systex | 265811041d468f71862131570a1366d634bd675e9810a096897310f067aa678c

Analysis

max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260511-e5fg1aex2n
SHA256 265811041d468f71862131570a1366d634bd675e9810a096897310f067aa678c
MD5 20d87d02dccd11ba089bf28c918619d3
SHA1 0f881208c4ec70dd8946f0136fa21f6a9db1e7ea
SHA512 f48ea745a6a5d34b27bf3ed7da47acf0fd710ef9a83539691e0075b2a25a5e542800cb66229a138eb673ed989e79f958ecba91a814725b6de53aff1d6455c74b
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5016	CP.exe
2064	qkicavsnhf.exe
8	CP.exe
2772	CP.exe
5536	i_qkicavsnhf.exe
2720	nkfdxvqkif.sys
1652	CP.exe
4488	faxsicausp.exe
5068	CP.exe
5144	CP.exe
3972	i_faxsicausp.exe
2324	cxrpkhcaus.sys
2244	CP.exe
5976	pmhfzxrpjh.exe
1244	CP.exe
4144	CP.exe
5740	i_pmhfzxrpjh.exe
1648	cxrpjhbzur.sys
2836	CP.exe
1884	rpjecwrpmh.exe
5048	CP.exe
5960	CP.exe
5484	i_rpjecwrpmh.exe
4160	geywrojhbz.sys
2496	CP.exe
5440	wrljebwtom.exe
2808	CP.exe
4568	CP.exe
2044	i_wrljebwtom.exe
4332	zuomgeywro.sys
2052	CP.exe
1284	gbvtolgeyv.exe
2476	CP.exe
4036	CP.exe
2040	i_gbvtolgeyv.exe
4616	ljgbytrljd.sys
2760	CP.exe
4208	dbvtolgeyw.exe
5992	CP.exe
804	CP.exe
1288	i_dbvtolgeyw.exe
5904	avtnlfdyvq.sys
3812	CP.exe
4296	toigaysqli.exe
5216	CP.exe
4192	CP.exe
5344	i_toigaysqli.exe
5488	qnifaysqki.sys
3856	CP.exe
5944	cavsnifaxs.exe
4500	CP.exe
2788	CP.exe
844	i_cavsnifaxs.exe
5004	avsnkfdxvp.sys
4704	CP.exe
5036	hfzxspkhca.exe
4976	CP.exe
6124	CP.exe
5008	i_hfzxspkhca.exe
5480	mkfcxupnhc.sys
2184	CP.exe
5028	czxspkicau.exe
5308	CP.exe
5920	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_1542762138\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5604_400872233\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\en\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_1542762138\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_1542762138\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_835805296\_locales\fr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjecwrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojebwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxsqkicavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrmjecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrmjecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjecwrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojebwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxsqkicavp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbvtolgeyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbvtolgeyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2416	ipconfig.exe
3828	ipconfig.exe
1756	ipconfig.exe
4968	ipconfig.exe
2448	ipconfig.exe
5340	ipconfig.exe
1180	ipconfig.exe
4288	ipconfig.exe
3296	ipconfig.exe
2124	ipconfig.exe
2916	ipconfig.exe
1004	ipconfig.exe
1620	ipconfig.exe
4984	ipconfig.exe
4308	ipconfig.exe
2432	ipconfig.exe
3692	ipconfig.exe
2816	ipconfig.exe
4972	ipconfig.exe
6092	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2140177952"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31252753"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229474771910217"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{25480987-DA87-41F0-9A86-4ACF5C20F316}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe
2064	qkicavsnhf.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5536	i_qkicavsnhf.exe
Token: SeDebugPrivilege	3972	i_faxsicausp.exe
Token: SeDebugPrivilege	5740	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	5484	i_rpjecwrpmh.exe
Token: SeDebugPrivilege	2044	i_wrljebwtom.exe
Token: SeDebugPrivilege	2040	i_gbvtolgeyv.exe
Token: SeDebugPrivilege	1288	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	5344	i_toigaysqli.exe
Token: SeDebugPrivilege	844	i_cavsnifaxs.exe
Token: SeDebugPrivilege	5008	i_hfzxspkhca.exe
Token: SeDebugPrivilege	5476	i_czxspkicau.exe
Token: SeDebugPrivilege	1620	i_smhezxrpjh.exe
Token: SeDebugPrivilege	1288	i_eztrmjecwr.exe
Token: SeDebugPrivilege	6020	i_ojebwtolge.exe
Token: SeDebugPrivilege	4792	i_ljdbvtomge.exe
Token: SeDebugPrivilege	5352	i_dbvqoigayt.exe
Token: SeDebugPrivilege	5628	i_sqkidavsnl.exe
Token: SeDebugPrivilege	1032	i_cxsqkicavp.exe
Token: SeDebugPrivilege	244	i_xvpnhfaxsq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 5000	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 5360 wrote to memory of 1164	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 1164 wrote to memory of 4036	1164	iexplore.exe	81
PID 5000 wrote to memory of 5604	5000	iexplore.exe	82
PID 5604 wrote to memory of 6060	5604	msedge.exe	83
PID 5604 wrote to memory of 756	5604	msedge.exe	84
PID 5604 wrote to memory of 5844	5604	msedge.exe	85
PID 5604 wrote to memory of 5844	5604	msedge.exe	85
PID 5604 wrote to memory of 5844	5604	msedge.exe	85
PID 5604 wrote to memory of 1664	5604	msedge.exe	87
PID 5604 wrote to memory of 1664	5604	msedge.exe	87
PID 5604 wrote to memory of 3704	5604	msedge.exe	88
PID 5604 wrote to memory of 3704	5604	msedge.exe	88
PID 5604 wrote to memory of 5600	5604	msedge.exe	89
PID 5604 wrote to memory of 3704	5604	msedge.exe	88
PID 5604 wrote to memory of 5600	5604	msedge.exe	89
PID 5604 wrote to memory of 5600	5604	msedge.exe	89
PID 5604 wrote to memory of 5304	5604	msedge.exe	91
PID 5604 wrote to memory of 5304	5604	msedge.exe	91
PID 5604 wrote to memory of 5304	5604	msedge.exe	91
PID 5604 wrote to memory of 1548	5604	msedge.exe	92
PID 5604 wrote to memory of 1548	5604	msedge.exe	92
PID 5604 wrote to memory of 1548	5604	msedge.exe	92
PID 5360 wrote to memory of 5016	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 5604 wrote to memory of 3388	5604	msedge.exe	94
PID 5604 wrote to memory of 4532	5604	msedge.exe	95
PID 5604 wrote to memory of 3388	5604	msedge.exe	94
PID 5604 wrote to memory of 4532	5604	msedge.exe	95
PID 5604 wrote to memory of 4588	5604	msedge.exe	98
PID 2064 wrote to memory of 8	2064	qkicavsnhf.exe	100
PID 5604 wrote to memory of 2956	5604	msedge.exe	103
PID 2956 wrote to memory of 1436	2956	msedge.exe	104
PID 5360 wrote to memory of 2772	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 5360 wrote to memory of 1652	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4488 wrote to memory of 5068	4488	faxsicausp.exe	113
PID 5360 wrote to memory of 5144	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5360 wrote to memory of 2244	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5976 wrote to memory of 1244	5976	pmhfzxrpjh.exe	122
PID 5360 wrote to memory of 4144	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 5360 wrote to memory of 2836	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1884 wrote to memory of 5048	1884	rpjecwrpmh.exe	131
PID 5360 wrote to memory of 5960	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5604 wrote to memory of 2252	5604	msedge.exe	136
PID 5604 wrote to memory of 3380	5604	msedge.exe	137
PID 5604 wrote to memory of 4408	5604	msedge.exe	138
PID 5604 wrote to memory of 3184	5604	msedge.exe	139
PID 5604 wrote to memory of 3184	5604	msedge.exe	139
PID 5604 wrote to memory of 4820	5604	msedge.exe	140
PID 5604 wrote to memory of 4820	5604	msedge.exe	140
PID 5360 wrote to memory of 2496	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5440 wrote to memory of 2808	5440	wrljebwtom.exe	145
PID 5360 wrote to memory of 4568	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 5360 wrote to memory of 2052	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 1284 wrote to memory of 2476	1284	gbvtolgeyv.exe	154
PID 5360 wrote to memory of 4036	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 5360 wrote to memory of 2760	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4208 wrote to memory of 5992	4208	dbvtolgeyw.exe	163
PID 5360 wrote to memory of 804	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 5360 wrote to memory of 3812	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4296 wrote to memory of 5216	4296	toigaysqli.exe	172
PID 5360 wrote to memory of 4192	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5604 wrote to memory of 3520	5604	msedge.exe	177
PID 5604 wrote to memory of 3520	5604	msedge.exe	177
PID 5360 wrote to memory of 3856	5360	2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_20d87d02dccd11ba089bf28c918619d3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fff4b2ac188,0x7fff4b2ac194,0x7fff4b2ac1a0
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,15578476409035294621,1002676634617994644,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,1633830171045704727,7545446301019474017,262144 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,9925773843100446160,5751076292712688916,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3716312932595336392,7302473175237339458,2097152 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13302839807909180523,4626327923444538903,2097152 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,10096474149876790436,2324229601889191619,2097152 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5016,i,9897687193672647420,14316512089399175932,2097152 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,4084378374833189731,1345476155079685718,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,5730626256267100530,14972634566692367258,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17474695407832096186,3507070862769245331,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,17474695407832096186,3507070862769245331,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,10069213924421820980,6004986876904409898,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1108
        5⤵
        
        PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17479662225473970273,9467879950461159172,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,186017310927439750,4161614137509191892,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,2856247158521482519,104594674585128914,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17996533448042949908,11887338416036798917,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,6567970908061346975,16371819835899486332,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,11833740814116600424,11149483458425801171,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,10189968355262848184,1441092910332003527,524288 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5180,i,644083741939170424,413853208780279365,262144 --field-trial-handle=2300,i,260423543372028489,16197874369250758185,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:10
      4⤵
      PID:2324
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicavsnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5016
- - C:\Temp\qkicavsnhf.exe
    C:\Temp\qkicavsnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:8
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicavsnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\i_qkicavsnhf.exe
    C:\Temp\i_qkicavsnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsicausp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Temp\faxsicausp.exe
    C:\Temp\faxsicausp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsicausp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5144
- - C:\Temp\i_faxsicausp.exe
    C:\Temp\i_faxsicausp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2244
- - C:\Temp\pmhfzxrpjh.exe
    C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Temp\i_pmhfzxrpjh.exe
    C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjecwrpmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\rpjecwrpmh.exe
    C:\Temp\rpjecwrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjecwrpmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5960
- - C:\Temp\i_rpjecwrpmh.exe
    C:\Temp\i_rpjecwrpmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrljebwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Temp\wrljebwtom.exe
    C:\Temp\wrljebwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrljebwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\i_wrljebwtom.exe
    C:\Temp\i_wrljebwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbvtolgeyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Temp\gbvtolgeyv.exe
    C:\Temp\gbvtolgeyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbvtolgeyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4036
- - C:\Temp\i_gbvtolgeyv.exe
    C:\Temp\i_gbvtolgeyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2760
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:804
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toigaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3812
- - C:\Temp\toigaysqli.exe
    C:\Temp\toigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toigaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4192
- - C:\Temp\i_toigaysqli.exe
    C:\Temp\i_toigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnifaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3856
- - C:\Temp\cavsnifaxs.exe
    C:\Temp\cavsnifaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnifaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2788
- - C:\Temp\i_cavsnifaxs.exe
    C:\Temp\i_cavsnifaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\hfzxspkhca.exe
    C:\Temp\hfzxspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\i_hfzxspkhca.exe
    C:\Temp\i_hfzxspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2184
- - C:\Temp\czxspkicau.exe
    C:\Temp\czxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Temp\i_czxspkicau.exe
    C:\Temp\i_czxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smhezxrpjh.exe ups_run
  2⤵
  PID:6072
- - C:\Temp\smhezxrpjh.exe
    C:\Temp\smhezxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smhezxrpjh.exe ups_ins
  2⤵
  PID:3728
- - C:\Temp\i_smhezxrpjh.exe
    C:\Temp\i_smhezxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eztrmjecwr.exe ups_run
  2⤵
  PID:1756
- - C:\Temp\eztrmjecwr.exe
    C:\Temp\eztrmjecwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eztrmjecwr.exe ups_ins
  2⤵
  PID:1396
- - C:\Temp\i_eztrmjecwr.exe
    C:\Temp\i_eztrmjecwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojebwtolge.exe ups_run
  2⤵
  PID:248
- - C:\Temp\ojebwtolge.exe
    C:\Temp\ojebwtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojebwtolge.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_ojebwtolge.exe
    C:\Temp\i_ojebwtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtomge.exe ups_run
  2⤵
  PID:6116
- - C:\Temp\ljdbvtomge.exe
    C:\Temp\ljdbvtomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtomge.exe ups_ins
  2⤵
  PID:2392
- - C:\Temp\i_ljdbvtomge.exe
    C:\Temp\i_ljdbvtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvqoigayt.exe ups_run
  2⤵
  PID:4560
- - C:\Temp\dbvqoigayt.exe
    C:\Temp\dbvqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvqoigayt.exe ups_ins
  2⤵
  PID:5568
- - C:\Temp\i_dbvqoigayt.exe
    C:\Temp\i_dbvqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnl.exe ups_run
  2⤵
  PID:2296
- - C:\Temp\sqkidavsnl.exe
    C:\Temp\sqkidavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnl.exe ups_ins
  2⤵
  PID:4744
- - C:\Temp\i_sqkidavsnl.exe
    C:\Temp\i_sqkidavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxsqkicavp.exe ups_run
  2⤵
  PID:5828
- - C:\Temp\cxsqkicavp.exe
    C:\Temp\cxsqkicavp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxsqkicavp.exe ups_ins
  2⤵
  PID:5964
- - C:\Temp\i_cxsqkicavp.exe
    C:\Temp\i_cxsqkicavp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  PID:980
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  PID:1832
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxrpkhc.exe ups_run
  2⤵
  PID:6020
- - C:\Temp\nhfzxrpkhc.exe
    C:\Temp\nhfzxrpkhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4692

C:\Temp\nkfdxvqkif.sys
C:\Temp\nkfdxvqkif.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\cxrpkhcaus.sys
C:\Temp\cxrpkhcaus.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\cxrpjhbzur.sys
C:\Temp\cxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:1648

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\zuomgeywro.sys
C:\Temp\zuomgeywro.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\ljgbytrljd.sys
C:\Temp\ljgbytrljd.sys
1⤵
- Executes dropped EXE
PID:4616

C:\Temp\avtnlfdyvq.sys
C:\Temp\avtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:5904

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\avsnkfdxvp.sys
C:\Temp\avsnkfdxvp.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\mkfcxupnhc.sys
C:\Temp\mkfcxupnhc.sys
1⤵
- Executes dropped EXE
PID:5480

C:\Temp\zwupmhfzxr.sys
C:\Temp\zwupmhfzxr.sys
1⤵
PID:5264

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
PID:1292

C:\Temp\ebztrmjecw.sys
C:\Temp\ebztrmjecw.sys
1⤵
PID:972

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
PID:2556

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:1296

C:\Temp\dbvtnlfdyv.sys
C:\Temp\dbvtnlfdyv.sys
1⤵
PID:2316

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
PID:820

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:2352

C:\Temp\usmkecxupm.sys
C:\Temp\usmkecxupm.sys
1⤵
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrpjhbzur.sys

Path C:\Temp\cxrpjhbzur.sys
Size 141KB
SHA256 de6c179cc44bd7a04008d29f438f14389011a458a7d19942a8cb8ab9eff1c928
MD5 f17266ed597f5ca061f3f4f542dbef91
SHA1 e56bd6cd789aeff39f6d1dad7e98e57e61c35c94
SHA512 a0ca02fbc74dcc51055ed39c762d4149c3049b7e508b40a866be9072e792365b3f607193822d83f3099c01cffb40bc970efe0dff35ded08b9ec8431473d765f6
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T1BBE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrpkhcaus.sys

Path C:\Temp\cxrpkhcaus.sys
Size 141KB
SHA256 93041c5df7a0ebcca542f1e0793352709cfaae2222d6778b36711cf9b58891de
MD5 29933e56100fb1195e4d86c7dbe0c282
SHA1 7a5c1a9a1d25c1b797e0754cabfe06e1aec4193d
SHA512 7b1f7bed16725422bb4697731ea085be2f13142994ff6c4e5c7fc7f09bb39d0ee50b703d6970d95cc0ba8a0171a64e0531a179965eb52f29653c807f949d0003
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T1BAE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsicausp.exe

Path C:\Temp\faxsicausp.exe
Size 230KB
SHA256 64230e7bfce7133768b183dfe6f0d6f01d735e2639cb2b0d99298d9ede1d5d5d
MD5 fdf81b1359b0445a8c931a34b955250f
SHA1 286cd3179db1cf565597f21604f9d8bd4d88ba11
SHA512 469cd8eca0ad194001fc5d1b23d43af0c06b844a199b452376792202fdb2968377199db541d27c0c872d5da8a3714ba54a740c107a108d75aca6bdda359a8f52
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtolgeyv.exe

Path C:\Temp\gbvtolgeyv.exe
Size 230KB
SHA256 e04ecf57e0ed9333ef7a0222248a8339a82f8c86703e27c18aff79fc45febd9b
MD5 2e8311e818bb29ecdf6e11a51273ba13
SHA1 4f80bd35d658c121e3045ade9d1ace5621cdb581
SHA512 50bf1126acd2638ba329e051ebc16669f0f1a7513df8e1766a8f1a3ea646885cb645495970b5c812c4c9d42dafa70bd0d283b231053ec7afc461064d020635d6
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.sys

Path C:\Temp\geywrojhbz.sys
Size 141KB
SHA256 51beadbc735bf556772af5ef52a558de36c9117af10d1adfbe67ed46173e8ddb
MD5 66ff08f344cd36a6351bac5d99c9ea23
SHA1 085ff055530ba480ccf48905fd7864fdf7e075ef
SHA512 f4f86353bf6623b68cf5ad056c1b81f8d616ec606dc133128f32d03beae8ee324ecd27b7991176a1e348c3a554eb0771d1d21cf997a33cbbaefae83ec5886f22
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T1E7E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faxsicausp.exe

Path C:\Temp\i_faxsicausp.exe
Size 230KB
SHA256 876f94179ac293f58cf55e7d144cdd6d0e0864d4c72ed5b56b73dcb18b0c0171
MD5 354d8f1d1657dd7e1b95000edd6d40fc
SHA1 38f8b9142807b96ff3a06f348618f65f3edcf3c6
SHA512 06bf02558bc420a3381595c79db84fdc558c0ba2bf0ac749c529f91cb27df6d629b47ac72cf676e39cb4989e0af3603e2a12c77d0e18a963f5dd93029c29ae6c
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbvtolgeyv.exe

Path C:\Temp\i_gbvtolgeyv.exe
Size 230KB
SHA256 7b5f153b7c63ff1e6dbda1c43f6229680f1f2fe3e136e43b9a590ad2cde842b2
MD5 9e4534f7fafb21661e7adb167882a39e
SHA1 6e659d96a6fc431f0e8c49a5e6489827cb6f37fe
SHA512 8f57c218a37cd00a2d38401d02f7b4a4e7c1a6086dd9838a62081938f94a1c65cdd59d189a5c2f758e0bcc0252d85b7ab6643521558d71af21fadd397ea359f0
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:MghLQ0sQmpcF8BzXfwVfAI
TLSH
T17C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxrpjh.exe

Path C:\Temp\i_pmhfzxrpjh.exe
Size 230KB
SHA256 a8ca49ba86af87d0d54e657a75ca087b74b2f7bac2cbf6417db1c29c0f64d2ac
MD5 009344dccf175026680a7826c4d93627
SHA1 27dcca9002c81e6a12dcc0597d6f5b3812a6e322
SHA512 0d38a0ada2f5d634c80db675db0e22450dfe580d4575dec87d65f829edad64ed14283ea16ebdd4bfcffda3d98b75b47e7e916131eaa8b3029530948fa15c33fc
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T19F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicavsnhf.exe

Path C:\Temp\i_qkicavsnhf.exe
Size 230KB
SHA256 f3647cf6e451ba436a53c6bb9de0fe0cd9d20f70f2e9a1adfa88e0510d3b48dd
MD5 b710561cbaf2c69fef34d374883fc3fc
SHA1 6c99488277bbfdc29b58b64a3357970f30ea2d5b
SHA512 a8f19aa448576d46e7fc4a466a36b4b16ece5fb51f7e63c06c9552f446cc259372440d03da05281c5c8117e2508853facb0c630cc57c0b0dbc4277a772a8a532
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjecwrpmh.exe

Path C:\Temp\i_rpjecwrpmh.exe
Size 230KB
SHA256 af501488d1105759c37cbf50765e375561dd8f3e89aefb4f4e964d3b247ba1ab
MD5 21c21e9991e84b35501a4941c29822fd
SHA1 00befa27c27c2004ed54624cd28edc75d0e4a59b
SHA512 053b303e38efcc4ced3dd8b0a15ae935555fe21be06eeff94b94f2663b9567025372a81660e9fa356fbbb0f8ffd9fd35330e8143a57a01fa6721cb89d327ab59
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrljebwtom.exe

Path C:\Temp\i_wrljebwtom.exe
Size 230KB
SHA256 cd6ad6a6e0835f6ec34f3b0d7fdbc2b302c89e7314069118146ed267653650df
MD5 1a4b711c3801a91efd77fb738684e202
SHA1 497768447786e584ebb3d39f8446415dbff6dabc
SHA512 a2602b339369d8993d023e1abd591853801f4a478abeebcb4e2ecf429661f71c8837e16d85f739d1ca66b5ba5930edaab5a95b83678b8500af9348d2c04f00c6
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbytrljd.sys

Path C:\Temp\ljgbytrljd.sys
Size 141KB
SHA256 2f7aea4ad0337cd0b27b0356f1cab515ce05e2d4652b9d5083e052834b80142d
MD5 3e3acb8206cfbdc6806759a3743440e4
SHA1 28a17a86e91841f1e5b49a1cbe977384c74e8a63
SHA512 e000bb334f2241efeafcd1927186b4921f35501d022049e545b2c207c109372b88377809b51a7ef7db715cda067444736c213de6355c1cf54abc7c56888e26d2
SSDEEP 3072:JsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:JsQmpcF8BzXfwV
TLSH
T1A2E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvqkif.sys

Path C:\Temp\nkfdxvqkif.sys
Size 141KB
SHA256 bc687d6b1a546768f412123117cf3f7babcb9ec7c783a57c5db21b2d2e07fba1
MD5 ba13b2ac6aae7abab59f6ed16e31abb7
SHA1 4f5fbb044fc94b120a7ae21582a2af3c60626edb
SHA512 1b8313e0e05bcdaa0fc636322583365131ca56849411b2ddffb575276d5fc33dd2d05b4250602517d66be3c54808fd268415c0254d9fd9106a0eac68941841ac
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T1DBE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpjh.exe

Path C:\Temp\pmhfzxrpjh.exe
Size 230KB
SHA256 4666074c36c3a58df62c871abdebfb4d28941fc1c542f18f44ed68c87814db68
MD5 5af4c367a00b6b71a8be001bab9c7dd2
SHA1 13da156fb9819f7b55459ffc531d896630107c5a
SHA512 f81f503882779dbf8d8b588d5b14366e9af6100902f3746871a375be748842afe53468b9932b14abadf6cf5627a796010f385bbfcaad16b9bf6fa07fb0989459
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnhf.exe

Path C:\Temp\qkicavsnhf.exe
Size 230KB
SHA256 d1f18cb7f9be0c4f839a0ce14beda04a994b833e124451c82786f3a1edb942db
MD5 a582c2b2a8ab5b0db33454a56c280c0c
SHA1 728938c132545f27e0589fb0f816461e2cda6b3b
SHA512 af74182c1d9599255fc6d089bab7d10f46c87ea0133631cd249e9bc36e58986f44ce025194eee82b5a2cb204857c2cdfebd64c15bd18d43af9bb942dc48b90b6
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjecwrpmh.exe

Path C:\Temp\rpjecwrpmh.exe
Size 230KB
SHA256 2a0da8c69b7201cd73bf0e4a20d1ef3dd82d2a93b856a78a6c8906d7c25dc601
MD5 17cb851c1e036c755a02d77382800288
SHA1 029084177cdf55ba091ffcb20846b6bc7343a88a
SHA512 a005e16defe80d3c4021bbfd7e7a08470d8d7ed172f1386dfa177a36c18b910f38c167c9b6bd86a237feb58bc9e8f0200557a132f3cf14266dfc1827d0438fa3
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T101344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrljebwtom.exe

Path C:\Temp\wrljebwtom.exe
Size 230KB
SHA256 304d515b36aab7c312220f23e73cde6411102cb08f8a16492b9229791410afe6
MD5 a66fc295c01cf48170e2e4ee675fe632
SHA1 fb7490d8d656d1cb4ecdf8a6cfe612d59d8cf983
SHA512 0989c1cfe70c4a8a5d880778d3c6579ead575b9bf0915df4bb0fe44cfe3607e91a81d680ff3811cb9cb3ad5de4b57543e2e094d4f4a51f3dd4bdbd338d192be0
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T114344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zuomgeywro.sys

Path C:\Temp\zuomgeywro.sys
Size 141KB
SHA256 0b201d625cb68b739e0d420eaff520283638adc7bdbc90c506d152c8fb3ef016
MD5 c9b012be04ed0787a13621fee5d3b1a3
SHA1 371589f51158da1860154916bbbe46b51da39cc5
SHA512 0dad6fce6e3cc4e7d1bf9be0b507f0a71032eb6d26743d83115c1c671a9753217ad004f1f820d8cb8c2b6ecb585502fa270709296bad24453ee4bd965de4496e
SSDEEP 3072:UsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:UsQmpcF8BzXfwV
TLSH
T1DDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 55adf7ef7a9bb5d9bf2478e13e0188df6ca76f9e32a6f2d3bf53697bd9c05c39
MD5 43ac941017a610f13514b8ae2f465755
SHA1 af167b9fb8bc4155848bead0879e375551dd512e
SHA512 89abc1296356c27e56d152d38bd512742f98458035ba51c9f7e7f91536d0486eb6c34aa34af3e342bbb735d658749cf59fc5441980cf22da7667bc5f52a9583c
TLSH
T18FE02BAAC860AC3B49FD572910494B45E76017571B848C5BBA3CD1098FB16378546C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 48b34a3ec384b68af7c50c16376c09c96dd80e4ceec0dde47fd78a4d43848d84
MD5 1b4041ae38ba9056d69a332de243d009
SHA1 941977c82a51ec8bd70a49984b9ad60a1636de53
SHA512 1346ff3c7f4a2adad8f314f3d57a473e47f90204b06ff65ad2dbdd1e82a5b8b7a347bf6bf5ecd6fc2587f52f7d958a10f3690a3ca4eeb016ec3b7849b1e824af
TLSH
T13741CBF7C3E4856E8A015AF0AA186E2FCE2D0950432C3C5AC9E4AF1B93E2460E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0cdfbb05d44af3c4d283a4b6355fdf74f81e335b9658622849b74bcb27dbdc9b
MD5 42772cd9b9e27fe31edf9dfc9fb9e761
SHA1 eae419bde64bfc36d8cfbd9522673f23fdbe4288
SHA512 9e8ff27a5c5ab9e4325beedb57c7ba4848f41a0afba0e6b48dd5a0bc5967f0a2d1db6ac43c11184782a175cf3912de9f7633dfe9f1dbfc235d312d2d13e106e7
SSDEEP 192:sxZ1RxyMqZ/K1Ml8UQAce/fPsUlW36WILcvzodpZX/W6+WNsoo/Y0lwaBELXIg5e:sxZ1Oq/e/fPsUlW3kh/bo/5qjGV
TLSH
T19872F916AA389D7B8CD7D219FA55BF53D7F9156292440D449AFCCF0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3ad803d80024fac8ed4284b469f4c44048f1a1f07eeb55cee6f439a6a06e6f95
MD5 8553261611a4759c5abb5f73e7bbe642
SHA1 adc54c9cf1b97818c3f3ce395ad696c2c59b5ebf
SHA512 c3d77dfa66262a031901a28b1372b56c10e4c2e3e31e413fc63cc06d18d5849918eb6c265bc13cd35763a21eec61281bc2124c50e7e38e95300f3ce04e9769c8
SSDEEP 192:sxZ1RxyMqZ/K1Ml8Mce/fPsVAW36WILcvzodpZX/W6+WNsoo/Y0l6a4QLXIgjlJ:sxZ1O0e/fPsVAW3kh/bo/5vjjP
TLSH
T15172E906AA389D7B8CD7D219FA45BF53D7F9156292444D449AFCCB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d08b17d979b91cd1d2d40a73ffca1eb624ab1b40445e02d542aa565919947fe2
MD5 a6de1e25f2615632073d0c1d9f90dcf4
SHA1 428b691b608685154e67acd5461b763d855f77f9
SHA512 c6fc86852b2d2e74d8e231c818656712c15271e2213ca56ec5b5af401fde5eb9948ac8ae3f0326899ec621a53d4735631ec58a81fe551b5d280b594db2b4fba7
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3/7yZLl8:EZN9b8PT24ZE/CuWRmCCQx6u1jaK/7yw
TLSH
T1F1031C3B2C0CCB7E4F804E9CDD26AE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 b10d3c79c40b6d6ab0b13b5eef5c3701b6d1bb8f2484f41d49676b00e1aaf19b
MD5 700f4394107b7ca7d07d1cfafcc5c19f
SHA1 48d6b41c5828b98b7348c1401e01afbfa321122e
SHA512 73fa6c0e16bc1afda057e53d71d8dbebc7a7840d4cda657ed24656b2981bfc82cec7a8582825c72590e3eab84e20f1ec8249e4c83a1b1250b0e36e712a20a186
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZJdAn8:cdOlNXJjSSjroduZJdAn8
TLSH
T1E8C26F55713B23903ABD298A8594F8AF42C231633018E47B7BB9546E0F67E14DCFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 86acd3a2962d20f2d4122f247fd99906b34bf6f6abec10a4ada6b85c477cd27b
MD5 7b12e12268877f054aa4e3528771b78a
SHA1 6669db5482502bf6849b5e791bd3ba02844b4efd
SHA512 eaae8bd5c020736ad114f733587bf7f2de5f2361609ae475272a83ea89b33482ea135c11dbbf57450cd31cca5c1debbb5918a73f8aa297248271ebf0b071d097
SSDEEP 768:OF/cpy3UwgibDQRKhAswRa9hkoFYS/5LEh4:9y3BbpAdRMhkoaO3
TLSH
T1C0E2B3F198DB8977E89E4B87A73D2E42A9FCC063B5484994F7851D0CCC961BFD70A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b3d92d0c26dd2700e5abc9fc59c8fc53a98cacaa206b8745382edd8a7e87ce52
MD5 f52d7349c9844c12412cc961dc0dffa6
SHA1 801208db2a4c5febca41a18bd26cf3212175f21e
SHA512 5d16b7a2fbb09091b8b989a669aa6607cf905e7908a6413350ef707c8725b98a98c22777f2977e28372567b592992c0c3689deec21157a625bfd00ff875f3076
SSDEEP 384:npiFavqMg38Ny8TUNTUlIxB4d45JFK14f1K+kAswqD3Ra49VErrN1k+5vI+G:AFayv3hwgL3FlKhAswqD3Ra0V66
TLSH
T1BBC23971EC98CAABEDEA4FC9E7097607EFE001A7998C4AD4DAD81D0D00971DD230BD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c20b1ef13aace779b2ed87536cf6308854cfe70cd94e4b894a9829c0b4c031c0
MD5 d3cce68d17c9d375ff4962ab14fa6e67
SHA1 e8328d8cd83bb9b4b7202f92025b539ed7ba58f9
SHA512 2b28c2989cdcf00c0352e35d6f0c0cd505421ba71c5739ceab58469b686baf6f33284a6ef85791adce7f7a9bd555fd67f829a96cefe72dbcf136994e2062a6a5
SSDEEP 384:n0iFavqMg38Nj8TUNTUlIxB4d03M14f1K+kAswR3D93Ra49VErrN1k+5vI+G:PFayv3kwg3XKhAswRz93Ra0V66
TLSH
T1C8C24A71EC98DDA7ADEA4FD9B70A7647EEF001A3898C8AD4DAD81D0D00971DD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ad4d2564947f7f1d78e43b568f6204983b0890e30340eacb89ea852c9ea4a5b
MD5 04f19b25ec651feef0101418d4fb8faa
SHA1 e0c9586ed3b7876ba7e3e3cf5748740227a7faee
SHA512 b0713d4c0f8cf33847600ff7336bca00bd87160759a5346171c3e3b0d66849886f387c3526124dd8cd163939d1d3718fba55ee77f568780029488f6fa14be155
SSDEEP 768:DF/cp5s3UwgibeQRKhAswRZ9hkoFYS/5LEh4:c5s3BbYAdRPhkoaO3
TLSH
T1D0C24B32E899DE67ACEA4ACAF71A7A43EEF00163858C9AD4D9C91E0C00971DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f36c841656e1d5e6a996c80f66e9241eb3fae3dfe4698e60f6efebe5a16d846f
MD5 693f281a2b9c6801222b6d7875c9ff13
SHA1 39db0924e8d1bfdfd2e463394e0fcda996a2acd0
SHA512 6e591b83269b552ea8955d3e5d9b294f5afc9779384d59a311fe7af921c0c7b2eb725063386ff2f8fb37d03ba6f4ea70b18cb0e42753dd7cf02aa11aae21f880
SSDEEP 384:nsiFavqMg38NP8TUNTUlIRy4dwWP14f1K+kAswR3D93Ra49VErrN1k+5vI+D:XFayv3UwgnoKhAswRz93Ra0V6H
TLSH
T191C23A71EC98DDA7ADEA4FD9B71A7643EEF001A3898C8AD4DAD81D0D00971DD230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8e2baa39dc31b3508f8ebfd9fee3b11e13c532350c24a3b8a8421581e722f902
MD5 ac92269f6b09a4ee69e557a565c6293c
SHA1 b63eaab746c28818893b3ab2822c4d7ddb041e76
SHA512 8ddc8601054fc0bc80dcb3f62f3559dd62494df8bdb43664afbc6cef94cd4fc0e9ad26ba1ebfbc6c267fb995befc30b7f1a1a7f0a5751f8062b67c45e433ef0d
SSDEEP 768:XFLcpH3UwgibiQRKhAswRF9hkoFYS/5LEh4:oH3BbsAdRjhkoaO3
TLSH
T1EEC24B32E899DE67ACEA4ACAF71A7A47EEF00163C58C99D4D9C91E0C00D72DD170BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1ed5b361c991dea74d1a56d8037f054d32adaa63d3f4700481cc12bcf8c5e08b
MD5 1343a22e0620b04c40899fd5427e7dd2
SHA1 5208d7bc5a032c1a5945d4e69b3b0bca5db5bc79
SHA512 0c5985a698a85f703ed2bbea61077b1f6195b3fdc52e2891cd1d99ed998f996a83ff32b0f1d2222be5b6e824c01efd68985c1b6445f748eaf27f3c0dbc41c2a6
TLSH
T1A74161D14C3E66D1D4FC0E3E709B78FC96D8D729F4A4347D6828EA84063A61D644043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_1542762138\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5604_1542762138\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/820-727-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/964-751-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/972-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1296-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1436-103-0x000001A760570000-0x000001A7605DF000-memory.dmp

Download

memory/1648-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2316-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2324-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2352-769-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2352-747-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2720-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-530-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4616-564-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5264-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5480-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5488-588-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download