26bbbf86d3ac07c1be7456f7dc69582298c7b8482d8fa5ad03d115f395978d6d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260518-cejevsa19m
SHA256 26bbbf86d3ac07c1be7456f7dc69582298c7b8482d8fa5ad03d115f395978d6d
MD5 fb542fc09b295bf7c4d90a32c42850f3
SHA1 e483bb42beebf90c6c1e6ab64e70ef33530f7ee7
SHA512 94f54a81f94cb37667cfc6399d0ad4d7f6a66b2e0f3afce7ac5ababe918dccd050183ffc155d83245bd723900a32330eda03be4538454998151d26d538d58c57
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T13434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2164	CP.exe
5148	ecwuomhbzr.exe
1724	CP.exe
2808	CP.exe
5356	i_ecwuomhbzr.exe
1152	uomgeywroj.sys
1856	CP.exe
1956	mgeywrpjgb.exe
5924	CP.exe
5944	CP.exe
2452	i_mgeywrpjgb.exe
2916	tomgeywrlj.sys
4524	CP.exe
4336	yvtolgeytr.exe
4572	CP.exe
5536	CP.exe
3992	i_yvtolgeytr.exe
5684	gbytrljdbv.sys
2932	CP.exe
1836	wqoigbytol.exe
4008	CP.exe
4508	CP.exe
3896	i_wqoigbytol.exe
584	qlidbytqli.sys
2056	CP.exe
2180	gavtnigays.exe
5216	CP.exe
2900	CP.exe
5360	i_gavtnigays.exe
228	axsqkicavs.sys
944	CP.exe
4676	snlfdxvpni.exe
3720	CP.exe
5176	CP.exe
4628	i_snlfdxvpni.exe
5844	ysqkicavsn.sys
5632	CP.exe
3360	fcxvpnkfdx.exe
5352	CP.exe
1900	CP.exe
1592	i_fcxvpnkfdx.exe
3448	fcxvpnhcau.sys
1504	CP.exe
2404	rpkhcausmk.exe
4328	CP.exe
5984	CP.exe
2004	i_rpkhcausmk.exe
6136	jhczurmkec.sys
4564	CP.exe
2624	zuomhfzxrp.exe
2108	CP.exe
5140	CP.exe
3216	i_zuomhfzxrp.exe
2012	omjecwuomg.sys
3896	CP.exe
2604	geywrojhbz.exe
2168	CP.exe
6052	CP.exe
6004	i_geywrojhbz.exe
3388	ojhbztrmje.sys
5232	CP.exe
5016	wrojgbytrl.exe
3704	CP.exe
5204	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtolgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gavtnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gavtnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtolgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtomgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrpjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxrpkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtomgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrpjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtolgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtolgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhbzr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxrpkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhbzr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3812	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1740	ipconfig.exe
2416	ipconfig.exe
816	ipconfig.exe
4864	ipconfig.exe
4960	ipconfig.exe
4556	ipconfig.exe
6120	ipconfig.exe
1756	ipconfig.exe
5336	ipconfig.exe
5496	ipconfig.exe
1420	ipconfig.exe
4748	ipconfig.exe
448	ipconfig.exe
4920	ipconfig.exe
4616	ipconfig.exe
5428	ipconfig.exe
4384	ipconfig.exe
124	ipconfig.exe
4884	ipconfig.exe
4540	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31254714"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3118281476"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237950899148704"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{766524B1-9E85-4D1C-9A2A-102C330A368D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found
692	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5356	i_ecwuomhbzr.exe
Token: SeDebugPrivilege	2452	i_mgeywrpjgb.exe
Token: SeDebugPrivilege	3992	i_yvtolgeytr.exe
Token: SeDebugPrivilege	3896	i_wqoigbytol.exe
Token: SeDebugPrivilege	5360	i_gavtnigays.exe
Token: SeDebugPrivilege	4628	i_snlfdxvpni.exe
Token: SeDebugPrivilege	1592	i_fcxvpnkfdx.exe
Token: SeDebugPrivilege	2004	i_rpkhcausmk.exe
Token: SeDebugPrivilege	3216	i_zuomhfzxrp.exe
Token: SeDebugPrivilege	6004	i_geywrojhbz.exe
Token: SeDebugPrivilege	1160	i_wrojgbytrl.exe
Token: SeDebugPrivilege	1228	i_ljdbwtolgb.exe
Token: SeDebugPrivilege	3968	i_aytqljdbvt.exe
Token: SeDebugPrivilege	3624	i_qnifaysqki.exe
Token: SeDebugPrivilege	3248	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	2364	i_usmkfcxupf.exe
Token: SeDebugPrivilege	244	i_kecxrpkhcw.exe
Token: SeDebugPrivilege	3976	i_omgezwrpjh.exe
Token: SeDebugPrivilege	796	i_ywtomgbztr.exe
Token: SeDebugPrivilege	4800	i_wrojytrljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2984	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 2984 wrote to memory of 2060	2984	iexplore.exe	81
PID 2060 wrote to memory of 1192	2060	msedge.exe	82
PID 2060 wrote to memory of 3812	2060	msedge.exe	83
PID 2060 wrote to memory of 5480	2060	msedge.exe	84
PID 2060 wrote to memory of 5480	2060	msedge.exe	84
PID 2060 wrote to memory of 5480	2060	msedge.exe	84
PID 2060 wrote to memory of 3292	2060	msedge.exe	85
PID 2060 wrote to memory of 3292	2060	msedge.exe	85
PID 2060 wrote to memory of 5920	2060	msedge.exe	86
PID 2060 wrote to memory of 5048	2060	msedge.exe	87
PID 2060 wrote to memory of 5920	2060	msedge.exe	86
PID 2060 wrote to memory of 5920	2060	msedge.exe	86
PID 2060 wrote to memory of 5048	2060	msedge.exe	87
PID 2060 wrote to memory of 5048	2060	msedge.exe	87
PID 2060 wrote to memory of 4324	2060	msedge.exe	90
PID 2060 wrote to memory of 4324	2060	msedge.exe	90
PID 2060 wrote to memory of 4324	2060	msedge.exe	90
PID 2060 wrote to memory of 2516	2060	msedge.exe	91
PID 2060 wrote to memory of 2516	2060	msedge.exe	91
PID 2060 wrote to memory of 2516	2060	msedge.exe	91
PID 2484 wrote to memory of 2164	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	92
PID 5148 wrote to memory of 1724	5148	ecwuomhbzr.exe	95
PID 2060 wrote to memory of 4948	2060	msedge.exe	98
PID 2060 wrote to memory of 1672	2060	msedge.exe	99
PID 2060 wrote to memory of 4948	2060	msedge.exe	98
PID 2060 wrote to memory of 1672	2060	msedge.exe	99
PID 2060 wrote to memory of 676	2060	msedge.exe	100
PID 2060 wrote to memory of 3300	2060	msedge.exe	102
PID 676 wrote to memory of 4984	676	msedge.exe	103
PID 2484 wrote to memory of 2808	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 2484 wrote to memory of 1856	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 1956 wrote to memory of 5924	1956	mgeywrpjgb.exe	112
PID 2484 wrote to memory of 5944	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 2484 wrote to memory of 4524	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4336 wrote to memory of 4572	4336	yvtolgeytr.exe	121
PID 2484 wrote to memory of 5536	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2484 wrote to memory of 2932	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1836 wrote to memory of 4008	1836	wqoigbytol.exe	130
PID 2484 wrote to memory of 4508	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2060 wrote to memory of 1000	2060	msedge.exe	135
PID 2060 wrote to memory of 2456	2060	msedge.exe	136
PID 2060 wrote to memory of 3748	2060	msedge.exe	137
PID 2484 wrote to memory of 2056	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 2180 wrote to memory of 5216	2180	gavtnigays.exe	142
PID 2484 wrote to memory of 2900	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 2484 wrote to memory of 944	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 4676 wrote to memory of 3720	4676	snlfdxvpni.exe	151
PID 2484 wrote to memory of 5176	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2484 wrote to memory of 5632	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 3360 wrote to memory of 5352	3360	fcxvpnkfdx.exe	160
PID 2484 wrote to memory of 1900	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2484 wrote to memory of 1504	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 2404 wrote to memory of 4328	2404	rpkhcausmk.exe	169
PID 2484 wrote to memory of 5984	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 2060 wrote to memory of 5260	2060	msedge.exe	174
PID 2060 wrote to memory of 5260	2060	msedge.exe	174
PID 2484 wrote to memory of 4564	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 2624 wrote to memory of 2108	2624	zuomhfzxrp.exe	181
PID 2484 wrote to memory of 5140	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	184
PID 2484 wrote to memory of 3896	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 2604 wrote to memory of 2168	2604	geywrojhbz.exe	190
PID 2484 wrote to memory of 6052	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 2484 wrote to memory of 5232	2484	2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_fb542fc09b295bf7c4d90a32c42850f3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff96658c188,0x7ff96658c194,0x7ff96658c1a0
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9903943603111020958,721332732142248704,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      System Time Discovery
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,5053896434637858876,14426431330852320314,262144 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,4066530591592402076,6692401179108461063,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,16747861225581130173,6768371813094396348,2097152 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,15743970560001606101,16633318578600831818,2097152 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4800,i,11233822070368226164,1338625801085381960,2097152 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4688,i,2630081285372460992,10721907180026291633,2097152 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,2375911297967024550,17909586245627040348,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15690885648154386385,10232438375265259271,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
      4⤵
      PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,1445495227530563761,13755239786434260202,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,896108946600734968,4853918458061225779,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,896108946600734968,4853918458061225779,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,17658183269029380794,8004751166359136605,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,555856547218803553,14786733044309809501,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,13239602407790733173,2168808275944766846,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,7122837875986255306,10711524469167979467,524288 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6372,i,11817577344113916915,860239258249386618,262144 --field-trial-handle=2100,i,5542443716644921618,10152420209058928178,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhbzr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2164
- - C:\Temp\ecwuomhbzr.exe
    C:\Temp\ecwuomhbzr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhbzr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\i_ecwuomhbzr.exe
    C:\Temp\i_ecwuomhbzr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrpjgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\mgeywrpjgb.exe
    C:\Temp\mgeywrpjgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrpjgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5944
- - C:\Temp\i_mgeywrpjgb.exe
    C:\Temp\i_mgeywrpjgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtolgeytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4524
- - C:\Temp\yvtolgeytr.exe
    C:\Temp\yvtolgeytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtolgeytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5536
- - C:\Temp\i_yvtolgeytr.exe
    C:\Temp\i_yvtolgeytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2932
- - C:\Temp\wqoigbytol.exe
    C:\Temp\wqoigbytol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\i_wqoigbytol.exe
    C:\Temp\i_wqoigbytol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gavtnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2056
- - C:\Temp\gavtnigays.exe
    C:\Temp\gavtnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gavtnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2900
- - C:\Temp\i_gavtnigays.exe
    C:\Temp\i_gavtnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvpni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:944
- - C:\Temp\snlfdxvpni.exe
    C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvpni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5176
- - C:\Temp\i_snlfdxvpni.exe
    C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5632
- - C:\Temp\fcxvpnkfdx.exe
    C:\Temp\fcxvpnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1900
- - C:\Temp\i_fcxvpnkfdx.exe
    C:\Temp\i_fcxvpnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1504
- - C:\Temp\rpkhcausmk.exe
    C:\Temp\rpkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5984
- - C:\Temp\i_rpkhcausmk.exe
    C:\Temp\i_rpkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4564
- - C:\Temp\zuomhfzxrp.exe
    C:\Temp\zuomhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\i_zuomhfzxrp.exe
    C:\Temp\i_zuomhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Temp\geywrojhbz.exe
    C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\i_geywrojhbz.exe
    C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5232
- - C:\Temp\wrojgbytrl.exe
    C:\Temp\wrojgbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Temp\i_wrojgbytrl.exe
    C:\Temp\i_wrojgbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtolgb.exe ups_run
  2⤵
  PID:4804
- - C:\Temp\ljdbwtolgb.exe
    C:\Temp\ljdbwtolgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtolgb.exe ups_ins
  2⤵
  PID:4012
- - C:\Temp\i_ljdbwtolgb.exe
    C:\Temp\i_ljdbwtolgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqljdbvt.exe ups_run
  2⤵
  PID:1140
- - C:\Temp\aytqljdbvt.exe
    C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqljdbvt.exe ups_ins
  2⤵
  PID:5520
- - C:\Temp\i_aytqljdbvt.exe
    C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  PID:3924
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  PID:2952
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run
  2⤵
  PID:2296
- - C:\Temp\fdxvpnhfax.exe
    C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
  2⤵
  PID:5048
- - C:\Temp\i_fdxvpnhfax.exe
    C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxupf.exe ups_run
  2⤵
  PID:3940
- - C:\Temp\usmkfcxupf.exe
    C:\Temp\usmkfcxupf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxupf.exe ups_ins
  2⤵
  PID:4956
- - C:\Temp\i_usmkfcxupf.exe
    C:\Temp\i_usmkfcxupf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxrpkhcw.exe ups_run
  2⤵
  PID:5832
- - C:\Temp\kecxrpkhcw.exe
    C:\Temp\kecxrpkhcw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxrpkhcw.exe ups_ins
  2⤵
  PID:2020
- - C:\Temp\i_kecxrpkhcw.exe
    C:\Temp\i_kecxrpkhcw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  PID:688
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  PID:3984
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtomgbztr.exe ups_run
  2⤵
  PID:5712
- - C:\Temp\ywtomgbztr.exe
    C:\Temp\ywtomgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtomgbztr.exe ups_ins
  2⤵
  PID:5728
- - C:\Temp\i_ywtomgbztr.exe
    C:\Temp\i_ywtomgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojytrljd.exe ups_run
  2⤵
  PID:4728
- - C:\Temp\wrojytrljd.exe
    C:\Temp\wrojytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojytrljd.exe ups_ins
  2⤵
  PID:4828
- - C:\Temp\i_wrojytrljd.exe
    C:\Temp\i_wrojytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5020

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
- Executes dropped EXE
PID:1152

C:\Temp\tomgeywrlj.sys
C:\Temp\tomgeywrlj.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
- Executes dropped EXE
PID:5684

C:\Temp\qlidbytqli.sys
C:\Temp\qlidbytqli.sys
1⤵
- Executes dropped EXE
PID:584

C:\Temp\axsqkicavs.sys
C:\Temp\axsqkicavs.sys
1⤵
- Executes dropped EXE
PID:228

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\fcxvpnhcau.sys
C:\Temp\fcxvpnhcau.sys
1⤵
- Executes dropped EXE
PID:3448

C:\Temp\jhczurmkec.sys
C:\Temp\jhczurmkec.sys
1⤵
- Executes dropped EXE
PID:6136

C:\Temp\omjecwuomg.sys
C:\Temp\omjecwuomg.sys
1⤵
- Executes dropped EXE
PID:2012

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\ztolgbytrl.sys
C:\Temp\ztolgbytrl.sys
1⤵
PID:5472

C:\Temp\lgdbvtnlgd.sys
C:\Temp\lgdbvtnlgd.sys
1⤵
PID:1380

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
PID:2512

C:\Temp\xspnifavsq.sys
C:\Temp\xspnifavsq.sys
1⤵
PID:5368

C:\Temp\hcausmkfcx.sys
C:\Temp\hcausmkfcx.sys
1⤵
PID:1600

C:\Temp\spkhczusmk.sys
C:\Temp\spkhczusmk.sys
1⤵
PID:2036

C:\Temp\zxrpjecwuo.sys
C:\Temp\zxrpjecwuo.sys
1⤵
PID:240

C:\Temp\rpjhbztjey.sys
C:\Temp\rpjhbztjey.sys
1⤵
PID:4992

C:\Temp\gebwtomgey.sys
C:\Temp\gebwtomgey.sys
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.sys

Path C:\Temp\axsqkicavs.sys
Size 141KB
SHA256 8ed9f642c5f0d6cbfa58fab6f90bf8564ee1629409d1c8139674381cd81034e7
MD5 e659d86f9b825f4c04e5f27f4e43ff36
SHA1 379a955bc092c5dbfcb0a95e544dc89d260a0f35
SHA512 145009d71d25c9af3ca4615f217c2e16bf25839b5a8d68a0cefd6d99a43cd4497d1f27dd14fc87bd700d96ad92bf2079ed0affd776cad87b80f3862c9371531f
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T130E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhbzr.exe

Path C:\Temp\ecwuomhbzr.exe
Size 226KB
SHA256 2ef64bf076ce7600253865375e60d062820341e0fe7dafe3d6604fee095a74ea
MD5 3bc1cf79294800ab7239c40299bbeca4
SHA1 b348981d814e4ea0013e2dffb7eda328b659cffe
SHA512 257643714e79aff159dfc27af4534e59702b6035c09ef1813e73b98cb27ca7fd92ccb88356733cac6ffd608cd3de9ccecfd3d842f9475cf8d26b6c455ba6b3d5
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnkfdx.exe

Path C:\Temp\fcxvpnkfdx.exe
Size 226KB
SHA256 4b4bc39a6fd8da1a3bbe5b8788a31fb2cf7beddc7e0b9b8fa37a1a6dd5fb542f
MD5 deb2c4691f58c72b9e0168891446e4f9
SHA1 ba8d7c21abe471e94d1b2a30e602414eedaf764b
SHA512 5658d9039de77c6658b4d3a8b19dae75c796f7a9fbf173c8d5acc8637fe5f3f2a20fc485859fa2a4127079d8fa159a8387bb769dbf65016581794cb6b465a5db
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T17B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gavtnigays.exe

Path C:\Temp\gavtnigays.exe
Size 226KB
SHA256 30af361109df54a48e16174246af529e43f6ed71783b259391b5b6168b64deb5
MD5 91569dac795af5469e4d28c0b52a4d24
SHA1 bbafc2e20c6bd066e338ce67a2026abf705f46bd
SHA512 9305e82e1f534820af146b88f519fc023071f73c4de420422fe8372620dfe7d8609a9f26002771356aa38dafced85d99a503fed7d45c34cd17517eca26ca67f1
SSDEEP 3072:YGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:fXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.sys

Path C:\Temp\gbytrljdbv.sys
Size 141KB
SHA256 5e2116a63f312e9b6213c329c9279bd62d581c8d6af33a7e49eae2fa83002efb
MD5 c7c709358aa59e58dbd290368e4bdc3f
SHA1 e6c29590c861f429b990abff18738299582b1738
SHA512 800c7882e28928fa2fce956b4569b98f530726e0834985ecc55c8b9b41ce97a36b0f2e209e447ae3f687f12eb5391da48e4acd06834d3f09d114368107de12fd
SSDEEP 1536:aa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:aa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T104E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomhbzr.exe

Path C:\Temp\i_ecwuomhbzr.exe
Size 226KB
SHA256 10040aa8e87535170c7ba56faa721bb41c35457a171a2171611670b2192d4656
MD5 605d4afa64bd9a0e80e22621aa78ad30
SHA1 ccb616bed672ac6d8f7cd11e09b3869f8904fe49
SHA512 fe1a342f9c8ab2f294a4582aa0dd8dd912aaa29f591bea1ef4609b6702034dd6ffc5e8b4c8e186850064e776459b0a828a62d14a3bdba4f46a1131eff9653d0b
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T13A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gavtnigays.exe

Path C:\Temp\i_gavtnigays.exe
Size 226KB
SHA256 c7d362496f7e2d5825e056af2af902890ac4e8b4d10f3f3f309a6196e2035bc4
MD5 9f1a0c70f216d1e349dd957faf6212d4
SHA1 823aa526144bfa359e5b897143d31b736d5337a2
SHA512 8efd558c107691469e63c840cc9e65093dddb527e6efd38d1d4e2301a198f58cb9a3143a130e84c361d159785d357d9364520fea44e9aa1f208a8e77d6f135f9
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T1B434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywrpjgb.exe

Path C:\Temp\i_mgeywrpjgb.exe
Size 226KB
SHA256 c580af907f6a0d95e3ce01621ce651bda0c9ea1d1cc1f102cb26fbd819942380
MD5 ca5e7990918a83d8d3e16ac74a983e19
SHA1 8aca37c472fe073f769a27279bd81ff3155a06ee
SHA512 32a217b2b80ea62ca06775d4b24ff3ce679b1adb90635d5acdea14400ed834160999ac186cbd86091409f87a61fa4f506ef5a1ed83c4d2f02b6162e146ec7e26
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1BE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpni.exe

Path C:\Temp\i_snlfdxvpni.exe
Size 226KB
SHA256 9d5f40cb2ecaaa6a954070082024520675d9bdaed9fc9db9e66a6493bea4f152
MD5 96a4e8dcac5b266b93fbb1135d2d9cf9
SHA1 b3bff6aee14b451a672a23518e0c48dae428971b
SHA512 03026f56ad8a3da6ef1c90d60b504d25c9c3b357befa0d8a9365725bda4e45bc23c95c8776f707cdc8e7670b6c53edbc73983cbda9292c01b334134e05c82015
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1DB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqoigbytol.exe

Path C:\Temp\i_wqoigbytol.exe
Size 226KB
SHA256 711b5611867fd2e0876e4c8e888b227fbab872e87f50274817cba448765f70e7
MD5 ae47b45a232f1b9996340b3da8bdda30
SHA1 dc7dd468c7e9fc379a76c5705643ff66724c53f0
SHA512 aa1c6d3254d63189cc4a288fd2042b01bfd7ce7a5ef784799f813097c753dceb48204e236882512b2e26aa3ae287ad287a80144cc2419e36c3b6f1d105b70a1b
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtolgeytr.exe

Path C:\Temp\i_yvtolgeytr.exe
Size 226KB
SHA256 23ebfae9a3a76a00579fbe60e666c9f381e4b53a6c3514ca8a62026e9f31b071
MD5 a6214fbc33bc98cf5bd57fb8cda74654
SHA1 877509a2e31c6e2f321d8f2f99af9271e1274f1e
SHA512 808a1118a5f31a54c9fd6cec0a3eebaf08f32ad871a2349655a689450218a5fcd219aa79a27b8dfadc3e8624144c5640dca946f8f668106ab74fd8bded5ae324
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1E834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrpjgb.exe

Path C:\Temp\mgeywrpjgb.exe
Size 226KB
SHA256 e937dc841b764b5ccd6c79080464f4920635872303e79e1a959fce234e25d6be
MD5 ef0458d1befc2a1165631b6b63f134a0
SHA1 6290fd3cb2ddcd7eec7fce69bed476cc0a4ff10d
SHA512 ae8e4db83bbdab25eccd13cd4816f64ad6a3e7fc071cf4ab6945b6bfa9c67fbec21820523595d3c29ff15b372d3cb0748b36f22e8bc7a7ad7d7072af41e76283
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T15734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbytqli.sys

Path C:\Temp\qlidbytqli.sys
Size 141KB
SHA256 d3e7ae976a7e7ea80649b75d9b6701e043ad84b96ebd28b2215fb68fca4daa48
MD5 3e4fa8c4c3269e43f4e5bc9d654bba95
SHA1 0b3104980559d1001866b1ff1512216e3ffb554d
SHA512 443224b667768ef26028c51edb1158a63c772d4d836a40a6853179b622c67f59997fc3264f073de1fae8214607481b34a260c9a7278e6377f96fb8a41a7d2053
SSDEEP 1536:Ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12BE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 226KB
SHA256 f574ce8060d0fe96cdaf8e53eb8b844c9dcf968b78e572a5c8f5549b097fba52
MD5 5e57e55e2a9da6d87b3a2e08337a3cbe
SHA1 f1955c2db4ef307612355ad642ff0d098dbc18ed
SHA512 3aaf2c11cce07ec695262e8ff717e76d34671c7d7c7f3c38099db3e1d0873ff7e6f80393deab7f39e12152b15fdbcfdb59d742390f143d94914f9e26dfb2388b
SSDEEP 3072:EGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:rXY4LK+a3lLNngoqRttA7
TLSH
T12A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywrlj.sys

Path C:\Temp\tomgeywrlj.sys
Size 141KB
SHA256 a3f104b8c5c5041f27aed47d4b7f4797cb88f4975977a9c3baa6bba023c55dec
MD5 804900e75eb2df46271e4d14f08a26a3
SHA1 561e4de86df230d90a31a082f2e56ed5f32b2883
SHA512 9491c2dd93adbd12f0b615b7116022fe89200b88bb3c5596284ddf9855d4bc6ea7d5b1614542329e9f74c0ef12c322409c86e3a6f3c7f429821e1f9b03c1fd44
SSDEEP 1536:ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T136E38C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywroj.sys

Path C:\Temp\uomgeywroj.sys
Size 141KB
SHA256 51185a69b121c6c7c622eff409fc9098782f920972d58c31ba730145210fe958
MD5 fa3c293f5ca87fb4e392017a8f71ada9
SHA1 3f489a13e7a30f0ec6e9544842a00b1392822b63
SHA512 cfe56504c1f12fcd968352ac085f3abad125bc5ddb075829c7f48c641ee368e0dea25a306fb647cdae4de42569106a0c40d975e36a328bf3bb59b95fddda3c96
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T108E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytol.exe

Path C:\Temp\wqoigbytol.exe
Size 226KB
SHA256 6fd4830e292cc23aa15cd70ca7c53f189ed250483de36d4d49572101de842a97
MD5 a1e981914b7e8d53b534e9d99861ab5c
SHA1 366842757bf041bcf87572dabb023cb09e54b829
SHA512 274c54ce9227affdde778f3b53e23972857b95ecf65714726a1e02f3b8d96c48183f9170b5abe95fcaa56d17cfcd4877dc9cad564e0d84648605b50ed0f20b1d
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.sys

Path C:\Temp\ysqkicavsn.sys
Size 141KB
SHA256 d964c06a25528e4d7f0348b38d3ca22f19403566455b70ff76500facc7f8203b
MD5 d957caf37500460811db0cda487165d4
SHA1 1a834ae8b26449f8567944b8d3065427ec575a4f
SHA512 deeda310a7ddbf25c65c80b78749fa043dcbe9c223a7176fe28d7220670c208da664b84ceba859e6f7e23cb9c0c033f1ea857eaa8fc141c4c0b3eb099ec44416
SSDEEP 1536:Fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E6E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtolgeytr.exe

Path C:\Temp\yvtolgeytr.exe
Size 226KB
SHA256 3254ac6d712ab5906404b5740f63bbd9b7f6936825f9fb0b5fc687351592fa3b
MD5 8e89455eb0b6ea94804fa82a66eec75b
SHA1 478dd42a1986751c7bcd7aab43c2d11ce456e587
SHA512 fc18dc6cf9d225a9786112e5598d7bbe81a952b00d48223c4002a19dd41a9ae9d0d33159a659ce27c80272b07d470a40c6afee91ad68708ffc844bc8c763dd8b
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1F034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

21c0b963-411d-4847-aa75-68e50486339e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\21c0b963-411d-4847-aa75-68e50486339e.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 26fd41486ce4a0ec39d9eb5f24aaf72276d85f76e9a16d80f9b3f3da26b53d14
MD5 5c7b4edcb7772ed349201b140e006e39
SHA1 6e45b189d2ad6fa24e6bc4c2914e7bb5fb9c1c08
SHA512 df952a5db1f47edcf920d121408f4a0370689fc8a4db782173a9bd4303c3940ef2f7f028679d8d789b067d93e60b10c9e478f85fea9885548114fa84f3ea96ce
TLSH
T1E4F0F9BAD920AC2718FD0B2970A5474AE75013672780989B3B3D460D8FF163B4686C1C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 688f04c105585ca23104c2bb9d31988366263f27347e3fd4d3500d1fae8e09a2
MD5 3738baaf33d505c6b12827fd5f8d8785
SHA1 7f41963963b33a18b6fc557c5a9e16fa3083b2f9
SHA512 a794cbb83752dd9a046dd76e370d7f1dffbbf13cae74d8b5ba36f1f4996d4aec650bc13c587a00d3667559a437a4964ceb7ce48ef05260be542bfad52189ac16
TLSH
T137419FF7C3E4856DC91196F0BA18BE2BCE2D0914432C3D5A85E4EF5B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b7717e8099e3e992ffe2bc4f13ff467427baba18e833c2c7b0f5ba82ccd9a558
MD5 03f28de4bda3c73243ddb7c62a11aca7
SHA1 f665bff2dec0d1c96492f0b8152a1a16b0620427
SHA512 36fcd940d9f1571cb14ec8ca490cf1d6f635a312e6d24064703209c5b5087634d1530f7ecbb875a9afa8f88df45c39e5567c83a7200a940d8ab1e3f32a499a67
SSDEEP 192:sxZdRDyMqZjK1Ml8UQjcn/fKs8vE0CXUyynDJzodpZe/W6+WNs0z/Y0dcWQLhIgZ:sxZdQqon/fKs8M0Ly8ig/bz/57QZkM/
TLSH
T11772F816AA38597B8CDBD219FA45BB53D3F9156292905E04A9FC8E0C04E76EC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c856145edcc0207f7f2de11d48cb197728f38dedc994c3d72e7a22b94248fcea
MD5 d9649e5d2b862b43c21c6bc3f106c0ec
SHA1 a04d47952f639bd95767f2d5eee953272fb611d1
SHA512 7973720f796b123e5c0d656107bacd281d2c6626f264886cb8c88c753c5f329f5e25600825de5face378b7f9bfa187f386ce812108d4895525c0a33a32a7fbd3
SSDEEP 192:sxZdRDyMqZjK1Ml8Mcn/fKs8X7xE0CXUyynDJzodpZe/W6+WNs0z/Y0dMWQLhIg8:sxZdQ0n/fKs8X760Ly8ig/bz/5fQZjY
TLSH
T11E620906AA3859778CDBD319FA45BF53D3F9156392905E4499FC8A0C04E76EC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 aa9dd2921b6abbccfba9ff3fb16a9e37486319486e064054310ab237e21c56ba
MD5 bf3edea4b8ef31efc9b69dd32a052826
SHA1 1fe0693c41cae8c0976af928c0faa914c03cac1a
SHA512 2fa1ca9d219b0ed076476771b14adb3e499d9ff92c9cb4242a5ce85bafadb807179a13de83bdc290477d80743c211c498b92b8a99bc0904b0aa915e6dd99d4af
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3v3pQLlr:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKv3pA
TLSH
T14C030A3B6C0CCB7E4F805E9CEC266F9A6EE8018B6698895447FA844C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 093f6a4d8b680becf92edf3476d33022edf92a1c0664833de0ac1e1eea27188e
MD5 64eb5cd90c590c6dfb67b130f8cd71de
SHA1 f7b54e0fa531081fdf4b1e29ed17b70bf75e3537
SHA512 d4c9bfe5d4b20a0424067db84569262717d0902807a210418e37f8365a4e2123cd785daa135a91309f53910f55ebe3cb9663bf5e77f5cbce59a8981de2968bca
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7cEo:AFBHhTofhno2mB21q3Llbfe3sLDdeEp6
TLSH
T16CB28057717B12023C3D290CA6969B370E8272A33458A56F7BB900BA4E67F215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 6cd523e4aa214e738b0887cce894488825a1e89b81a40e66c457b3b7223c3909
MD5 c2419241036d192c71033d2872befc67
SHA1 8b4421d6fb9ca84585a2688c23a052cea30b4a7a
SHA512 1f78449db2df3cbd9522e3b5ac143039fb74bab58fcf3957846f9bdfadf0f0566214ed4879f9191f75d775e42efee06b055c094ccc646cef6c3af6093ff5f798
SSDEEP 384:n4iF9CcmyWCk8Ny8TUNTUlIRfyda+JNudjf+8o/64QmOW70DsRdAknIIC/Hy/7I2:DFccpkBwg5+Joo/JQC0DinJBjdn
TLSH
T130E2E5F198D78973D89E579BA73D2D02AAFCC163B9884994B7C44D1CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5baa2c7ddb7e40148705a198703e0c6b5c9cf24741a7e13ae2c1827e5db553cd
MD5 b468c5865cc47fed3b09d5ef8a86c8b4
SHA1 b4a85592ce1883bab60767db1afa393d84f48699
SHA512 7f0fb0169143257d28dd9787e051680ef5ae74ae7284d6ab041271577c5bd92a9bb770f7ff27937710cc70901d5b5991d974374f84f9ca5c35f6bf84aa9e39d2
SSDEEP 384:n5qiF9CcmyWCs38N18TUNTUlIx0ZeydvQooadjf+8o/64QmOv6hkP+lFYS/vkHyp:HFccps3OwgqZStOo/JQd6hkoFYS/F
TLSH
T17FB24C36E8A8DAB7ECE64F99BB4E7A07EEE01163858C89D4DAD81D5C00D71DD0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 17e28e2a926d6cf0d29c54afda90e48e2ef5de3c9d144580efc91080b31ec0af
MD5 b0dbc92d5e3e4917b08fd72ee2a36355
SHA1 f867afc963ddc613d450e10a309433853a5f0078
SHA512 0f48081f035eec7eebb2f9628d8e43f27931297c4f1e78dde3b6e36ecdb67c6248f3f9467431a7cd81c12a6a1ff40263b6a35af3e16a38da92d4ce0c050e5b5a
SSDEEP 384:nGiF9CcmyWC/8Ny8TUNTUlIRfyM/PNudjf+8o/64QmOW7KDsRdAknIIC/Hy/7Ig/:tFccp/BwgZoo/JQCKDinJBjdn
TLSH
T1B9D26D35EC65CDB7ECEB5B99B74A3603EEE011A389885EE4DAC84D1C009B1DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd3b6082-4592-4fb4-8eb0-ca8d84b4c1db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd3b6082-4592-4fb4-8eb0-ca8d84b4c1db.tmp
Size 28KB
SHA256 cdba95b1b3a6cd6984edbd8b87453db3f4608e1953439471c210a12b2991638e
MD5 1ab68f8fabf6cbd8958a5fd0935a2587
SHA1 22b5b56beb6372f3aee3c7d3dc7832ef09f65046
SHA512 5bd3274b9a7493d6f06b59fe3474666b6261eff784680efb1242dbae61bef7e3551c511dde3816928bef313f2a560d1971ea0454410739275e0a121a23db1a01
SSDEEP 384:n5riF9CcmyWCA8Ny8TUNTUlIRfyHPNudjf+8o/64QmOW74DsRdAknIIC/Hy/7Ig/:EFccpABwgeoo/JQC4DinJBjdn
TLSH
T148D26D35E865CDB7ECEB5B99B75E3603EFE011A389885AE4DAC84D1C009B1DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/228-257-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/240-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/584-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-155-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1380-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1380-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1596-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1600-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2012-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2012-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2036-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2512-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-190-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3388-354-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3388-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3448-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5368-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5472-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5684-232-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5684-210-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5844-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6136-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download