3f9e044c6faae6e83fecd4759ebe6e976106b4d2de5f04051e0a2a48b7c189e4

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260820-thrn3s1arh
SHA256 3f9e044c6faae6e83fecd4759ebe6e976106b4d2de5f04051e0a2a48b7c189e4
MD5 075b1cd03cb320024146e6ec83407f7c
SHA1 dfed53933222bac99b72774361f5d5605331563c
SHA512 94987ce4cdabec58d339d965bb9fb03f0fbf01dd97f7d2288d5fe7eace3e1b8d6f6a8f2747688a883f0b8bc945fa0c4dbfdd89f434aef52f9902c557a1515147
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T18C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2732	CP.exe
5040	ljeywqojgb.exe
3860	CP.exe
4548	CP.exe
5376	i_ljeywqojgb.exe
2208	rojgbytrlj.sys
3320	CP.exe
6256	wqoljgbywq.exe
2088	CP.exe
4988	CP.exe
2664	i_wqoljgbywq.exe
5216	wqoigaysql.sys
5932	CP.exe
4960	nlfdyvqoig.exe
4424	CP.exe
5592	CP.exe
1124	i_nlfdyvqoig.exe
6460	aysqkicavs.sys
5748	CP.exe
5808	aysqnlicay.exe
6296	CP.exe
1844	CP.exe
4556	i_aysqnlicay.exe
3584	axvpnhfaxs.sys
1776	CP.exe
3876	nhfaxspkic.exe
4384	CP.exe
1368	CP.exe
5228	i_nhfaxspkic.exe
5020	khcaxvpnkf.sys
4396	CP.exe
6484	czxusmkhfz.exe
6340	CP.exe
6000	CP.exe
6300	i_czxusmkhfz.exe
4164	pmkecxupmh.sys
5756	CP.exe
5752	mkhcaupmhf.exe
632	CP.exe
6304	CP.exe
5632	i_mkhcaupmhf.exe
4672	mjhczurmjh.sys
6544	CP.exe
4140	pjgecwurmj.exe
5276	CP.exe
6928	CP.exe
4400	i_pjgecwurmj.exe
4880	bzwjgbywur.sys
5852	CP.exe
2824	omgebztrlj.exe
6708	CP.exe
7048	CP.exe
4092	i_omgebztrlj.exe
916	bwtomgeywq.sys
6992	CP.exe
476	ztrlbvtolg.exe
6080	CP.exe
5492	CP.exe
5376	i_ztrlbvtolg.exe
2916	qoigbytrlj.sys
4796	CP.exe
556	ljgaywqoli.exe
4612	CP.exe
6936	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
6152	msedge.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_1340435488\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_643400264\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_6152_880079890\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_1583568574\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_643400264\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_1583568574\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_1340435488\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6152_936692619\_locales\iw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcaupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgaywqoli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgaywqoli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidavqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcaupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjgecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoljgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrlbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdytnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdytnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnlicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjgecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrlbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoljgbywq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3324	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5636	ipconfig.exe
1076	ipconfig.exe
7132	ipconfig.exe
6868	ipconfig.exe
5344	ipconfig.exe
1440	ipconfig.exe
1776	ipconfig.exe
1128	ipconfig.exe
7000	ipconfig.exe
7056	ipconfig.exe
4464	ipconfig.exe
1588	ipconfig.exe
6320	ipconfig.exe
3516	ipconfig.exe
1272	ipconfig.exe
6536	ipconfig.exe
1460	ipconfig.exe
6740	ipconfig.exe
5412	ipconfig.exe
2380	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317154363756689"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{B23B0030-9853-45FF-9745-603E98A14E00}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5684	msedge.exe
5684	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6152	msedge.exe
6152	msedge.exe
6152	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5376	i_ljeywqojgb.exe
Token: SeDebugPrivilege	2664	i_wqoljgbywq.exe
Token: SeDebugPrivilege	1124	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	4556	i_aysqnlicay.exe
Token: SeDebugPrivilege	5228	i_nhfaxspkic.exe
Token: SeDebugPrivilege	6300	i_czxusmkhfz.exe
Token: SeDebugPrivilege	5632	i_mkhcaupmhf.exe
Token: SeDebugPrivilege	4400	i_pjgecwurmj.exe
Token: SeDebugPrivilege	4092	i_omgebztrlj.exe
Token: SeDebugPrivilege	5376	i_ztrlbvtolg.exe
Token: SeDebugPrivilege	3492	i_ljgaywqoli.exe
Token: SeDebugPrivilege	1816	i_vsqlidavqn.exe
Token: SeDebugPrivilege	5820	i_vpnhfdxvpn.exe
Token: SeDebugPrivilege	6856	i_caxsqkicau.exe
Token: SeDebugPrivilege	6180	i_hcausmkeca.exe
Token: SeDebugPrivilege	996	i_jhbzurpmhe.exe
Token: SeDebugPrivilege	1968	i_jhecwuomge.exe
Token: SeDebugPrivilege	5992	i_wuomgeywro.exe
Token: SeDebugPrivilege	2356	i_trljdbvtqo.exe
Token: SeDebugPrivilege	6068	i_gdytnlfdyv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 248	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 248 wrote to memory of 6152	248	iexplore.exe	90
PID 6152 wrote to memory of 5072	6152	msedge.exe	91
PID 6152 wrote to memory of 6548	6152	msedge.exe	93
PID 6152 wrote to memory of 3324	6152	msedge.exe	94
PID 6152 wrote to memory of 6548	6152	msedge.exe	93
PID 6152 wrote to memory of 6548	6152	msedge.exe	93
PID 6152 wrote to memory of 6400	6152	msedge.exe	95
PID 6152 wrote to memory of 6400	6152	msedge.exe	95
PID 6152 wrote to memory of 2676	6152	msedge.exe	96
PID 6152 wrote to memory of 2676	6152	msedge.exe	96
PID 6152 wrote to memory of 2676	6152	msedge.exe	96
PID 6152 wrote to memory of 4868	6152	msedge.exe	97
PID 6152 wrote to memory of 4868	6152	msedge.exe	97
PID 6152 wrote to memory of 4868	6152	msedge.exe	97
PID 1500 wrote to memory of 2732	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	98
PID 5040 wrote to memory of 3860	5040	ljeywqojgb.exe	101
PID 6152 wrote to memory of 2540	6152	msedge.exe	103
PID 6152 wrote to memory of 4824	6152	msedge.exe	104
PID 6152 wrote to memory of 2540	6152	msedge.exe	103
PID 6152 wrote to memory of 4824	6152	msedge.exe	104
PID 6152 wrote to memory of 2780	6152	msedge.exe	107
PID 1500 wrote to memory of 4548	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 1500 wrote to memory of 3320	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 6256 wrote to memory of 2088	6256	wqoljgbywq.exe	116
PID 1500 wrote to memory of 4988	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 1500 wrote to memory of 5932	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 4960 wrote to memory of 4424	4960	nlfdyvqoig.exe	125
PID 1500 wrote to memory of 5592	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1500 wrote to memory of 5748	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 5808 wrote to memory of 6296	5808	aysqnlicay.exe	134
PID 1500 wrote to memory of 1844	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 6152 wrote to memory of 1972	6152	msedge.exe	140
PID 6152 wrote to memory of 5796	6152	msedge.exe	141
PID 6152 wrote to memory of 5924	6152	msedge.exe	142
PID 6152 wrote to memory of 2012	6152	msedge.exe	143
PID 6152 wrote to memory of 2012	6152	msedge.exe	143
PID 6152 wrote to memory of 6292	6152	msedge.exe	145
PID 6152 wrote to memory of 6292	6152	msedge.exe	145
PID 1500 wrote to memory of 1776	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 3876 wrote to memory of 4384	3876	nhfaxspkic.exe	149
PID 1500 wrote to memory of 1368	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 1500 wrote to memory of 4396	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6484 wrote to memory of 6340	6484	czxusmkhfz.exe	158
PID 1500 wrote to memory of 6000	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 1500 wrote to memory of 5756	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 5752 wrote to memory of 632	5752	mkhcaupmhf.exe	167
PID 1500 wrote to memory of 6304	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 1500 wrote to memory of 6544	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4140 wrote to memory of 5276	4140	pjgecwurmj.exe	176
PID 1500 wrote to memory of 6928	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 6152 wrote to memory of 624	6152	msedge.exe	181
PID 6152 wrote to memory of 624	6152	msedge.exe	181
PID 1500 wrote to memory of 5852	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 2824 wrote to memory of 6708	2824	omgebztrlj.exe	188
PID 1500 wrote to memory of 7048	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 1500 wrote to memory of 6992	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 476 wrote to memory of 6080	476	ztrlbvtolg.exe	197
PID 1500 wrote to memory of 5492	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 6152 wrote to memory of 2044	6152	msedge.exe	201
PID 6152 wrote to memory of 2044	6152	msedge.exe	201
PID 1500 wrote to memory of 4796	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 556 wrote to memory of 4612	556	ljgaywqoli.exe	207
PID 1500 wrote to memory of 6936	1500	2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe	210

C:\Users\Admin\AppData\Local\Temp\2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_075b1cd03cb320024146e6ec83407f7c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff85322c188,0x7ff85322c194,0x7ff85322c1a0
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,16398830991980147284,2796133055669723689,262144 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
      4⤵
      PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,8046796874278801791,14418677665905414104,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:11
      4⤵
      System Time Discovery
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,4271518469265252019,7128908327290143579,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
      4⤵
      PID:6400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,2782735845774236022,6780155738491238820,2097152 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,834651587347318705,6571838037802315920,2097152 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,16983466118946302961,16767785254641798914,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,16160822510512154323,7641041667447850116,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,4042736616332061565,5904063474376655771,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,4042736616332061565,5904063474376655771,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,16552896070607920958,546018515248199017,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,5554854681248150733,7123846453754915028,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,16066611245158475392,375169004361941054,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,10702599633595065072,2914815863264527098,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,15843796776665962743,6049570849064178340,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,13241318518262976068,13096520571459562969,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,12505862906493217312,14614074692809802825,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,13816201935387443747,14792022384556822306,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:6828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,12103693095065112942,7403916998946420657,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6876,i,7746782493189122341,1930614605580661831,262144 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1352,i,25898430355917110,3064572794960363840,524288 --field-trial-handle=2500,i,14528214061841476837,4745222230578192787,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2732
- - C:\Temp\ljeywqojgb.exe
    C:\Temp\ljeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\i_ljeywqojgb.exe
    C:\Temp\i_ljeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoljgbywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3320
- - C:\Temp\wqoljgbywq.exe
    C:\Temp\wqoljgbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoljgbywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\i_wqoljgbywq.exe
    C:\Temp\i_wqoljgbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\nlfdyvqoig.exe
    C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5592
- - C:\Temp\i_nlfdyvqoig.exe
    C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqnlicay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\aysqnlicay.exe
    C:\Temp\aysqnlicay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqnlicay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Temp\i_aysqnlicay.exe
    C:\Temp\i_aysqnlicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxspkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1776
- - C:\Temp\nhfaxspkic.exe
    C:\Temp\nhfaxspkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxspkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1368
- - C:\Temp\i_nhfaxspkic.exe
    C:\Temp\i_nhfaxspkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxusmkhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Temp\czxusmkhfz.exe
    C:\Temp\czxusmkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxusmkhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6000
- - C:\Temp\i_czxusmkhfz.exe
    C:\Temp\i_czxusmkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcaupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\mkhcaupmhf.exe
    C:\Temp\mkhcaupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcaupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6304
- - C:\Temp\i_mkhcaupmhf.exe
    C:\Temp\i_mkhcaupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjgecwurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6544
- - C:\Temp\pjgecwurmj.exe
    C:\Temp\pjgecwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjgecwurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6928
- - C:\Temp\i_pjgecwurmj.exe
    C:\Temp\i_pjgecwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgebztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5852
- - C:\Temp\omgebztrlj.exe
    C:\Temp\omgebztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgebztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7048
- - C:\Temp\i_omgebztrlj.exe
    C:\Temp\i_omgebztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrlbvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6992
- - C:\Temp\ztrlbvtolg.exe
    C:\Temp\ztrlbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrlbvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5492
- - C:\Temp\i_ztrlbvtolg.exe
    C:\Temp\i_ztrlbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgaywqoli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4796
- - C:\Temp\ljgaywqoli.exe
    C:\Temp\ljgaywqoli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgaywqoli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6936
- - C:\Temp\i_ljgaywqoli.exe
    C:\Temp\i_ljgaywqoli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqlidavqn.exe ups_run
  2⤵
  PID:3768
- - C:\Temp\vsqlidavqn.exe
    C:\Temp\vsqlidavqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqlidavqn.exe ups_ins
  2⤵
  PID:6192
- - C:\Temp\i_vsqlidavqn.exe
    C:\Temp\i_vsqlidavqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfdxvpn.exe ups_run
  2⤵
  PID:4904
- - C:\Temp\vpnhfdxvpn.exe
    C:\Temp\vpnhfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfdxvpn.exe ups_ins
  2⤵
  PID:4636
- - C:\Temp\i_vpnhfdxvpn.exe
    C:\Temp\i_vpnhfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxsqkicau.exe ups_run
  2⤵
  PID:5132
- - C:\Temp\caxsqkicau.exe
    C:\Temp\caxsqkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxsqkicau.exe ups_ins
  2⤵
  PID:6632
- - C:\Temp\i_caxsqkicau.exe
    C:\Temp\i_caxsqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkeca.exe ups_run
  2⤵
  PID:4944
- - C:\Temp\hcausmkeca.exe
    C:\Temp\hcausmkeca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkeca.exe ups_ins
  2⤵
  PID:860
- - C:\Temp\i_hcausmkeca.exe
    C:\Temp\i_hcausmkeca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurpmhe.exe ups_run
  2⤵
  PID:2024
- - C:\Temp\jhbzurpmhe.exe
    C:\Temp\jhbzurpmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurpmhe.exe ups_ins
  2⤵
  PID:7140
- - C:\Temp\i_jhbzurpmhe.exe
    C:\Temp\i_jhbzurpmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhecwuomge.exe ups_run
  2⤵
  PID:2700
- - C:\Temp\jhecwuomge.exe
    C:\Temp\jhecwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhecwuomge.exe ups_ins
  2⤵
  PID:4068
- - C:\Temp\i_jhecwuomge.exe
    C:\Temp\i_jhecwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  PID:2864
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  PID:4204
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtqo.exe ups_run
  2⤵
  PID:5940
- - C:\Temp\trljdbvtqo.exe
    C:\Temp\trljdbvtqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtqo.exe ups_ins
  2⤵
  PID:3932
- - C:\Temp\i_trljdbvtqo.exe
    C:\Temp\i_trljdbvtqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdytnlfdyv.exe ups_run
  2⤵
  PID:1236
- - C:\Temp\gdytnlfdyv.exe
    C:\Temp\gdytnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdytnlfdyv.exe ups_ins
  2⤵
  PID:2380
- - C:\Temp\i_gdytnlfdyv.exe
    C:\Temp\i_gdytnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5760

C:\Temp\rojgbytrlj.sys
C:\Temp\rojgbytrlj.sys
1⤵
- Executes dropped EXE
PID:2208

C:\Temp\wqoigaysql.sys
C:\Temp\wqoigaysql.sys
1⤵
- Executes dropped EXE
PID:5216

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
- Executes dropped EXE
PID:6460

C:\Temp\axvpnhfaxs.sys
C:\Temp\axvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:3584

C:\Temp\khcaxvpnkf.sys
C:\Temp\khcaxvpnkf.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\pmkecxupmh.sys
C:\Temp\pmkecxupmh.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Temp\mjhczurmjh.sys
C:\Temp\mjhczurmjh.sys
1⤵
- Executes dropped EXE
PID:4672

C:\Temp\bzwjgbywur.sys
C:\Temp\bzwjgbywur.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
- Executes dropped EXE
PID:916

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\vtqligaysq.sys
C:\Temp\vtqligaysq.sys
1⤵
PID:1708

C:\Temp\dxvpnifays.sys
C:\Temp\dxvpnifays.sys
1⤵
PID:4132

C:\Temp\cxvsqkifax.sys
C:\Temp\cxvsqkifax.sys
1⤵
PID:3516

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
PID:5600

C:\Temp\khczxrpmhe.sys
C:\Temp\khczxrpmhe.sys
1⤵
PID:4092

C:\Temp\rmjhbzxuom.sys
C:\Temp\rmjhbzxuom.sys
1⤵
PID:6252

C:\Temp\ztrljebwto.sys
C:\Temp\ztrljebwto.sys
1⤵
PID:1592

C:\Temp\wtrljdbvtr.sys
C:\Temp\wtrljdbvtr.sys
1⤵
PID:4468

C:\Temp\ljdbvtnlgd.sys
C:\Temp\ljdbvtnlgd.sys
1⤵
PID:6872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axvpnhfaxs.sys

Path C:\Temp\axvpnhfaxs.sys
Size 141KB
SHA256 746bbfd7a99bfa4fc173b9e9ca3cf062d135f8444a92f60a7c5ecbbc96931be6
MD5 b94e35bb5af67179c2c9ae1d0fe27f2c
SHA1 977ea687b333347b9bca70c42c39cf1bc6e3eb32
SHA512 cd73e74a2510b7104abc0dced900ead548297b6c97f3ec1a4f6785d443888ddce221af77490d5126b2d9e136b825c8ed47b68a2a445e76779e7c370876447ff4
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkicavs.sys

Path C:\Temp\aysqkicavs.sys
Size 141KB
SHA256 a1303dab078a54d24770a3783918ea1215701c51e6b79c75d63b5e86fc24e252
MD5 fb9bd0f945419920df607810a830f3d5
SHA1 433d86d54d58f83b9929a81063a4b653977419de
SHA512 edb0fa05c93b6773581095a25e7c149091a7e60a3a4c942afbf8298838c4eb9dd4c250193bd8800d5e5de82291e7b4525cd4dddc7c403a3658e1d6b3c602500c
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13AE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqnlicay.exe

Path C:\Temp\aysqnlicay.exe
Size 226KB
SHA256 c6a8e56cc56d302701bee5b3ff02630b6d031b7ac1d8928762ef9f72c157381c
MD5 7b57f0c7181f6bd2d01e3aa96e9e9703
SHA1 3b73bc5e16a820684b7d8414b9728b7dd4edfe37
SHA512 1daa8a2661530058544d78a2ea329261ae96370c532fd354c6bb0d0d4103b74af4e32fcaf01d87097fcb6b6adcec51d4858c51c4e5e6caf15a0dcf1f0448e97d
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T14E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czxusmkhfz.exe

Path C:\Temp\czxusmkhfz.exe
Size 226KB
SHA256 f45683c581b8ef6f845be632cd38e1240e546b818bf843eb154ced76410eea63
MD5 d2702b242f1b4848b7a921905343dc9b
SHA1 4f43a63f5153aad01c35c7da45115603be747d54
SHA512 2339a0f223084307974f7a2a820185f6bb80679fc90b1d951b6a5aae35401ec8b38950ced4ec87859ce0d21fb55292dcc96874369b0f592722b8e59100036ddb
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T13734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqnlicay.exe

Path C:\Temp\i_aysqnlicay.exe
Size 226KB
SHA256 7451b5389965810232d41b3642cff1725573bc9281f8dc62987a74bc3c401b29
MD5 e0065860c739706b5ee725eafd2da131
SHA1 bd239a278a71175cc3bba6aba5dafa2f5acd74fc
SHA512 2d7d8cd98997e946856e92ce775474d7a314d5d0d7572b6927ac73aa37b6766f09d62f70691a686765529c2e43331dbdc63e071f81fdf19b17c214ca1576dca5
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T12F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxusmkhfz.exe

Path C:\Temp\i_czxusmkhfz.exe
Size 226KB
SHA256 c73d2fe805e0b161c38fb8b8afb0964967c43eb59ca25613ccfaa62cfc8f2bf5
MD5 24dfb3729c8a0a8fc1122afed7d91cb1
SHA1 437fad2e10ff2af75bb92277c78228a22a5e88f3
SHA512 789e64ff5083ef9a3871dcfc3296e1ff1ddbc84565333379d70f1a09eb5317762082dc789fbaf073825ddb78343539d9ba24191f3b42c64aa940f8c644a86ca9
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T16434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljeywqojgb.exe

Path C:\Temp\i_ljeywqojgb.exe
Size 226KB
SHA256 b8f2b299eb1c55389c617d329987744608ace5a3702777f33223b7ff557bdc30
MD5 ad8342d7ad43ceb7ba6706af80d390cf
SHA1 065d71ac256195e77876899cd04cadd538d861d7
SHA512 4b3c8e8decec2e503b4b93e679d2e86ce2a232c21f5f59c85fdd9bb4737885f0e95bd777598ce1233f8264a8947909ac5527e18364c315e00c606ae1184e8b1e
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T17634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfaxspkic.exe

Path C:\Temp\i_nhfaxspkic.exe
Size 226KB
SHA256 e5364bf7e434f4141fe3453a9923f4901ae4cd5f7b056a0af2432a925d13db47
MD5 1fad4541fee8354fdcb8bc08af87e12b
SHA1 d1ff4a7a1e34d8b2ecf360fa0e7f5249e7a512a1
SHA512 9dbad30220218baf0440c5678e9c643502cc58d2138e017f12a11adb988104a9a43041589abaf3d5aac5c2c80e1855bed937f97f6c0a32b91f2ce0efa45ea9fa
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T1F334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdyvqoig.exe

Path C:\Temp\i_nlfdyvqoig.exe
Size 226KB
SHA256 5826b4278137ac89c97ea73cf3bc5aa3ddb2bf6028bbfb41836dd10e6484c9c6
MD5 81c68fe9969203475a6fe6c6e76e585b
SHA1 f83914d987faa9b88489663d68b4c87adceb8af8
SHA512 5f79e5dbcd7970f3fb2b1829be42e2a51bb2fb61da2c9078e43ab052673f315904174422ae526089de34dce2f2467a1c6cf727d6ed0f92d7d5b34e6375eaa70e
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T12E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoljgbywq.exe

Path C:\Temp\i_wqoljgbywq.exe
Size 226KB
SHA256 07bfc8efca382056ad659f38665198112c7476214fc44bafa095bc0511c18a39
MD5 87876f06a3087a1e858f6a5b23b34d1d
SHA1 499fc2c426edca316bf2eb24f53a0dfdb36cd39a
SHA512 3df7f542b5a913c5226b4f90937c3a672fa05640417a898b41873b6cd354d89bc0c7d72109e2a35e007b42d70f9322c7dceca65a3e30af1c594546174505efe6
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1B234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcaxvpnkf.sys

Path C:\Temp\khcaxvpnkf.sys
Size 141KB
SHA256 2af1f694641be9191ee9fb6c4167bf709d1d73b4b721e9f55f8189006f383c8a
MD5 ab9985a6f1596c1234ab6b00d62180bf
SHA1 607c3951c267f6a7b25d72f82c42b8d13b709766
SHA512 e3400e1175c4d34952db055fbfbfe6083e86abb9a188c5758d4b68262b9d08537e087338ed680bd06cd4084391050478f5b4753d81636cc4bc29967b15467567
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljeywqojgb.exe

Path C:\Temp\ljeywqojgb.exe
Size 226KB
SHA256 db24cffd8df28104201345d2d1ed08826a75ede5a92a7221187a80cabed11c6c
MD5 025039ac47058f8f55c5a6b844740091
SHA1 edae08208acd9c2ef00a8a22a853b72281af4a92
SHA512 7431a1af74888ff407daddb3aa51321ee06dcbf080a7fbe8c200a7e1f269b8abe9d23b9444c5ebc1959c309ee94e3310673fc6247d8709dc80e60491f1bba882
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T11F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhcaupmhf.exe

Path C:\Temp\mkhcaupmhf.exe
Size 226KB
SHA256 b16b7e378b0c0f643c1642a19540c9a3d0fa53d571bfdcfcbf2765ee9159e1f8
MD5 f66401f7e59992a195079a2886f94590
SHA1 5b83b3bb286cf6f1d52efeae7dbd3b4b1816a40f
SHA512 b543579545f9ab60cf92705926d885fb8a4662935e1d909e8d7ac352c6943147fd9b8f4f792d8c8616364352caf97f753aaa601c72e0910cda085618513f72dc
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T15E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfaxspkic.exe

Path C:\Temp\nhfaxspkic.exe
Size 226KB
SHA256 815f3d35bb41dc628e82c6176a7ee82d7efe94f737fb6731c43e085919c889ef
MD5 31f60a813b1bd93f72910151aeabc1c8
SHA1 56e5d92cfb1e6904ce40f69721d5cd5e6edc4976
SHA512 e86f556c0e5c9b4047806cd78e186df610452f509b2c72c1067bf9aff26bbb0517e3eded6f389b523f4ddab61c4ef1d035031bf7ff10eca93b74258ff4a0a4e7
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T19B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvqoig.exe

Path C:\Temp\nlfdyvqoig.exe
Size 226KB
SHA256 3b21a910374a2af1335ed75fc1dd689a8a5f419d51b534928aa90ebe23314b5e
MD5 b0f7f745b27802e97fcc467e7e925c3a
SHA1 43e7ccac241377743118ad7e89bfaf1c31c007d5
SHA512 f83d95edfb918f86195072a097b686057f4d047d93465ad2457014a3cadc3c12e30ff0489b627298e745b64c353ece2709e0ff4a2402ec6bc7c4ce53858b825c
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1EC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkecxupmh.sys

Path C:\Temp\pmkecxupmh.sys
Size 141KB
SHA256 0edefb3989ffa885b5ec2a9fb10b055446777c868ff7d213a9123f41c368cd9f
MD5 20d1760f0a17b00cace4a85919e40845
SHA1 7bbd7294b926db7b9c15f8d1d654ddb014139890
SHA512 3bef351f6ea0cb964bc613c0b14d97c2cc89ca444c1708ae45d61eca15bb5dfeff531b001c2ff99511417340fb7fcefec4ebdb8bc06dcfff0483ea3ae6a30ae3
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbytrlj.sys

Path C:\Temp\rojgbytrlj.sys
Size 141KB
SHA256 32c187ebb995e17bba789c462ebf7be2eda2941b577598191a59e421a010d685
MD5 602df067d7359bd380765303c16043d0
SHA1 17fe00eeb5b11cca7e13efa5e571a928629f7741
SHA512 5e4225191dc0e0f82c2972b83d8c492c5f660591aadab53567ee1d6594f447be1af90c66396d03dbf4b5bd6e11d05185b1546321d99a42aa807d53206f02a950
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1B0E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigaysql.sys

Path C:\Temp\wqoigaysql.sys
Size 141KB
SHA256 0b31613aa560751880f037a0ae89170ee3c769cc8547b59685f53d140c12ca90
MD5 f1cb3e58edca26866094e52ed93858b7
SHA1 d1d9662de9d150b3cb667473311efb5b4375f3b4
SHA512 4fe172d0d07b7a99d13f16377417978f80e1b2d00677efc2849792258b5f6f999c812f028fef28082e6fe2eae839a1f1c69a4093610c9798de22651f184aab38
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T15FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoljgbywq.exe

Path C:\Temp\wqoljgbywq.exe
Size 226KB
SHA256 3bc45aaf2fcc437e520723acecd828358493d3196dcade987793c7f365115d06
MD5 96f8ac5a9e9297f76d783958906dc295
SHA1 ed6e0da209cbcd1d658092cf3d05c27f539597cd
SHA512 0374c1ddef87dd408266268f064d8d9a082047734389ec7a8cc7e17093d0347170b1a7b61bb813b6ae534f190833fe3bd63ba47fc60b6e32ed5f720e9a9596d9
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 feaf267a4f389a4c76b40511adfa61064fd0f4dbc9fa96c1684ab36590e80c12
MD5 08a741aee5e9dfce33eefe3f8239232b
SHA1 bf807f1685e566f8449090b14c1e54fd1f9d9846
SHA512 545f0ad489971c02063a8f6c6fe0d85f0cdf18217e519cf71e330d96fa666581a723f2138516e5acf4d22f068cdcdba8191ebdb519dc804ab69d4782f1ff925d
TLSH
T113E0E595C921B8375DFC1B28A155064BE740232B3A41884F3B3C912D4FF0637428685C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9dcf996013498443b61374763afea6072636bef6f31a08308a4ab0f7a1e26cfc
MD5 b12d1cb1fa7cde2dac8a594b5649b90d
SHA1 529551ec8ce43156db8db7e0bd1e314ed26d71eb
SHA512 9cb0ee58739764e2d9c46f30b6aa268ed1c790bf77b366d6b2cf05eb712fbfa5be4cee7850fc0f70095e7ecc8ee0caec6c3c8bf549119451dddb1a99e1d6b1b2
TLSH
T1BC41C0F783F8856ECA1195F0AA186E1FCE1D0511432C7D9AC9E4AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 612567d36cd516626c5bfa4dc3b9d3e0dd5d4098775385e4da067683ca90aa7e
MD5 a2a7070e09151ed7dca9d4cc58533832
SHA1 9a4535160d130b798fd8a3bd854fd2c5aef5fec7
SHA512 72ab0d94f4893d11dc2a1d633370b8c851e14ac7d9e2441f400cd9f437c7eb8a73696c385e74119b9e7d135aba8e98e20f8878a8d40229c8ecaf4849c28a4b44
SSDEEP 384:sxRO3qQA/f9sd5N/RI6W2/5i/WGksGQg2eY:syaQA/f2bWu/5YWGksGQgS
TLSH
T13872C615AA249D7B8CDBE619FA957F93D2F91173A1905E44AAFC8A0C00E77DD210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8a8757902c4f462e673b19ca9ad4d4c44089bb8696124d3731592971db99e63c
MD5 225798c955285aa0cb0c5bb435458bbc
SHA1 dc6a023bf1b0a8e46bcc0af48005e7d05a8c9ad7
SHA512 aadc0d8cc29832a33ca0aeec8ebdeb2e7b28953dddf9f533fbcae1fc80305d01ef2b35a2ebaf586f3c19dc347ab75af35f2763268d552ca0c3c868da36baf12a
SSDEEP 384:sxRO38A/f9sw4N/RI6W2/5i/WGesGQg2jp:syMA/fTiWu/5YWGesGQgW
TLSH
T15772D715AA249D3B8CDBD219FA957F93D6F91173E1905E44AAFC8A0C04E77EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ea9f290a1135c9ec1a979a33ae182b21ee12c0eb907e77c4ce112a94e309afda
MD5 fd9c65853d1aac6556af2c49296021d9
SHA1 e134c9f4c99fd8e5fd4da5304f62f188b85aa0fa
SHA512 64e46aab7215456c1d79d1f3fcf480bae99b24c5ed497b4cf3168bd5d1e458d8817158204e7e8818e73b58209621750923cab0b78a4d265dbd63fd573a62e98c
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZobbDwzrol4F:Ob4YZnE7yTWg1NfwBu1jaCobHwAaF
TLSH
T1CCE2FC3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8f3a6579b6d8dad1e22be5ecdda6c521dccac77ee84c107fc79dd7ce6f0a7ee4
MD5 06de58c50654fde3898f2ea49974acac
SHA1 0379e1212e5782336738f527c51eb6fec02ef8cb
SHA512 76257761974c78eb74fced0a92f26dc7b575de392e6f4251b7c473f7ad8879ee1c0a2056bc264713863337d5d6e7d6e3022e0f1a123e9b1dd09990703bf1f6eb
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9PLz:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRu
TLSH
T1F3B24C11753F4680387EA90C91B8D82F86C2B4637519E53F7BA801A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 36aa7501d5b6cdb6b0312b2ad0e05191015d4d7c813ee9e923db1fbd8ced506f
MD5 a80288602bdfb0482d3f0e75cc9527a1
SHA1 04be52a164ebed2e2e3b1b96a7f9a7cb7cb75514
SHA512 b72724d01cbf83005882ac30ff8244f60127c15338d6158b5fc85e7ace1317064a9df949cf9634838eb80ab7ed9e85898dc9eaed83525f00dccef3f4238c4ffb
SSDEEP 384:nBiFiZcIt8NLj8TUNTUlIRKPvuTLdfEqfbzGYrUCzVwp+F8AxivtUV8LEEIzYoX:oFQtQjwgEulFGoFzV8ePxiLQ
TLSH
T122E2A2F198D78972D8EE8B87673D6D469AFCD163B4888584B7C44D0CCC862BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 062bf509e7c49b194da326f53f72e1d333e6bd04c393145ea4d4a574f74b55cc
MD5 d72e6218ef28ade000ee9b37290c4a6f
SHA1 9a3b75efbfb571457041d3949e22a54e15658bbc
SHA512 9fa990cdff5d0c9f686a421115586cc2d028e15469dbcb373e417e84b72d5d8fa0b4dc8d77eac86d47c6696e7523f56c74cbfa5137ce830ab82f97e17300bcb4
SSDEEP 384:njiFiZcIP8NLj8TUNTUlIRKPvuTLcfEqfbzGYrUCzVwp+FFoxivtUV8LEEIzYoX:OFQPQjwgEuUFGoFzV8e6xiLQ
TLSH
T1DDC24B31DCA4CDB7ACEA8BD4A74A7646EFE05163C9CC9AC4E9D85E1C00872DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 56c008c6c9cb7c9dd86375973b264bfbacba8c86a9c23ffd4c583ce5299feffa
MD5 2c20ce9f586c7b3f249946a7660a398d
SHA1 ba697b084238368ad327c55b5a8787f8db9bf205
SHA512 1f2f0036844ca6246e15fe574f599cfc08fb794291336e0201ab57b582135cc5227601c4d4d4a6d7d8433e8d203fd8f59b5ae7e81c7025565f3581022e18fdcc
SSDEEP 384:n3iF1tNn/s3n9Sn8Ngo8TUNTUlIRiPvuTuCREqfbzGYrUCzVSxLJOObjI9G6w70S:yF1j+9SXowgUudXGoFzVStJ29M0S
TLSH
T1E7C25B32DC55CEB7EDEA4FD8B74A3A56EEE0126785DC5AC4EAC85E4C00C729D430781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e6bb6b3fe52d1407c0e6c6feffa5e2962e0beee139e9e22f91b3436c872b950f
MD5 8b69ca4b77ec7ddca05cf0426268bde2
SHA1 c6c8f6948efc5d0f717c1330f7437d5328993f1b
SHA512 03502594ba44bc53690fefcf6505e09e198d25110ccae2bd5f0a005b8d7d284d42218fa56fcc760521f5ffb4a40edbb439983a81b09d251589238610e1e163ff
SSDEEP 384:nAiFiZcIP8NLj8TUNTUlIRKPvuTLcfEqfbzGYrUCzVwp+FFoxivtUV8LEEIzYoX:bFQPQjwgEuUFGoFzV8e6xiLQ
TLSH
T1F4C24B31DCA4CDB7ACEA8BD4A7497646EFE05163C9DC9AC4E9D85E1C00872DE170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf9b0a4e35fa78cd63afc13e84f09669e477f559ac833edde14e671e99aadb03
MD5 798900a17c6af54f8380a423128be788
SHA1 27b411f6b7122f07bc9340ffa6b5cf5bd3b052a8
SHA512 7004bce1cbefebada948f7d785914c799697619c8a0d8bd4ed800c056583d6e87576cb4c3c8afcd42c4130a9c8f00b585dcff7d35f571808f4f15095e0806d73
SSDEEP 384:n7iF1tNn/s3n9Sn8Ngj8TUNTUlIRiPvuTv0fEqfbzGYrUCzVwp+FFkxOObjI9G62:WF1j+9SXjwgUu4FGoFzV8eax29M0S
TLSH
T1E2D25C32DC55CEB7ECEA4F94B74A3696EEE0126389DC5AC4E6D85E4C00C729D070B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c474053a6237ce5e376d4c53d197e00e903cc86f6f9f92460a7677c92a471abf
MD5 d33d94687b9ced6e08797bc94679bcc3
SHA1 43aee219910ee64743ea619ff56db7f757833830
SHA512 a517a48f924237888d7cb90c8cf35bbf5d8962144fb418edc23aef7d373885a381beab6b05dcea3bb3b450df29f9517b3c43de8d12d6efa2334a604707275bb6
SSDEEP 384:nAiF1tNn/s3n9Sn8NLj8TUNTUlIRn2PvuTvcfEqfbzGYrUCzVwp+FFkxivtUV8Lr:bF1j+9SQjwgNGugFGoFzV8eaxi5
TLSH
T106C23B31DC55CDB7ACEA8FD8A70A7646EFE0516388CC9AD4E9D85E5C00C729E170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 63e36b77e100c5c24b95c0e6a50373d8df13ec37520bc17987a5de9aec958345
MD5 e4ddf28c58b4757d4a14c04e8ec2ebf6
SHA1 19798cc092c3ee38a727c38d5a8e93f9fc2e6e8f
SHA512 38c1654a83af49fde1bb9f841b8d7f88a64eba9b3cf84913a9f0975a536075a6d9dfcbb214b4118858bfb65097487d8341249ecec16cb6d13aa218efcd83eece
TLSH
T1D0511FE04C3C1AD1D5FD0E7EB08739FC95EC9726F8A434386858E998596A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f7edb8e54884795a399cf363b08025af7a10f0a9e9c48c87854a53534b72072a
MD5 6afaf2c6a06041dbc126d4d845923690
SHA1 abca841a40f03e80b0fe881dcc99787623e80af6
SHA512 5e79322c7342aa79d04b2b260bd0d2aefd014a02f582524bf394b2d2864d1c03d374236e83a6fda7af77ba775e7dc37e002340410b733c52d8ef4197226e3449
TLSH
T1E8512DE04C3C1AD1D4FD0E3EB09739FC95EC9626F89434386859EA989A7A61D309083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/916-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/916-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1592-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2208-148-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3516-593-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3584-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-588-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-534-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5216-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-614-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6252-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6460-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6872-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download