177aa2eb0bfed76bebb80c35a418f679145921a7ad1b0ebf529e5b3ddf40bdc1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample261027-kmg6rsbx21
SHA256 177aa2eb0bfed76bebb80c35a418f679145921a7ad1b0ebf529e5b3ddf40bdc1
MD5 b565e10516aa0fe942e79b3d1b60b302
SHA1 d6e46f76fa86535fa6fcb8372bdeaf7cbcf9dbc1
SHA512 47403a9b1b57c79cfb8c3fe8754adcb781a10ef25601a136259d73c7c52e9a1531d56aa333523f4785be34d96a6c8c6fa1b4f08999f801def06c9f0e9758247e
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1EE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2176	CP.exe
2792	rljdbwtolj.exe
1340	CP.exe
3320	CP.exe
5044	i_rljdbwtolj.exe
3304	gdyvqoigay.sys
836	CP.exe
2496	yvqoigdbyt.exe
1300	CP.exe
2300	CP.exe
2644	i_yvqoigdbyt.exe
4380	gaytqlidbv.sys
2840	CP.exe
3356	qkidavtnlf.exe
4164	CP.exe
976	CP.exe
1216	i_qkidavtnlf.exe
3316	dxvqnigays.sys
4296	CP.exe
2600	xvsnkifaxv.exe
2824	CP.exe
4600	CP.exe
3576	i_xvsnkifaxv.exe
1344	fdxvsnkhfa.sys
1880	CP.exe
3212	axvpnhfcxv.exe
2936	CP.exe
1824	CP.exe
900	i_axvpnhfcxv.exe
3764	fcxupnhfzx.sys
5812	CP.exe
1896	fzxrpkecxu.exe
5340	CP.exe
4224	CP.exe
2100	i_fzxrpkecxu.exe
5824	mhfzxupmke.sys
4532	CP.exe
5788	bzurmkecwu.exe
5296	CP.exe
4840	CP.exe
5992	i_bzurmkecwu.exe
3860	rmkecztrpj.sys
4484	CP.exe
1484	urmjhbztrm.exe
2820	CP.exe
5472	CP.exe
2512	i_urmjhbztrm.exe
3000	ebwuomgebw.sys
2808	CP.exe
5672	hbztrljdbw.exe
1436	CP.exe
5756	CP.exe
2384	i_hbztrljdbw.exe
4856	iywqolgdbw.sys
5164	CP.exe
5956	bytrljgbyt.exe
5980	CP.exe
2632	CP.exe
3576	i_bytrljgbyt.exe
5792	oigaytqoig.sys
4860	CP.exe
4384	oigayoigav.exe
2744	CP.exe
900	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_917676921\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1761532676\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1761532676\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4464_317629281\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1641359264\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1761532676\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_2070273456\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_331841792\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxupnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxupnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigayoigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigayoigav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqligayvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigdbyt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5632	ipconfig.exe
5176	ipconfig.exe
5148	ipconfig.exe
1372	ipconfig.exe
5476	ipconfig.exe
3900	ipconfig.exe
1844	ipconfig.exe
3840	ipconfig.exe
5044	ipconfig.exe
4968	ipconfig.exe
4856	ipconfig.exe
4384	ipconfig.exe
5484	ipconfig.exe
4844	ipconfig.exe
3888	ipconfig.exe
4428	ipconfig.exe
5284	ipconfig.exe
4712	ipconfig.exe
776	ipconfig.exe
1460	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{D11E7041-D0D8-47DD-A354-06CB06B46EC2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	i_rljdbwtolj.exe
Token: SeDebugPrivilege	2644	i_yvqoigdbyt.exe
Token: SeDebugPrivilege	1216	i_qkidavtnlf.exe
Token: SeDebugPrivilege	3576	i_xvsnkifaxv.exe
Token: SeDebugPrivilege	900	i_axvpnhfcxv.exe
Token: SeDebugPrivilege	2100	i_fzxrpkecxu.exe
Token: SeDebugPrivilege	5992	i_bzurmkecwu.exe
Token: SeDebugPrivilege	2512	i_urmjhbztrm.exe
Token: SeDebugPrivilege	2384	i_hbztrljdbw.exe
Token: SeDebugPrivilege	3576	i_bytrljgbyt.exe
Token: SeDebugPrivilege	6136	i_oigayoigav.exe
Token: SeDebugPrivilege	2788	i_lidavsqnif.exe
Token: SeDebugPrivilege	5792	i_nkicaxvpnh.exe
Token: SeDebugPrivilege	5988	i_nhfzxupnkf.exe
Token: SeDebugPrivilege	2112	i_cxupmkhfzx.exe
Token: SeDebugPrivilege	5548	i_mkeczurmke.exe
Token: SeDebugPrivilege	4956	i_ojhbztrlje.exe
Token: SeDebugPrivilege	4552	i_jgbytrljdb.exe
Token: SeDebugPrivilege	5868	i_qljdbvtnlg.exe
Token: SeDebugPrivilege	3860	i_sqligayvtn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4944	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4944 wrote to memory of 4464	4944	iexplore.exe	91
PID 4464 wrote to memory of 4376	4464	msedge.exe	92
PID 4464 wrote to memory of 1468	4464	msedge.exe	93
PID 4464 wrote to memory of 1424	4464	msedge.exe	94
PID 4464 wrote to memory of 1424	4464	msedge.exe	94
PID 4464 wrote to memory of 1424	4464	msedge.exe	94
PID 4464 wrote to memory of 1884	4464	msedge.exe	95
PID 4464 wrote to memory of 1884	4464	msedge.exe	95
PID 4464 wrote to memory of 1020	4464	msedge.exe	97
PID 4464 wrote to memory of 3904	4464	msedge.exe	98
PID 4464 wrote to memory of 1020	4464	msedge.exe	97
PID 4464 wrote to memory of 1020	4464	msedge.exe	97
PID 4464 wrote to memory of 3904	4464	msedge.exe	98
PID 4464 wrote to memory of 3904	4464	msedge.exe	98
PID 4464 wrote to memory of 1064	4464	msedge.exe	100
PID 4464 wrote to memory of 2564	4464	msedge.exe	99
PID 4464 wrote to memory of 1064	4464	msedge.exe	100
PID 4464 wrote to memory of 1064	4464	msedge.exe	100
PID 4464 wrote to memory of 2564	4464	msedge.exe	99
PID 4464 wrote to memory of 2564	4464	msedge.exe	99
PID 4464 wrote to memory of 1844	4464	msedge.exe	101
PID 4464 wrote to memory of 1844	4464	msedge.exe	101
PID 4464 wrote to memory of 1148	4464	msedge.exe	103
PID 4464 wrote to memory of 1912	4464	msedge.exe	104
PID 4464 wrote to memory of 1148	4464	msedge.exe	103
PID 4464 wrote to memory of 1912	4464	msedge.exe	104
PID 4980 wrote to memory of 2176	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2792 wrote to memory of 1340	2792	rljdbwtolj.exe	109
PID 4464 wrote to memory of 912	4464	msedge.exe	112
PID 4464 wrote to memory of 4624	4464	msedge.exe	113
PID 4464 wrote to memory of 4624	4464	msedge.exe	113
PID 4464 wrote to memory of 980	4464	msedge.exe	114
PID 4464 wrote to memory of 980	4464	msedge.exe	114
PID 4464 wrote to memory of 3076	4464	msedge.exe	116
PID 4464 wrote to memory of 3076	4464	msedge.exe	116
PID 4464 wrote to memory of 1712	4464	msedge.exe	118
PID 4464 wrote to memory of 1712	4464	msedge.exe	118
PID 4980 wrote to memory of 3320	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4980 wrote to memory of 836	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2496 wrote to memory of 1300	2496	yvqoigdbyt.exe	125
PID 4980 wrote to memory of 2300	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4980 wrote to memory of 2840	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3356 wrote to memory of 4164	3356	qkidavtnlf.exe	134
PID 4980 wrote to memory of 976	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4980 wrote to memory of 4296	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2600 wrote to memory of 2824	2600	xvsnkifaxv.exe	143
PID 4980 wrote to memory of 4600	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4464 wrote to memory of 2212	4464	msedge.exe	149
PID 4464 wrote to memory of 3616	4464	msedge.exe	150
PID 4464 wrote to memory of 6072	4464	msedge.exe	151
PID 4980 wrote to memory of 1880	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 3212 wrote to memory of 2936	3212	axvpnhfcxv.exe	156
PID 4980 wrote to memory of 1824	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4980 wrote to memory of 5812	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1896 wrote to memory of 5340	1896	fzxrpkecxu.exe	165
PID 4980 wrote to memory of 4224	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4980 wrote to memory of 4532	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 5788 wrote to memory of 5296	5788	bzurmkecwu.exe	174
PID 4980 wrote to memory of 4840	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4980 wrote to memory of 4484	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 1484 wrote to memory of 2820	1484	urmjhbztrm.exe	183
PID 4980 wrote to memory of 5472	4980	2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 4464 wrote to memory of 2544	4464	msedge.exe	188

C:\Users\Admin\AppData\Local\Temp\2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_b565e10516aa0fe942e79b3d1b60b302_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc98b0c188,0x7ffc98b0c194,0x7ffc98b0c1a0
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,1889178735192427892,4480010922982695303,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
      4⤵
      System Time Discovery
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,14627157076062772532,13175896119904508928,262144 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,14509807290974371427,13752860650473907909,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:13
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,16106878156962042195,6474317778233918946,2097152 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,4962690840007424346,7402935121686446882,2097152 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,3847976319721380540,1209750029342911865,2097152 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,17908217809790427051,10968847798063444396,2097152 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:9
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15637778323059853112,15263179086477271591,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17541489443648684150,8734311377190751881,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6867073718549472413,17903310534936464341,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,2229450607038118737,1119709474369098500,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,2229450607038118737,1119709474369098500,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17517011587552506908,4113188928920914934,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,1849268003312213732,9918916147923569335,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,18333089148599736722,8618034756787028490,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,2639208553578430579,281702666436105408,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,3656176489877029783,17007270857464651651,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14159170905320360998,12059627021410381473,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16131119869035633677,1681096850494844403,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,11137069008677996312,3369843126360744790,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,913825903928848992,8493015550203167935,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15580439380929855236,7796285050600306169,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9537506989008351790,9976508171604976547,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6620,i,17567215548375290321,7644826070781350607,262144 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,10505114256229177771,16354475926379794730,524288 --field-trial-handle=2280,i,7280985394018936174,6380701260859094530,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwtolj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2176
- - C:\Temp\rljdbwtolj.exe
    C:\Temp\rljdbwtolj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwtolj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3320
- - C:\Temp\i_rljdbwtolj.exe
    C:\Temp\i_rljdbwtolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigdbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:836
- - C:\Temp\yvqoigdbyt.exe
    C:\Temp\yvqoigdbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigdbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2300
- - C:\Temp\i_yvqoigdbyt.exe
    C:\Temp\i_yvqoigdbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavtnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\qkidavtnlf.exe
    C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavtnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:976
- - C:\Temp\i_qkidavtnlf.exe
    C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkifaxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\xvsnkifaxv.exe
    C:\Temp\xvsnkifaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkifaxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4600
- - C:\Temp\i_xvsnkifaxv.exe
    C:\Temp\i_xvsnkifaxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpnhfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1880
- - C:\Temp\axvpnhfcxv.exe
    C:\Temp\axvpnhfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpnhfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_axvpnhfcxv.exe
    C:\Temp\i_axvpnhfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\fzxrpkecxu.exe
    C:\Temp\fzxrpkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4224
- - C:\Temp\i_fzxrpkecxu.exe
    C:\Temp\i_fzxrpkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4532
- - C:\Temp\bzurmkecwu.exe
    C:\Temp\bzurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\i_bzurmkecwu.exe
    C:\Temp\i_bzurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\urmjhbztrm.exe
    C:\Temp\urmjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5472
- - C:\Temp\i_urmjhbztrm.exe
    C:\Temp\i_urmjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\hbztrljdbw.exe
    C:\Temp\hbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\i_hbztrljdbw.exe
    C:\Temp\i_hbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrljgbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5164
- - C:\Temp\bytrljgbyt.exe
    C:\Temp\bytrljgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrljgbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2632
- - C:\Temp\i_bytrljgbyt.exe
    C:\Temp\i_bytrljgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigayoigav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Temp\oigayoigav.exe
    C:\Temp\oigayoigav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigayoigav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:900
- - C:\Temp\i_oigayoigav.exe
    C:\Temp\i_oigayoigav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavsqnif.exe ups_run
  2⤵
  PID:3980
- - C:\Temp\lidavsqnif.exe
    C:\Temp\lidavsqnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavsqnif.exe ups_ins
  2⤵
  PID:3540
- - C:\Temp\i_lidavsqnif.exe
    C:\Temp\i_lidavsqnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicaxvpnh.exe ups_run
  2⤵
  PID:2472
- - C:\Temp\nkicaxvpnh.exe
    C:\Temp\nkicaxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicaxvpnh.exe ups_ins
  2⤵
  PID:3740
- - C:\Temp\i_nkicaxvpnh.exe
    C:\Temp\i_nkicaxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxupnkf.exe ups_run
  2⤵
  PID:720
- - C:\Temp\nhfzxupnkf.exe
    C:\Temp\nhfzxupnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxupnkf.exe ups_ins
  2⤵
  PID:4400
- - C:\Temp\i_nhfzxupnkf.exe
    C:\Temp\i_nhfzxupnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmkhfzx.exe ups_run
  2⤵
  PID:5400
- - C:\Temp\cxupmkhfzx.exe
    C:\Temp\cxupmkhfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmkhfzx.exe ups_ins
  2⤵
  PID:4660
- - C:\Temp\i_cxupmkhfzx.exe
    C:\Temp\i_cxupmkhfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkeczurmke.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\mkeczurmke.exe
    C:\Temp\mkeczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkeczurmke.exe ups_ins
  2⤵
  PID:5088
- - C:\Temp\i_mkeczurmke.exe
    C:\Temp\i_mkeczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:2008
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:5844
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytrljdb.exe ups_run
  2⤵
  PID:5380
- - C:\Temp\jgbytrljdb.exe
    C:\Temp\jgbytrljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytrljdb.exe ups_ins
  2⤵
  PID:3328
- - C:\Temp\i_jgbytrljdb.exe
    C:\Temp\i_jgbytrljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbvtnlg.exe ups_run
  2⤵
  PID:2836
- - C:\Temp\qljdbvtnlg.exe
    C:\Temp\qljdbvtnlg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbvtnlg.exe ups_ins
  2⤵
  PID:5916
- - C:\Temp\i_qljdbvtnlg.exe
    C:\Temp\i_qljdbvtnlg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqligayvtn.exe ups_run
  2⤵
  PID:4564
- - C:\Temp\sqligayvtn.exe
    C:\Temp\sqligayvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqligayvtn.exe ups_ins
  2⤵
  PID:464
- - C:\Temp\i_sqligayvtn.exe
    C:\Temp\i_sqligayvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2008

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:3304

C:\Temp\gaytqlidbv.sys
C:\Temp\gaytqlidbv.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Temp\dxvqnigays.sys
C:\Temp\dxvqnigays.sys
1⤵
- Executes dropped EXE
PID:3316

C:\Temp\fdxvsnkhfa.sys
C:\Temp\fdxvsnkhfa.sys
1⤵
- Executes dropped EXE
PID:1344

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\mhfzxupmke.sys
C:\Temp\mhfzxupmke.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\rmkecztrpj.sys
C:\Temp\rmkecztrpj.sys
1⤵
- Executes dropped EXE
PID:3860

C:\Temp\ebwuomgebw.sys
C:\Temp\ebwuomgebw.sys
1⤵
- Executes dropped EXE
PID:3000

C:\Temp\iywqolgdbw.sys
C:\Temp\iywqolgdbw.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Temp\oigaytqoig.sys
C:\Temp\oigaytqoig.sys
1⤵
- Executes dropped EXE
PID:5792

C:\Temp\qnlfdxvtnl.sys
C:\Temp\qnlfdxvtnl.sys
1⤵
PID:3976

C:\Temp\nhfdavsqki.sys
C:\Temp\nhfdavsqki.sys
1⤵
PID:3720

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:4368

C:\Temp\zxrpnhfzxu.sys
C:\Temp\zxrpnhfzxu.sys
1⤵
PID:6116

C:\Temp\jhezwuomke.sys
C:\Temp\jhezwuomke.sys
1⤵
PID:4192

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
PID:5000

C:\Temp\wuomgebwto.sys
C:\Temp\wuomgebwto.sys
1⤵
PID:4344

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
PID:5284

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
PID:4124

C:\Temp\xvpnifdxvs.sys
C:\Temp\xvpnifdxvs.sys
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axvpnhfcxv.exe

Path C:\Temp\axvpnhfcxv.exe
Size 226KB
SHA256 3e6f4d5adf7f1f88110de45daa8c29491a5f3b1b9cee3f2e50dbc6aa9383bfcb
MD5 b44da10edbc558eaf3841af6b2d0c97e
SHA1 0fa287de545b2b4ed3b93da945ec8ae922fa3ebf
SHA512 cb68692faeff965ee1698bc207aa2b20bc027e461a1c55de8fba60fdea210ecc0fedc4bbbd75d22956c8ee7cb4faf7ba6349fac41464aedb0b9b34271378ef13
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T17E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnigays.sys

Path C:\Temp\dxvqnigays.sys
Size 141KB
SHA256 525c5a06ec41ecb31ef4cd13c7dccffc85d7f9a4e50a11b25c2ac9bc45118327
MD5 9949bb5098c0035ce11a1fe10210076a
SHA1 e1fad554459f7a80a32f5c205f108c7ea5c830a5
SHA512 a89677ed8078fd5aead093525bdcb116d7818c2afdc01c10ce38bbd4336e10dae69d451905dd8581de7893b71baae0c73632d4fcd757054d97701596690c560d
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T194E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxupnhfzx.sys

Path C:\Temp\fcxupnhfzx.sys
Size 141KB
SHA256 69fdd8a6f629b0423ad55776782ef1e5fb86995c2d873235cb4d422af210300b
MD5 1c8d4cae64f18ef0f09beca0466b65a8
SHA1 9af1d976fe965b0e5fd4df7bf2d0cdb84fa8e1b0
SHA512 c008f546b0ac8752d88f3f68eb81609d37ccdecb4414173615c50c02de87b769f0c819237421f722c3c809e42a49183e7e22336d4c6e1ac0fffae7b542434694
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T159E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvsnkhfa.sys

Path C:\Temp\fdxvsnkhfa.sys
Size 141KB
SHA256 0efeadeb659ec52ff9192d35c38e712d8ad58d9106503fce4ac3a7666685a9ba
MD5 49c45a44d7b428cc85b43e73c19cc645
SHA1 53070c74e3db685f61d0baba64495681f81f0af4
SHA512 baa3d90ef36f1a294a29f7a4f8cd88e3b747f4cd367552fefb2f16dd73f70c4924cdf16fa14598fe58c4b418823f18eb7dda2f81f774c0979f6c244fa93b5a29
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T189E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkecxu.exe

Path C:\Temp\fzxrpkecxu.exe
Size 226KB
SHA256 1f3d0fd7a14fffdf41e1d4167d50de0dfde3f3c7ff66111de222283e297ee950
MD5 d10d385acafd917e13ffea039c9fed94
SHA1 524a7c68ab1d51f5186bedfda3801165b8280fa1
SHA512 3ce1a7fa02a7100e5d2e70d0a61745064e7e74f8b1524cf69bebca3b0b39d32dd86f144cedf54d015d5d943deebbfef84494ee80fd3d402dd32e29ede1d066a2
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T13334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqlidbv.sys

Path C:\Temp\gaytqlidbv.sys
Size 141KB
SHA256 8f36aeb7d979b45ed1b73de7f16bb96079494563d074ea2bd2a97e493534a1ad
MD5 57e78396198d62cd2fbecbfb05d6e4f4
SHA1 fc85e24347c984496ed07060bb48633820478d6c
SHA512 6e54f5d1c5b05cf1fc52f78f9aa54d68bd6c70a5bef9d92bc9d511b2ef83dd56d45bcb6e1589942ec4e6895fccf9012bbd3f8bf3b9d53a470613056ef4cd9a75
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.sys

Path C:\Temp\gdyvqoigay.sys
Size 141KB
SHA256 eeee7d2c11b5eb443e693bb0190a0692861348acd311acc5cae60d3fcc8b4196
MD5 9478e36e5d49655ce763c539a0a34e00
SHA1 0f3917b146d487b95a945539be03c28cedbeba68
SHA512 fdadda06e7bfb219016d1fdec21733d86b4adf701340ed3145ffca976af7bec49e0d76c74eed0e8449f6803d4b438b7b95ee47fa8a52b6e6f46109babb137ac0
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12AE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvpnhfcxv.exe

Path C:\Temp\i_axvpnhfcxv.exe
Size 226KB
SHA256 df8faa8a831ab4b101a9d270cc71718ed589cf5c6235799a98c0aeb860581160
MD5 941355357cadc9be5c12a4a2f77e0403
SHA1 0ba0a04262a32dbda635bd8e2f42ab803385d083
SHA512 edf391c5b23ba4790464376b89cc9a6a577b4ece8a7be0eb98751b397abdd9127345f558de6bc841be86c541e1cbd876df41b2a78cee8e70def1ad48eafe9dbb
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1AB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkecxu.exe

Path C:\Temp\i_fzxrpkecxu.exe
Size 226KB
SHA256 41c5ed14f4a68c49250613980279af53ae1c4fc7a231d24350f066d8c0f8e98a
MD5 5f26b4543a1a03268fe69ebd62cd4179
SHA1 8e472670fa6702d4c484243801e5e5bc026af208
SHA512 a685baf32c176f9a4a68721896321a69e15b07d06b7a85042410112b9ed0f0760d77d375e50054c39a3e044e74432d22f82398050ca0d0d113ad81c078a3bb4f
SSDEEP 3072:gGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:HXY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkidavtnlf.exe

Path C:\Temp\i_qkidavtnlf.exe
Size 226KB
SHA256 89eabedb4de96ed4ad28abdb3ea1bcb918259cef90704ab4e157626c85390258
MD5 4fdd542bc98e5b596bca89e810733c23
SHA1 58e957c8cf786b38d11723e37c2904557a9507ec
SHA512 c7376144de529ceb523759964fb2e2aad5aa1b72e6c9ee004d42c6d05b10ee427d43b7e4a617407cbb34332625d595e995ac12f3f171801e03d00ec40a38113a
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1D634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbwtolj.exe

Path C:\Temp\i_rljdbwtolj.exe
Size 226KB
SHA256 2aa2959fe255efd4af2613adba296b8d436855be344accfd90714ec08656fac8
MD5 a571494b9d6beaf518b5663b3cb35c32
SHA1 838f1a01f9f493f9299592ef4f2cd159d15dc8fc
SHA512 d02121a806844bb6027d06dd5ccd4e7f4c6ec4be89480a20306bd767bd56f8520e130f541c0b202fc949171e099432350e6032a7a24c9110658ddfb0cdc46907
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T12234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvsnkifaxv.exe

Path C:\Temp\i_xvsnkifaxv.exe
Size 226KB
SHA256 18f76932661487d0bbf3cce7ca20e630296559ed1a2348ae7d8d21e984656caf
MD5 3ad74dae2fd6e358712ebef54374dd05
SHA1 6df1cd75d24795ed4cc3077bae51ba9803c67af7
SHA512 abdfd76d89517244163afc5ac314492e2391dd9dbed19dea276fa26e9bb798ce8df72393d8336b98e58bf5f8dab56747332b458d755d9d58ee1f018ab644259f
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T16F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigdbyt.exe

Path C:\Temp\i_yvqoigdbyt.exe
Size 226KB
SHA256 eb38fa2496be2bbdb5b15d7250d0ef901ad3dc7bfdf794d765539adbec2c9664
MD5 8bed9eedfaa7687b94ab6dda793ba040
SHA1 a8b1fe3b0b7a0eff801000a6713a69fa844ac6da
SHA512 07f692e0ad0d2710f5a458dae8cf71774e1a684ef0e956e25c142d66b41d06d0ff559ef422a75d814a551fe7759ae47c68a4049fa3c653f21d6bf1a9ebf0e036
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T1D734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavtnlf.exe

Path C:\Temp\qkidavtnlf.exe
Size 226KB
SHA256 6bc5d9621be1910f8e94ea9c3e6dae3196c4f7e7f6f7075ae606b0b3c9a02e4f
MD5 09c8a8d3f340cc7dec21d6738e026ff1
SHA1 a3e7f2e06219042d4b5b9de188f985d512e860b6
SHA512 77287bc68f08805f9eaaa94ca496ca5a643d7ea027a9b230a7ce43d2832ae50a4a87e4868675d7af3408d94f0e7709c1e20552385dc4fe585bf048d971a16625
SSDEEP 3072:LGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:KXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbwtolj.exe

Path C:\Temp\rljdbwtolj.exe
Size 226KB
SHA256 08fcade9c31ea810fb8f258748f3c21a6d0b293015cdcdc2a95464184c7f3c64
MD5 a522736acb94580166fa5b92068e2b91
SHA1 bf2830cf1a8e3462126de2436027c05eac7c6631
SHA512 6e95a8eac83b8a5a866df441aa73c13db8b13a9b341ee6b3c7e85a7125575eb4405b99d29e72d5581f128ce3c434364f5c88ce184dbf0b3c91a501c47636d973
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T13134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkifaxv.exe

Path C:\Temp\xvsnkifaxv.exe
Size 226KB
SHA256 0a6db547af4d36cc7106a2cf9d26c5f5ec676d085a55cb43d1e4be9bf09ffd6c
MD5 d7c1ac2d1b0aca5cdcf5d86c863b7c2a
SHA1 b24b3c6efec528fbaf19b40a36f72ff91f78fe97
SHA512 290bf84d98ac9e8c6764a92e16fa8b818ad8e49c5009edeb30b6d18bd8614d57de9619b65fb3257c69a495ffc2b05257d11c3cea6b85016fef6dfb15f77a5d44
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1F134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdbyt.exe

Path C:\Temp\yvqoigdbyt.exe
Size 226KB
SHA256 1e69850146f79842f4f5169e79049b55240771fe3ff35f68532ae78d3f59caa5
MD5 5182ca3c81924526adbd02c33392f88f
SHA1 76e21fc82080a3b64112ebe7dc42cc55ccd5341c
SHA512 fd62928a6b11ab0a9a458f01f0abcc61f39c0d75ec7c1bb761e1604773397fc9ab64b13ef8a2596a36beb70ec9b476a17c05b2de165aa7c0f3df9c1d53a5c50f
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T12434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ba2758b-7b1f-4f3e-bfad-9a83dab75422.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ba2758b-7b1f-4f3e-bfad-9a83dab75422.tmp
Size 37KB
SHA256 3537680e00f5ed3bb840dc45772e65bd34d3623326637fad9a592906cb9f4872
MD5 d911537c65fd4e0df56e021cb830f9fa
SHA1 0f39c2da500b722cdf684c5216860c5ff3ac243f
SHA512 0134da84587d07767aa4d9983b76209e34ee3c098e8b943121ed6ead7df68f02c368f28f80b836dbae2f5f7d890078cd567f4ad3aceb76d6f6f8b567db5ab13a
SSDEEP 768:B/UxvxjgC+CZ3RUK3OVStG1h3Yogkl5akl8pbHW0AWTlSHvP0Vv:UZj3+I341h3Yog05akl4bHW0AcSCv
TLSH
T1E503CF3AEC64AE778DE6E284761AA307FFF494635AC4569445DCAF0D02873AC030BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

607e6c95-35f2-4728-a7cc-2f18613974e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\607e6c95-35f2-4728-a7cc-2f18613974e7.tmp
Size 38KB
SHA256 ee1e421d89efcda13bdf6f23ec2854885f4177b5733f9c6f1007da2488ab72c6
MD5 5c5b11eb6fa6d90b50bc8945344433de
SHA1 5b2bf18252639476bc13423d8579e8baef384ba8
SHA512 d8d73f0111450a23034b895c6e99eac43b61713ca212df110a45e7ef639a6fe8b1e3fc40b2024682fbb96a83282fbcb2e976a734529ea533ea914de62f70af6d
SSDEEP 768:m/UxvxjgC+CZ3IAK3OVStwe1h3Yogkl5akl8pbHW0AWitSHvP0Vv:bZj3+I3k1h3Yog05akl4bHW0AbSCv
TLSH
T13003BF35EC69AD738AEAE244721AA357FFF454735AC04A9499DC9F0D06873AD030F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

0fa438a6-18da-4254-aa3d-91355d0d175b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fa438a6-18da-4254-aa3d-91355d0d175b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dc08fae-ce63-41e5-8d30-d0ffc04f07f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dc08fae-ce63-41e5-8d30-d0ffc04f07f6.tmp
Size 11KB
SHA256 4be27eee60e0ff47796e847f842022dd939e04365998c3685f5cc6571aa6be78
MD5 7cbb5648f09c5e964ecbf9eec6bc174f
SHA1 7b4811f507c03efe364198d7c67e2a8f66b12e52
SHA512 ce4aaa8c52c6a71296776d5deaad5f85e99084e14ee0cda6fd9b7fc323921696d3a1b46b8ae1b35e8a45571e5c6779a7dbb7b2b56e608c37a425dc220aafc2b6
SSDEEP 192:sxRbR1Cg/fk9syPZW1zoA8p9e/g6+WNCLo/YdtQS+GJdIgVzHJ:sxRb6g/fk9syRWY8/59/WBtp
TLSH
T12142C956AE28A93F9CCBD21DFB557F53D2F9503291911F48A6FC891C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

642b693d-0884-4e46-850b-2a3ba173eae4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\642b693d-0884-4e46-850b-2a3ba173eae4.tmp
Size 11KB
SHA256 6d4068a93af698d0ae09a90cfc9476eeb5c0206d9721d15f7e2dd538c47221d5
MD5 001712fe9597035cadb062f39ed99168
SHA1 b4afd49888e96f11ff94d9e2fec133f1c832d91b
SHA512 f5944b3b601a93433deb22dc8e6354a8edc6641fe6bf56d7ff44d101f35ad55aa650805278ed1b0ef5fc449896fc97dcbf4a50242bd5ffb7da055b9ae9eb4bc7
SSDEEP 192:sxR4R1Cg/fk9sjPZW1zoA8p9e/g6+WNCLo/YdtQS+GJdIgDyzHJ:sxR46g/fk9sjRWY8/59/WBKp
TLSH
T1DB42C856AE28A93F9CCBD21DFB557F53D2F9503291911F48AAFC8A1C04EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d69581b-5280-4208-9fb1-f61ceefc4834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d69581b-5280-4208-9fb1-f61ceefc4834.tmp
Size 29KB
SHA256 066cf375d3aa5014feb625fb678c32d62a443caa397d04b04c8e32f636a9dae7
MD5 17c956c2110597ff26676d7d13d2c9af
SHA1 e5e9f5d55bfd2710d0d1c3af60cbf3ae216b3802
SHA512 fb71fa040891d1228f5c38d50aecc62999cea32b0a3cf1bf15686404d6e0a10bda1002338a1c5240900db8f51b13314dfa66e6ef4389a73764277dced2fe730d
SSDEEP 768:qF+zB57pLuLj3oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVb8IIGUbroRY:qF+zBPEj3oWgU6f8Su1ja48IxUoe
TLSH
T1A8D2E97B740CCA7E4F804ADDAC197E9E6DA802CB9698C94047FE845C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 e3e9e7293bd80e1a36d3fdfc76bf7b74371172e3c67cf405df34456782440176
MD5 1998fee41f67d7670d7095e338731cd4
SHA1 d3ad52f2a0d1b12121f5dc7549935ce5b5b6dc53
SHA512 41266a7db15c1d77617d06871f8e5b94a255b93d61f7e8d574e19803878c1098e218b8bd9a61e2cfc2f931ddcf3a51754026cd779312bc1dfd9d6c3da4540fc5
TLSH
T1AE6178419272454EF36831F096CD1E5E323256ECABF31F16E7E6C5B4890D761C896198
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2405e1b396979ad0cf32b269cf957b3cb3bdae0284bd059c0334f0e86c9ab510
MD5 a981eec0882a961767ceaf6d8355eb12
SHA1 fc8d66d09d3da6a5ed56ab90420ff20b3219df25
SHA512 7cb0ac971d06e3664f075935d0f3918033f7d8adeef0dc7259fc200a446d957162aeb020c9e493663666510285503b1954ece4548e1b53411cdbc30e021cdf36
TLSH
T1F96187419272410EF36831F096CC1EAE323256ECABF31F16E7E6C5B4890D760C896098
MD5 SHA1 SHA512 TLSH

Submit Download

dc4a8b68-10df-4516-9540-9ef96ef48434.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dc4a8b68-10df-4516-9540-9ef96ef48434.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

42fc67e6-d228-463b-be1e-5bb1eefe5722.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\42fc67e6-d228-463b-be1e-5bb1eefe5722.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ca1f0369-95f7-456a-ba45-8c03bef4bd2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca1f0369-95f7-456a-ba45-8c03bef4bd2c.tmp
Size 2KB
SHA256 0d985703b8ab5e5db3c416bdc5b50114a4213f4361b63d00430952fec0c06eb1
MD5 fd97dbfefa7fefc837a61ffc392ce5a9
SHA1 b7c857f8b93f5aff0f08bd7b7d1939b91de635c7
SHA512 5c420b31115c0bd4c5b2f658dd6fb27914d1832f520f7233f9a1d14bce62d87560418382f85b47703c9325bd7c5bed01d08840fa744109281c855c4ef0ab97a3
TLSH
T18341BDF3C7F8856E8E0145F4AA146E2BCE2C0915432C7D5A84E49E2B93F3871E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

daf1f0fd-d1c7-443a-b150-0c7488461f1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\daf1f0fd-d1c7-443a-b150-0c7488461f1e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f045f2f9-a913-4622-b6c5-dc5a5a465ffa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f045f2f9-a913-4622-b6c5-dc5a5a465ffa.tmp
Size 12KB
SHA256 77bba8a0ae19a48de313bff325304fa8e62e2d99ba37f1fb607b3a67a29bac57
MD5 7622034d219697de9aef9c15f9fc135e
SHA1 f91ca9148136af2ba25d767665734222c28a0b6a
SHA512 ca3354c96f42567eb04881abb5410ff71bb9eeaba9844b8d03aea160d6b6715a140ab79ae9785364c5d69cf2ee6525d0e1f5e7fd2bdd3da65426ef76d830d9e3
SSDEEP 192:sxR4R1Cg/fk9siPZW1zoA8p9e/g6+WNCLo/YdrsS+GJdIgDIzHJ:sxR46g/fk9siRWY8/59/SBcp
TLSH
T16742D956AE28693F9CCBE21DBB557F53D2F9503291911F48A6FC8A1C04EB7DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e97a698b-3d3f-4910-8892-85532aeae02e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e97a698b-3d3f-4910-8892-85532aeae02e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adf108f2-d9bc-4c7f-939f-318a772ad73e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adf108f2-d9bc-4c7f-939f-318a772ad73e.tmp
Size 34KB
SHA256 cd9a755b848c9f049c67dfad143762e15d5057953feb436c3158d061f6e367e2
MD5 f55ede93a0bb6f638dd52e3f2f51caa5
SHA1 2dcafe93e95905d5f81c50222f4a12c9b1d5f1f7
SHA512 043a4c7559a8c20f1db94b815d1cf83f98bc38c142bf1acc75b9d11bc71c7a36e202478d079d62ba30da051e5e60931e942c096dc45cf8b117156d2da0ffc0ed
SSDEEP 768:Bl3q8eK3OVStwt1h3Yogkl5akl8pbHW0AWDtoaTZc8MLM:Bl341h3Yog05akl4bHW0Aw9JMQ
TLSH
T152F29E70E86ADE7399EAE244B21A2253FFF490639AD40F85D5CDDB1D01873AE174F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf1260d2-c586-4284-a172-d0b8c712bfba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf1260d2-c586-4284-a172-d0b8c712bfba.tmp
Size 42KB
SHA256 26c07f493d8eec6ef11179fcb9ed3dfcf9da820e56588e1253bfc1ccf441218b
MD5 37e0ea1bd45d61ecf0adc549639f0428
SHA1 6854c394e0b4c31029b484697ee98c3362fe3778
SHA512 85adace16078c744f5d2bd9464afe7e2cf241ab04af6fa673cbdd0650419e942e45f6e4e0e56837598d7bc2d8aa7feac3034179e0a9b44a1d20b2004b9d955ec
SSDEEP 768:3FdM3gwggt7e3OVStwO1h3Yogkl5akl8pbHW0AWDtoaTZc8MLM:HM3m1h3Yog05akl4bHW0Aw9JMQ
TLSH
T1FD1308F598D7DA37D99E9383633D2E42AABCD063B9944984B7C85D0CCC861BFC74A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05893253-38e3-4c79-a9d1-9014ee6ac409.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\05893253-38e3-4c79-a9d1-9014ee6ac409.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

3d304fd3-9a1f-4737-ad3a-3d0e727a3c19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\3d304fd3-9a1f-4737-ad3a-3d0e727a3c19.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f87025d9-e85d-4890-ab4b-07598250cfc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f87025d9-e85d-4890-ab4b-07598250cfc2.tmp
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e05a8403-f48c-449f-82d0-67ade8399f51.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e05a8403-f48c-449f-82d0-67ade8399f51.tmp
Size 34KB
SHA256 c827ea1b578b43b8702801186436c48df8690cd2ce5459dd4b5e6e161ed3bc6c
MD5 16947d3b05bc2d529ee237594b643bfd
SHA1 825c14ea5e2ceb4ae5e3d9a982089f6beab3b667
SHA512 8a71eab9902189da1fb9d35eca8ef64ddfb5c8a6a5ee956f55a4900141280864837f314dd13176e91def91e018173081afac1723b43372da1c3262be97ccd0f8
SSDEEP 768:1l3pleK3OVStwU1h3Yogkl5akl8pbHW0AWDtoaTZc8MLM:1l3B1h3Yog05akl4bHW0Aw9JMQ
TLSH
T172F29E70E86AEE7399EAE244721A2253FFF490639AD40F85D5CDDB1D01873AE174F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac1a7fb1-6b61-4fe7-a58d-2fabd8b1bc3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac1a7fb1-6b61-4fe7-a58d-2fabd8b1bc3b.tmp
Size 132B
SHA256 cf4125d94d82b448cb33d6f462cf53eec00f2ee8165fa00f1b9c3bdba48e3328
MD5 8126a600a3d95922fb651e3a6f104f68
SHA1 e386add1c2c1d9ca74461e5ce0d1b271d689160f
SHA512 5a0e81111f0d9a0f7943b99f7bad8162de0d3f99fffa9d8f8ab466fa9c7c4249808bedfa6e4d26426bc2d1a422e2155900ba71adc222617a5f0880dc60b89a93
TLSH
T122C02B8F542E47CBBAA5152D42D40B3B4690CD60F199E6B449FA5640006435CC608C47
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

65150124-f10d-45e2-87b5-4e7ae98ffab8.tmp

Path C:\Users\Admin\AppData\Local\Temp\65150124-f10d-45e2-87b5-4e7ae98ffab8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c8a9b9b5-bc9f-4afb-9a66-e4624d2c265f.tmp

Path C:\Users\Admin\AppData\Local\Temp\c8a9b9b5-bc9f-4afb-9a66-e4624d2c265f.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_1048196517\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4464_1050515252\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1641359264\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_1761532676\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_331841792\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4464_917676921\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1344-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3000-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3304-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3316-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3720-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3764-528-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3976-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-745-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4192-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4344-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4380-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-749-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4856-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4856-579-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5284-725-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5792-609-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6116-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download