94488d28446c2c291b53115cb18dca
SHA1 525cf77f434b8bfda62b0326f2e93bd2f8eac43f
SHA512 63950b645840cf6e82c098f550c2d12c1d71a709d35fcf0bcae73f820e6642dab0e60cbae5a0220084e652829152f5c3ab587457e57378b1a590fba7029a2452
SSDEEP 768:Irv+4UNbdD3pcONp8+p3bd66j+4BRv86aLIiJ2bwCl1:Ibsbp3xL8+p3Z6n4y/0ww
TLSH
T12603BE73F9A899339CE6C644B2467A437FF851A396C10AC4D8DD2B4E419B19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5e8a6adade087e90d929345b5b2225953d5155016290af5f554ae90ba796b776
MD5 57dd4ba31357faddb3a11a08cecd37d4
SHA1 50af2a8a44c39f2ccf2bff088df248ec671ccf3a
SHA512 8bd3ff96b3f98ef1b6b338f54e1c074e97d90977248b072980ffdfeb39a61e1d20dfd6111a0b7253d7cc20737a566cb2bf8a316385e0296ba288c26096e6fb8a
SSDEEP 768:Vrv+4UNbdD3lr4oNp8+p3bd66j+4BRv86aLITo52bwCl1:Vbsbp3lL8+p3Z6n4yr50ww
TLSH
T19803BF72E468D9339CE6C64472867B837FF811A399C10ED4E8D96B4E405B29E370F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 55457753dae232418d289bb53c288f1a73cc786298799f8c0dec4f256511489f
MD5 b4c45dbe69e1d69becf3626f6c814e3b
SHA1 9dbb812fc08871a50b779357918cd444e062d380
SHA512 0fd56317d921a48ffa6a7cfc7fd232aaed41fa41ad1aabe58dfdb79d7b73efbcba320b596a6b00cb5e3e617a188fefe2cc948b598e993cbf62405c4bf8ef468e
SSDEEP 768:hrv+4UNbdc37c9xGR4oTp8+p3bd66j+4BRv86aLIWo5/o:hbsbq3IXml8+p3Z6n4ym5Q
TLSH
T10203AF72E869DD338CF2C644B2463B437FF811A399C11E94E8D96B4D449B1AD270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

21f8d6d1-614c-4b2c-b7a2-361afc7f5a22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\21f8d6d1-614c-4b2c-b7a2-361afc7f5a22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe592a52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe592a52.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

5cad6792-1bb1-4859-9d1d-358fe2ee90f1.tmp

Path C:\Users\Admin\AppData\Local\Temp\5cad6792-1bb1-4859-9d1d-358fe2ee90f1.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5288_817057739\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1756-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1788-607-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1824-619-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2148-578-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2380-534-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2484-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2552-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-705-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4212-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4520-582-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4520-381-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5816-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download