01bd66c9c9a128b25026baf01a7f7de004cf0b7b035cc0488c298f81aecea3e3

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260822-232nsazhmf
SHA256 01bd66c9c9a128b25026baf01a7f7de004cf0b7b035cc0488c298f81aecea3e3
MD5 da68d9d4892a4d79ffabd091f5eb0ff2
SHA1 f203fda2a616503cc41f3195f434ab3913c5bb75
SHA512 13c5c639c078d36b5d4a6fb717b817647f13a706a844622162a66a46f1409072189e018377bba9e70767e3d4fdeab98bed61efbe8638550094dac482ae6266aa
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T1CF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
900	CP.exe
928	xupnhfausm.exe
2508	CP.exe
4592	CP.exe
1784	i_xupnhfausm.exe
1740	cwupmhfzxu.sys
4880	CP.exe
4288	zurpjhecwu.exe
1056	CP.exe
1532	CP.exe
1416	i_zurpjhecwu.exe
1536	zusmbzwuom.sys
4516	CP.exe
5680	mgecwuojhb.exe
5376	CP.exe
4112	CP.exe
2760	i_mgecwuojhb.exe
4348	rmjecwuomg.sys
4664	CP.exe
3800	ljetrojgeb.exe
3628	CP.exe
3500	CP.exe
4564	i_ljetrojgeb.exe
3028	rljebytqol.sys
1680	CP.exe
2092	mjdbvtolge.exe
5116	CP.exe
1472	CP.exe
3352	i_mjdbvtolge.exe
1416	igaytqljdb.sys
3872	CP.exe
1500	igaytqlidb.exe
5224	CP.exe
2140	CP.exe
4156	i_igaytqlidb.exe
5824	idayvqnlyv.sys
1588	CP.exe
892	vsqnlfdayv.exe
3428	CP.exe
560	CP.exe
3704	i_vsqnlfdayv.exe
1740	pnlicavsnl.sys
2056	CP.exe
4920	vsnlfdxvpn.exe
2916	CP.exe
1276	CP.exe
6076	i_vsnlfdxvpn.exe
2852	faxsqkicau.sys
3676	CP.exe
2004	fzxspkicau.exe
4848	CP.exe
3788	CP.exe
2976	i_fzxspkicau.exe
4480	uspkhfzxrp.sys
5576	CP.exe
4348	pjhecaurpk.exe
4488	CP.exe
916	CP.exe
4832	i_pjhecaurpk.exe
808	zwupmhfzxr.sys
6076	CP.exe
2076	pmhezwrpjh.exe
4688	CP.exe
4568	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_817271896\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5552_505216772\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_706413925\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_149323853\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_1105678429\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_1105678429\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_817271896\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_1105678429\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5552_672280778\_locales\kk\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecwuojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqnlfdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljetrojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxusmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhecaurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecwuojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqnlfdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzurmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljetrojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhecaurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzurmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdyvqniga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5492	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5340	ipconfig.exe
5688	ipconfig.exe
3876	ipconfig.exe
2164	ipconfig.exe
2424	ipconfig.exe
4536	ipconfig.exe
968	ipconfig.exe
1724	ipconfig.exe
5848	ipconfig.exe
1292	ipconfig.exe
5484	ipconfig.exe
5428	ipconfig.exe
5688	ipconfig.exe
4332	ipconfig.exe
2052	ipconfig.exe
2612	ipconfig.exe
4380	ipconfig.exe
4060	ipconfig.exe
2712	ipconfig.exe
5544	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319136402499758"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{1E74B1F6-0213-47D8-9D56-C3AC4D409A62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe
5552	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	i_xupnhfausm.exe
Token: SeDebugPrivilege	1416	i_zurpjhecwu.exe
Token: SeDebugPrivilege	2760	i_mgecwuojhb.exe
Token: SeDebugPrivilege	4564	i_ljetrojgeb.exe
Token: SeDebugPrivilege	3352	i_mjdbvtolge.exe
Token: SeDebugPrivilege	4156	i_igaytqlidb.exe
Token: SeDebugPrivilege	3704	i_vsqnlfdayv.exe
Token: SeDebugPrivilege	6076	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	2976	i_fzxspkicau.exe
Token: SeDebugPrivilege	4832	i_pjhecaurpk.exe
Token: SeDebugPrivilege	4580	i_pmhezwrpjh.exe
Token: SeDebugPrivilege	968	i_xrojgezwrp.exe
Token: SeDebugPrivilege	808	i_bwtomgeywq.exe
Token: SeDebugPrivilege	2712	i_ywqoigbytq.exe
Token: SeDebugPrivilege	5688	i_dxvtqligay.exe
Token: SeDebugPrivilege	1336	i_ifdyvqniga.exe
Token: SeDebugPrivilege	3424	i_lfdxvsnkic.exe
Token: SeDebugPrivilege	4404	i_hfcxusmkic.exe
Token: SeDebugPrivilege	3220	i_hfzurmkecz.exe
Token: SeDebugPrivilege	1800	i_uomkecwurp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 3656	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3656 wrote to memory of 5552	3656	iexplore.exe	90
PID 5552 wrote to memory of 4628	5552	msedge.exe	91
PID 5552 wrote to memory of 5492	5552	msedge.exe	92
PID 5552 wrote to memory of 5780	5552	msedge.exe	93
PID 5552 wrote to memory of 5780	5552	msedge.exe	93
PID 5552 wrote to memory of 5276	5552	msedge.exe	94
PID 5552 wrote to memory of 5276	5552	msedge.exe	94
PID 5552 wrote to memory of 5276	5552	msedge.exe	94
PID 5552 wrote to memory of 5316	5552	msedge.exe	95
PID 5552 wrote to memory of 5316	5552	msedge.exe	95
PID 5552 wrote to memory of 5316	5552	msedge.exe	95
PID 5552 wrote to memory of 2920	5552	msedge.exe	96
PID 5552 wrote to memory of 2920	5552	msedge.exe	96
PID 5552 wrote to memory of 2920	5552	msedge.exe	96
PID 5552 wrote to memory of 5828	5552	msedge.exe	98
PID 5552 wrote to memory of 5828	5552	msedge.exe	98
PID 5552 wrote to memory of 5828	5552	msedge.exe	98
PID 5552 wrote to memory of 5976	5552	msedge.exe	99
PID 5552 wrote to memory of 5976	5552	msedge.exe	99
PID 5552 wrote to memory of 5976	5552	msedge.exe	99
PID 5552 wrote to memory of 1548	5552	msedge.exe	100
PID 5552 wrote to memory of 1548	5552	msedge.exe	100
PID 5552 wrote to memory of 4328	5552	msedge.exe	102
PID 5552 wrote to memory of 4772	5552	msedge.exe	103
PID 5552 wrote to memory of 4328	5552	msedge.exe	102
PID 5552 wrote to memory of 4772	5552	msedge.exe	103
PID 5552 wrote to memory of 5864	5552	msedge.exe	105
PID 4132 wrote to memory of 900	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 928 wrote to memory of 2508	928	xupnhfausm.exe	110
PID 5552 wrote to memory of 2156	5552	msedge.exe	114
PID 5552 wrote to memory of 2156	5552	msedge.exe	114
PID 5552 wrote to memory of 5536	5552	msedge.exe	115
PID 5552 wrote to memory of 5536	5552	msedge.exe	115
PID 5552 wrote to memory of 4648	5552	msedge.exe	116
PID 5552 wrote to memory of 4648	5552	msedge.exe	116
PID 5552 wrote to memory of 4332	5552	msedge.exe	117
PID 5552 wrote to memory of 4332	5552	msedge.exe	117
PID 4132 wrote to memory of 4592	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4132 wrote to memory of 4880	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4132 wrote to memory of 1532	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4132 wrote to memory of 4516	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5680 wrote to memory of 5376	5680	mgecwuojhb.exe	133
PID 4132 wrote to memory of 4112	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4132 wrote to memory of 4664	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3800 wrote to memory of 3628	3800	ljetrojgeb.exe	142
PID 4132 wrote to memory of 3500	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5552 wrote to memory of 3532	5552	msedge.exe	148
PID 5552 wrote to memory of 808	5552	msedge.exe	149
PID 5552 wrote to memory of 1716	5552	msedge.exe	150
PID 4132 wrote to memory of 1680	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 2092 wrote to memory of 5116	2092	mjdbvtolge.exe	155
PID 4132 wrote to memory of 1472	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4132 wrote to memory of 3872	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 1500 wrote to memory of 5224	1500	igaytqlidb.exe	164
PID 4132 wrote to memory of 2140	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4132 wrote to memory of 1588	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 892 wrote to memory of 3428	892	vsqnlfdayv.exe	173
PID 4132 wrote to memory of 560	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4132 wrote to memory of 2056	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 4920 wrote to memory of 2916	4920	vsnlfdxvpn.exe	182
PID 4132 wrote to memory of 1276	4132	2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5552 wrote to memory of 2652	5552	msedge.exe	187
PID 5552 wrote to memory of 2652	5552	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_da68d9d4892a4d79ffabd091f5eb0ff2_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x31c,0x7ffd6c62c188,0x7ffd6c62c194,0x7ffd6c62c1a0
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,4622337058157856014,17841200929896946581,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,14205652708309149824,9588294895435742569,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,11926165701829676321,6682008417249297746,262144 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,15471619891074160021,11315040133940307226,2097152 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,12801607036222605279,3518827334798511120,2097152 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,15342258298230276280,14608887053618813274,2097152 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,9516883739776402572,8866365989214860476,2097152 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:9
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2380947623714399808,12510038146507506191,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,3811483727590514833,11317691417385795502,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,13466329066239533878,5547932651749718614,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8114714205631401147,10668219958849207245,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,8114714205631401147,10668219958849207245,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,7358101121858038783,4374568991141836375,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,12441943485581653379,9623767123979323655,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,18256967402450030210,9609259024088492889,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,6766497004191144874,13672442747467224595,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,14506555575903642226,11971367556875671984,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16945799612888774786,8406464178840648649,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14750188328867075081,1020675666701764408,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,10807024077360823650,6121289912401575680,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2692145508021768530,9037532460307819253,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,2669958515363657652,8396533661549684904,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=896 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,16244119800903211963,3336878653343482165,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6812,i,17563276485566900157,16708726373021005504,262144 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10561310653383387008,7682783592300091167,524288 --field-trial-handle=2320,i,17034439665868636036,2050682222159545970,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfausm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:900
- - C:\Temp\xupnhfausm.exe
    C:\Temp\xupnhfausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\i_xupnhfausm.exe
    C:\Temp\i_xupnhfausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpjhecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\zurpjhecwu.exe
    C:\Temp\zurpjhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpjhecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Temp\i_zurpjhecwu.exe
    C:\Temp\i_zurpjhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgecwuojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\mgecwuojhb.exe
    C:\Temp\mgecwuojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgecwuojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\i_mgecwuojhb.exe
    C:\Temp\i_mgecwuojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljetrojgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\ljetrojgeb.exe
    C:\Temp\ljetrojgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljetrojgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3500
- - C:\Temp\i_ljetrojgeb.exe
    C:\Temp\i_ljetrojgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\mjdbvtolge.exe
    C:\Temp\mjdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Temp\i_mjdbvtolge.exe
    C:\Temp\i_mjdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3872
- - C:\Temp\igaytqlidb.exe
    C:\Temp\igaytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_igaytqlidb.exe
    C:\Temp\i_igaytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqnlfdayv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\vsqnlfdayv.exe
    C:\Temp\vsqnlfdayv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqnlfdayv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Temp\i_vsqnlfdayv.exe
    C:\Temp\i_vsqnlfdayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2056
- - C:\Temp\vsnlfdxvpn.exe
    C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Temp\i_vsnlfdxvpn.exe
    C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3676
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhecaurpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5576
- - C:\Temp\pjhecaurpk.exe
    C:\Temp\pjhecaurpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhecaurpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:916
- - C:\Temp\i_pjhecaurpk.exe
    C:\Temp\i_pjhecaurpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\pmhezwrpjh.exe
    C:\Temp\pmhezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\i_pmhezwrpjh.exe
    C:\Temp\i_pmhezwrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrojgezwrp.exe ups_run
  2⤵
  PID:2976
- - C:\Temp\xrojgezwrp.exe
    C:\Temp\xrojgezwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrojgezwrp.exe ups_ins
  2⤵
  PID:952
- - C:\Temp\i_xrojgezwrp.exe
    C:\Temp\i_xrojgezwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:2568
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:756
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytq.exe ups_run
  2⤵
  PID:880
- - C:\Temp\ywqoigbytq.exe
    C:\Temp\ywqoigbytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbytq.exe ups_ins
  2⤵
  PID:6052
- - C:\Temp\i_ywqoigbytq.exe
    C:\Temp\i_ywqoigbytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvtqligay.exe ups_run
  2⤵
  PID:1408
- - C:\Temp\dxvtqligay.exe
    C:\Temp\dxvtqligay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvtqligay.exe ups_ins
  2⤵
  PID:3256
- - C:\Temp\i_dxvtqligay.exe
    C:\Temp\i_dxvtqligay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdyvqniga.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\ifdyvqniga.exe
    C:\Temp\ifdyvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdyvqniga.exe ups_ins
  2⤵
  PID:4564
- - C:\Temp\i_ifdyvqniga.exe
    C:\Temp\i_ifdyvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvsnkic.exe ups_run
  2⤵
  PID:4480
- - C:\Temp\lfdxvsnkic.exe
    C:\Temp\lfdxvsnkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvsnkic.exe ups_ins
  2⤵
  PID:2604
- - C:\Temp\i_lfdxvsnkic.exe
    C:\Temp\i_lfdxvsnkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcxusmkic.exe ups_run
  2⤵
  PID:2396
- - C:\Temp\hfcxusmkic.exe
    C:\Temp\hfcxusmkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcxusmkic.exe ups_ins
  2⤵
  PID:3088
- - C:\Temp\i_hfcxusmkic.exe
    C:\Temp\i_hfcxusmkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzurmkecz.exe ups_run
  2⤵
  PID:2532
- - C:\Temp\hfzurmkecz.exe
    C:\Temp\hfzurmkecz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzurmkecz.exe ups_ins
  2⤵
  PID:5432
- - C:\Temp\i_hfzurmkecz.exe
    C:\Temp\i_hfzurmkecz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomkecwurp.exe ups_run
  2⤵
  PID:1240
- - C:\Temp\uomkecwurp.exe
    C:\Temp\uomkecwurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomkecwurp.exe ups_ins
  2⤵
  PID:1420
- - C:\Temp\i_uomkecwurp.exe
    C:\Temp\i_uomkecwurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3068

C:\Temp\cwupmhfzxu.sys
C:\Temp\cwupmhfzxu.sys
1⤵
- Executes dropped EXE
PID:1740

C:\Temp\zusmbzwuom.sys
C:\Temp\zusmbzwuom.sys
1⤵
- Executes dropped EXE
PID:1536

C:\Temp\rmjecwuomg.sys
C:\Temp\rmjecwuomg.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Temp\rljebytqol.sys
C:\Temp\rljebytqol.sys
1⤵
- Executes dropped EXE
PID:3028

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
- Executes dropped EXE
PID:1416

C:\Temp\idayvqnlyv.sys
C:\Temp\idayvqnlyv.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\pnlicavsnl.sys
C:\Temp\pnlicavsnl.sys
1⤵
- Executes dropped EXE
PID:1740

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
- Executes dropped EXE
PID:2852

C:\Temp\uspkhfzxrp.sys
C:\Temp\uspkhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\zwupmhfzxr.sys
C:\Temp\zwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:808

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
PID:4152

C:\Temp\bwtrojgbyw.sys
C:\Temp\bwtrojgbyw.sys
1⤵
PID:1020

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
PID:4700

C:\Temp\lgdyvtnlig.sys
C:\Temp\lgdyvtnlig.sys
1⤵
PID:2424

C:\Temp\qnigdyvqoi.sys
C:\Temp\qnigdyvqoi.sys
1⤵
PID:1156

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
PID:2708

C:\Temp\hfcxusmkic.sys
C:\Temp\hfcxusmkic.sys
1⤵
PID:1228

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:4528

C:\Temp\urpjhbzurm.sys
C:\Temp\urpjhbzurm.sys
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhfzxu.sys

Path C:\Temp\cwupmhfzxu.sys
Size 141KB
SHA256 e467319d9e8fd76837705840712f1cadb18a7e6da88bde5924ac19710d25987a
MD5 1212b2357b7f67e4299c643106a0efc0
SHA1 694f4ded388fbf6a202907b6a208a53c902c1582
SHA512 60669537e6310fb52e91bdbc7bae24b4f55529a6b66fbf61f2e6386776854b002e5f6248977aafbb436d3e102bf0f9acef10fb03af7451a820803389192a043e
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaytqlidb.exe

Path C:\Temp\i_igaytqlidb.exe
Size 226KB
SHA256 84010844357f61989a5e873ce5382afca6531ab2c48ffcb339cc7c7adbbee3b7
MD5 509b14cedc83b6601349e10e0bb866b9
SHA1 9a17e4136fe52910f2503baeb491a55bf24cbaee
SHA512 7644189e47d11e21a41673f6e86d786e1c256b1a9bd033a5f1ecbd498389406292cb0a15bbd2a217af4b8f8d2f8b175011983974f4bccc160e0a8f825f082f4f
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T15C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljetrojgeb.exe

Path C:\Temp\i_ljetrojgeb.exe
Size 226KB
SHA256 f9bcc7dc88c6b209994aad96198e84edb28d8ecd857b78c93b2572c3ebffbd63
MD5 badc1308de2f7dd59bc52fad14316843
SHA1 b35d354f85a0d2f9164cc40242cf553a52554ca6
SHA512 4e6b1bcb3dcfb17d016a47f5d4640b54b1de12e8cf7cdeaefcd3c17e8257845fde0eca48909657d78162c0e698a71ed632aab9c6a190da53de71e7384b6fe847
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T13C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgecwuojhb.exe

Path C:\Temp\i_mgecwuojhb.exe
Size 226KB
SHA256 d75768ea8ecff3b9554b1c799edf433b1af30253f6b636305ad17920cf7e350e
MD5 4e617e4b711a86f3c3c3bc8453e715e0
SHA1 f3356d16b64f0f17c41a7caf0fdfcdd5ca0241e2
SHA512 bd239fff9939b4c4ebb55d4a92658b7e75775af84871f13208c8d8b9a4cc8d8f2c9d1721697d058e05743c610e1f1ec70492aa6f008930b58d860c14877462f6
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjdbvtolge.exe

Path C:\Temp\i_mjdbvtolge.exe
Size 226KB
SHA256 c3c5acf5de37fc5b83e6389bc470c1a46c5254c6ed1d6f9662a9bf13fa0a0ff3
MD5 e01c3cdb9d722c761103c4b473c0a44b
SHA1 3381379a4d6176814a1d6da6b673d62acbea292c
SHA512 7b9f7cc48de7a23a3e6062247a23b054136c6dab6e26bb89fbfe68db2e9a50a0d5d504e769f69196aa7b7064d74749698eddc3b9d4eae9916adfd05dd55934aa
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T1C334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupnhfausm.exe

Path C:\Temp\i_xupnhfausm.exe
Size 226KB
SHA256 76336db1a78bb4ccae0c134bb6ece4aa25e2438ea864635c9dc9870bfa1a3715
MD5 8cdba5fa91d77de79557105f6e238faa
SHA1 11363930b21433e1e2113bd985c78cb353908452
SHA512 151c5304de65f10a72a3f2cab30c2f13c6384e4325b474c09dce4a861e9db26d876c2288d8485c1699dc2d05267d7dd0ebb792ec06a3fb4feb64d220ac32899a
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpjhecwu.exe

Path C:\Temp\i_zurpjhecwu.exe
Size 226KB
SHA256 c8d0bcabaf499736b1a7f81f51eb943bf1fc558423346a3a30d76c90e56c0527
MD5 1789322b211a8865c4c28d40e02c54c1
SHA1 66bbc44863f4a0df232c57304042867b838b206c
SHA512 f1c93ba5d89013174e867e1b6c5d7335e700435dcbcf06b4b7d2a0de6811816d3ab2c4c5ac76f7a9bcc64ffb2b3eb0f09447cbe6c0490c2a726069a6c81c4c4b
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlidb.exe

Path C:\Temp\igaytqlidb.exe
Size 226KB
SHA256 5ae945d25a27826ebf3da414bf75f1c6f29d5b80db7f16b69b3e9cc4c59c8c46
MD5 d836a85e39f93704b20fc7d674bf5a8c
SHA1 fd94e3afb46dc7e495340dfb9036b7f13e100931
SHA512 b349606a31b0b8569b59772a07073ae676c78d864dddefc6e7fb8acd3e77d0331d2dfa750460227e16e1589300a2ad6222c2cee5d5b48d381a7b2668d452b178
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T1E034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqljdb.sys

Path C:\Temp\igaytqljdb.sys
Size 141KB
SHA256 112ebdd07e0a452b61d4ca607df7fe4e4a490b25960c72d4bd2860ebc7bda508
MD5 c73c92aa5b60ac4709203545a47a09fc
SHA1 01d47da6c302e4c71d0450e35f0b604022b01642
SHA512 deab5cfb2c8bc0d18d619a92513a367208e99d13d8f1bb42dd5ee2d885b7c4653492d0524ac1d2cf91ef7b7e1bd8ac42b39910247a488b4b6a93d70044e6383a
SSDEEP 1536:Aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljetrojgeb.exe

Path C:\Temp\ljetrojgeb.exe
Size 226KB
SHA256 d34b08d249731b5ffd78668b6eb3b9ce0c213bf35e5179fef5adf58e5ad187c1
MD5 653b6111da0535a1b9a892ce700c665e
SHA1 ab1ea4b7f52d8605742d3b75588743c150a092ad
SHA512 8fcbd371c6b898b7eef8e067fba56163b2acb253090cb3721d937868be1a009074f285771e4ba62545ae01742f77c4d8217ae519775004cacfa8c6e79800d253
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgecwuojhb.exe

Path C:\Temp\mgecwuojhb.exe
Size 226KB
SHA256 06b347558427c45b0ef224938e399f4caa6e0e71312b540f09284edbac4df19c
MD5 09a0b529d666e810681bbb80b8c37e13
SHA1 74dc2157df7c15960470bf887c28fe3180b6d959
SHA512 66ef346cb20da42b99b4c59902e1398e2caf3af9b8cf6f85bbccd4486c19d6206985b0a67a3061f68d2df10262218bb7dffdf70a43d9d594a0556c7f731bf124
SSDEEP 3072:diGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:TXY4LK+a3lLNngoqRttA7
TLSH
T19D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjdbvtolge.exe

Path C:\Temp\mjdbvtolge.exe
Size 226KB
SHA256 478fcd04c823905044b01c8aba27bb44fe4dda8a8ad86379ed7b6a43f3009132
MD5 133cde7d22d3798d8f726cfc96736915
SHA1 4f487082bbedb9de6c39ecee0f1d5043be84200c
SHA512 37187d50c37a6deaf8bd680b0c782fcacf0c602e5fedb253ae87420fb83109e9733706d3c4ea927719811f79b31310f190606801916d7c46ed5d3a054fa57a72
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T10B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebytqol.sys

Path C:\Temp\rljebytqol.sys
Size 141KB
SHA256 8ab95a7f0af7bd4742c468097a31f1730d4bbcb83332650a8d604865d2c12c7f
MD5 8c9d153a6296f333a3c5187fcf6c0cdf
SHA1 5958e867b2d861342338ac3c16590e5c50a132fb
SHA512 9b614aacf9bb237310cf684375e3354442233d897f8c08232acc052cca751f8599b37a71694ab8c302df97fef0cf98f08aff62cbb63cf3b310951d1e308b367f
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T172E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjecwuomg.sys

Path C:\Temp\rmjecwuomg.sys
Size 141KB
SHA256 b7a4c9ca066b6bbdfaa583c3121666940858e765d52a9fe0abed87913fb156f7
MD5 e837c586eaec562b4c23c74c6b7d30d2
SHA1 df37e84b7279b0829bb954312e6bd93fcafdc08d
SHA512 5d9cffa7090d799bb25bbc1b8d707abee48b3e87d29e9892347d325f87475f35d13ba781be1858cdbbb528f3ddb51a1776bd66192b99d1b13aa91ce732f3d444
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1AEE38D12B2D2D172D8A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfausm.exe

Path C:\Temp\xupnhfausm.exe
Size 226KB
SHA256 d6fc76fd396a444834f90506f2857e92f5305579f8117237e8a22da431597322
MD5 90f6185d986e8ae0fe04ff5e402d5ed4
SHA1 d3fe513c6a783946e5f131fb71e5b1f50b030a37
SHA512 8ebc080de8d4f4eb5b3fc6c06aff2a9b71c81126825afebb107320c8ed0473a4f101b87621e9ab48d7acf0d2d6dfd5974e1786da9b2f741d7a4eae67a7b7df0d
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T1A134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpjhecwu.exe

Path C:\Temp\zurpjhecwu.exe
Size 226KB
SHA256 ab8fbef024e7344dfff958e3242205f78ef08b5e70ee77af44a9407141a5f1c5
MD5 52b6c6d7984697b43860b167ea5dbc6f
SHA1 99834ece10494672150076191aca2be71cbb7cbf
SHA512 8f16cd4a77337216440fb9370f55f3ba37bdc37c5cd1188c2064631691494356815e3145261e4352cc0e03e325820c0e338fece8e76c3c23c431bc55cd81318d
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1D534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmbzwuom.sys

Path C:\Temp\zusmbzwuom.sys
Size 141KB
SHA256 1d0da4a0aecb333e674dda8a2ff2ae8856bdb9462c29f1f12037b1400038fc31
MD5 9dba3898a6f54c88d32ebc8a94314ca2
SHA1 bba1df1625001b1a9d788d5d98d00f0155018e42
SHA512 656650eb0b6e2b7df8bc0dbed0b56a778efbe79e41d8f7349e190a464748844b0eb87794f3d64c7661fd7082132dc60f28e70261b82b3b89d28128a35c31cd2c
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

5f7a5615-e21f-4abe-9943-0da003b0fef1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f7a5615-e21f-4abe-9943-0da003b0fef1.tmp
Size 29KB
SHA256 b43df2f471e296ed17ac3b61817bb2cad0f82bbcde3e831df510aa020f1642c5
MD5 3b2b98d42cc557c55e107ec68a021651
SHA1 12eef78b75a6f9d7521899508df21a5a4797f7e2
SHA512 2a433138a24c9a9005c9f5824d67d4c4873d9c66594afae45b77271d35fc744964c0484731f573603a6743b1ab11f3fb424f010c16630abf57767306c83bf8e8
SSDEEP 768:jC+vuR7pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGR0QqcNroZK:jC+vuHEzDQWgQ+f4+u1jalR0Vcm0
TLSH
T114D2EA7B640DCB7F4F804ADDAC197E9F6DA802CB9698CD4047FA941C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 57296db7e18fee70a908e1420efa3617a409f93fe79a274043840e7e6718c764
MD5 9cf51cd1a7f7cb23acb5b11c0a1e33a8
SHA1 e63cf47c6a1427d9d891786c6732f46416b6b967
SHA512 a1e81d0770394925c14fdba78822f71eccb953814cda3a6fb1cc6895f741528462a370f0210a04e0bb774071945875328f7ddaa931a90dd3f14e1d0fcf87586f
TLSH
T102514D07333267ADCBA555B250E8B8D636F2B56B407B5F2088102EBE0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594608.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594608.TMP
Size 2KB
SHA256 4db7357e7f688eb0ba3ce66632eab177abccc3cbb212279a527255d67905644a
MD5 f28655daa7650f642c916463f03f4a9a
SHA1 64a44f373aad33170a67ebafea88b1bcd484aba9
SHA512 4829a3494c1c277e07fddc508b00c4191aafcdb018593fc30233c9279f9a8426bb12bbc5492a9f17fe1813fd6cded8fe2de243710bb2564d3b6d6b16483480af
TLSH
T16B514F07333267ACCBA155B250E8B8D636F2B56B40775F2088102DBE0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 986206c17c180da56e77d00bca4f6f0cb2c8518035c45e6cb1ee07013c0d2aba
MD5 d76a18ff6dc3f82f86ce886dd0d4812b
SHA1 27fbc36276e81a68df60e0a4a75bc3d8f41e9eee
SHA512 e9acc7c5b79951b8bc8dc4deac6bb5458b39a7e837ea7eeba06926f3cb673596bf4b402b07e862e38a267322b29d96a04f1cf845f608bfc4846ffd922628e36c
TLSH
T1A341CEF7C3F8856DCA1195F0AB146E2BCE2D0915432C7D5A88E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3ac38527e6fc20ef346cc66d9f10a92c1dc90e04b1e8533d559f80818b976eb0
MD5 4b0998208f33cdac9d1d66813f5c5629
SHA1 33758c4638c0dc1f740ee64f156d50a39ab445dd
SHA512 a23742ee1c305d2d53cfe11af654c06cb2186b4f5b0971ba895a7c36ce8d4587c24c75a6d33b617d83cfa9332c4c5a94283655b302d124561f2bdb75b210a7dc
SSDEEP 192:sxRMR2CM/fysV3QZdQMzoD8p9u/g6+WNCn9/YCk3uOqGRIgDypljJ:sxRMvM/fysV3OdQk8/5M/I3w
TLSH
T13C42DA166E245D3B4CC7E21DBB55BF53D7F96072B1941E58EAFC861C00E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 df0c124300579425daca4cb74d366f57a7857b463e7e7f16059310e3b461e944
MD5 9c5c0fb9f0a5693ff93280eab760f187
SHA1 2cd0acfce86f30ad91558a3eb92b1d63c60ebf5b
SHA512 f03ef75d74e43da8c3a2d397c5d492df7c5628c191d9ae1b5fe993ba83dedadbed21ea480c071e71aa3bdba9914449e1df1264f8e51f446bcd6454200d0bae7f
SSDEEP 192:sxRbR2CM/fyse3QZdQMzoD8p9u/g6+WNCn9/YCk3uOqGRIgVpljJ:sxRbvM/fyse3OdQk8/5M/I3b
TLSH
T17E42DB166E249D3B5CC7E21DBB65BF53D7F96032B1941E54EAFC861C00E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cc4dcf56b3e55ccfa08d882b8c305287e6de4379c29b67f5094aa4bc64b48d90
MD5 ae37a07b2e216a21be918e1141ddccd1
SHA1 69d99f437c72612b39f2910eadcff16548890310
SHA512 d2a30c7ef57f7051628c6b87b45351a6d14377e8deb96c3dd287ae48a6be48da2395ba9c17b636eefb0a5d4c694abb7feeca9078dbdfec7f4c8cc489652902b1
SSDEEP 192:sxRMR2CM/fysVtQZdQMzoD8p9u/g6+WNCn9/YChyduOqGRIgDIpljJ:sxRMvM/fysVtOdQk8/5M/Q3W
TLSH
T1BD42D91669246D3B9CC7E21CBB56BF53D3F96072A0941E58EAFC8A1C10E66DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e10f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e10f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 ec1144f5c7930b99659c38ab983dd88d5abc9872c67478472cffe46e5197151e
MD5 c432fe3b9f3d34324f47dfa0ca2cc8a7
SHA1 92b7fc2b73237e0ded2a059af822e9829f0ff701
SHA512 be657e99d3602385579962115cbb988857726ad50f41c846ae3a1fb39787d2ae44b9149aae40e8a516017c758cb8d30bc646969ce359c2492985f4ef53d23fc6
SSDEEP 768:9P3PV5uAUp8+p3bd66j+4BRv86aLIWJeBG:9P3fi8+p3Z6n4yjeBG
TLSH
T15DF29FB1E8A5DD735CF9D244B2473783AFB450A3A5C04EE5D8DDBB1D00462AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3108f7c2a22e556afa59166959ca6531d1c61ca8feeb8a553212d8e3a9db121d
MD5 9d60b8f838a5b0882c875830fdcd20c6
SHA1 a84d92e8c111b320bafbdca9f4c103c83b8fab3f
SHA512 0eefdff81ff228c4f043b42e7caedc9796423012defc2fdd03808f2b881340d1ec7c3ece46a8b13be1c0dfb90da0de2e2edefe62463c4725c6cd96bd9f508b95
SSDEEP 768:Irv+4UNbdD3Tc5VNp8+p3bd66j+4BRv86aLIi42bwCl1:Ibsbp3WL8+p3Z6n4yu0ww
TLSH
T14A03BE33F8A899739CF6C648B24677437FF851A396C10AC4E4DD2B4E419A19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8806ac1b47b7596446a828a4363d7157350d8538fee42882d1f0e586a26772a0
MD5 d6392078ba3ff7577e285aaf43ba40bf
SHA1 5dbef2a68db145795d29055ff6858982e027874c
SHA512 680e8617e7dbcd91d9cf24a2cb1ab975866b8deb78b2a0d474931a99391fcb6623d0aae7fc776655b210ff8e390e5fdf755bd8edc00541940d277a82f752896e
SSDEEP 768:0rv+4UNbdc3yV5uAqp8+p3bd66j+4BRv86aLIWJaDY:0bsb630U8+p3Z6n4yjaM
TLSH
T1FC03BF71F8A9DD739CF6D644B18736837FB420A395C00ED4E8D9AB5D018A19E2B0F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0044bae892f6f6ffb31d6899a09b09b9cbfc1dc7750af115ad2e07eb580ede10
MD5 b3ddff55a856888b4da795170c3caa1e
SHA1 23d63226be11c1be6d9799ad48ceb902fee0ffb3
SHA512 6e82c36e34c13a8853fdc2ce61767528981a0ff6f73ebf8158691492de30bf862a2e94f349704b87d7630614e99a3457fc0681759b7624834f44610f0e7ddc82
SSDEEP 768:mFQb3pwgAq4usp8+p3bd66j+4BRv86aLIWJeBG:tb308+p3Z6n4yjeBG
TLSH
T1041329F198D79976D8AE8743A37D2E429EBCD063B5844994FBC86E0CCC421BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9808d6a91e35ba4a469bf23e97b2ca4cf36e5e68e40782685436bc55dd8b1f4a
MD5 d37a4ea86fabf6b58ab31e3a8c014bbd
SHA1 95b1a9f2e6bdf0cff3f0297244ef713a14038dd8
SHA512 eba459889fb8292e8c6d0160baa992957bed6308186ae690d20b23b82bb8200c3ac125c9f02fea04851af50db9b55561d2776d04344999205cf2fe2adf37c65d
SSDEEP 768:QP3gV5uAUp8+p3bd66j+4BRv86aLIWJeBG:QP3ui8+p3Z6n4yjeBG
TLSH
T10CF2AFB1E8A5DD735CF9D244B28737836FB450A3A5C04ED5D8DDBB1D00462AE2B0B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1058d5ef29ef611178e814f93807695c88730b023d987453ef6e12757d5f348d
MD5 6dc0a5634f752211ab8d2c7621d53152
SHA1 724753c50e7d8d1315185b5eaabcc39c31159c40
SHA512 a4ef92fae9a8c58983e210a57c9affb5b5b19677aa1c02b0c596545ca68e6308152341dd0d92dcf2ca94087ceae5feba3c5a4f338676282ec6a70eaf1ec7400f
SSDEEP 768:3rv+4UNbdD3Yf5uANp8+p3bd66j+4BRv86aLITJ2bwCl1:3bsbp3wL8+p3Z6n4yc0ww
TLSH
T10003BE72E4A9AD339CE6C644B1867B837FB811E399C10ED4E4D96B4E005A19E370F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

84cd5d9b-e1f0-4d78-a474-1ab2cc291d25.tmp

Path C:\Users\Admin\AppData\Local\Temp\84cd5d9b-e1f0-4d78-a474-1ab2cc291d25.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5552_1804387875\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1020-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1156-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-692-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1416-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1536-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1740-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1740-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2424-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2708-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2852-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-713-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-592-0x0000000000BC0000-0x0000000000BFD000-memory.dmp

Download

memory/4152-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4348-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4480-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4528-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4700-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download