ac8abb6e550963bcd6256054a82ab550df52ae402f5f9fad99173179fa995554

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260529-dtmlhabx7j
SHA256 ac8abb6e550963bcd6256054a82ab550df52ae402f5f9fad99173179fa995554
MD5 3576c65e1a2dc95140be507fbf40ff1d
SHA1 1d4d66b2e45752c88881afb1935940f1b580efa7
SHA512 cbd2264af0c82be97508a5ed318b800f827ea95e2cac9f54ca9aa08fbf579dacc168e7c6c85086d4a257a353404d12fd571f8b5458c4673b6ef261b9fa0aeeaa
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1F934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
576	CP.exe
1488	spkicausmk.exe
1012	CP.exe
3392	CP.exe
1416	i_spkicausmk.exe
2556	xrpnkecxus.sys
1068	CP.exe
1416	pmhfzxrpkh.exe
1504	CP.exe
2252	CP.exe
1756	i_pmhfzxrpkh.exe
460	jhczusmkec.sys
3232	CP.exe
3448	zxrpjhbzur.exe
1940	CP.exe
2056	CP.exe
3176	i_zxrpjhbzur.exe
4740	ljebwuomge.sys
4588	CP.exe
460	bztrmjebwu.exe
1168	CP.exe
4604	CP.exe
1468	i_bztrmjebwu.exe
3656	geywrojhbz.sys
952	CP.exe
5052	olgeywqoig.exe
1780	CP.exe
3108	CP.exe
4032	i_olgeywqoig.exe
2092	lgbytrljdb.sys
1756	CP.exe
1284	ywtolgdvtr.exe
724	CP.exe
4676	CP.exe
3892	i_ywtolgdvtr.exe
3688	oigaysqlid.sys
4064	CP.exe
2576	dxvqnigays.exe
2912	CP.exe
1944	CP.exe
4024	i_dxvqnigays.exe
572	aysqkidxvp.sys
2092	CP.exe
536	qkfdxvpkic.exe
4300	CP.exe
1852	CP.exe
3044	i_qkfdxvpkic.exe
1740	usqkicavpk.sys
2832	CP.exe
1508	faxsqkicau.exe
4972	CP.exe
3840	CP.exe
3432	i_faxsqkicau.exe
2956	causmkfcxv.sys
1968	CP.exe
4660	upkhcamkec.exe
4732	CP.exe
1972	CP.exe
4964	i_upkhcamkec.exe
2044	hbzurmkecw.sys
3024	CP.exe
3004	urpkecwuom.exe
3432	CP.exe
572	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtolgdvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkfdxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upkhcamkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtolgdvtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkfdxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upkhcamkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3996	ipconfig.exe
1968	ipconfig.exe
960	ipconfig.exe
2240	ipconfig.exe
4236	ipconfig.exe
4944	ipconfig.exe
376	ipconfig.exe
1104	ipconfig.exe
1104	ipconfig.exe
3704	ipconfig.exe
4828	ipconfig.exe
664	ipconfig.exe
608	ipconfig.exe
3332	ipconfig.exe
236	ipconfig.exe
4600	ipconfig.exe
2868	ipconfig.exe
4176	ipconfig.exe
764	ipconfig.exe
3892	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "43929510"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256362"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244982934815624"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2824035265-2271499813-2042964211-1000\{84EFE794-6D34-4364-A9A8-56CF9A90109C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	msedge.exe
2888	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	i_spkicausmk.exe
Token: SeDebugPrivilege	1756	i_pmhfzxrpkh.exe
Token: SeDebugPrivilege	3176	i_zxrpjhbzur.exe
Token: SeDebugPrivilege	1468	i_bztrmjebwu.exe
Token: SeDebugPrivilege	4032	i_olgeywqoig.exe
Token: SeDebugPrivilege	3892	i_ywtolgdvtr.exe
Token: SeDebugPrivilege	4024	i_dxvqnigays.exe
Token: SeDebugPrivilege	3044	i_qkfdxvpkic.exe
Token: SeDebugPrivilege	3432	i_faxsqkicau.exe
Token: SeDebugPrivilege	4964	i_upkhcamkec.exe
Token: SeDebugPrivilege	1380	i_urpkecwuom.exe
Token: SeDebugPrivilege	3220	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	4532	i_qomgeywqoi.exe
Token: SeDebugPrivilege	1876	i_tgdyvqoiga.exe
Token: SeDebugPrivilege	4912	i_gdywqoigay.exe
Token: SeDebugPrivilege	2984	i_vpnifaysqk.exe
Token: SeDebugPrivilege	664	i_hfzxspkica.exe
Token: SeDebugPrivilege	1400	i_ausmkecxup.exe
Token: SeDebugPrivilege	2244	i_upmhfzxrpj.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1696	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	83
PID 1696 wrote to memory of 3032	1696	iexplore.exe	84
PID 3032 wrote to memory of 932	3032	msedge.exe	85
PID 3032 wrote to memory of 3880	3032	msedge.exe	86
PID 3032 wrote to memory of 3000	3032	msedge.exe	87
PID 3032 wrote to memory of 3880	3032	msedge.exe	86
PID 3032 wrote to memory of 3880	3032	msedge.exe	86
PID 3032 wrote to memory of 2496	3032	msedge.exe	88
PID 3032 wrote to memory of 2496	3032	msedge.exe	88
PID 3032 wrote to memory of 2672	3032	msedge.exe	89
PID 3032 wrote to memory of 4576	3032	msedge.exe	90
PID 3032 wrote to memory of 2672	3032	msedge.exe	89
PID 3032 wrote to memory of 2672	3032	msedge.exe	89
PID 3032 wrote to memory of 4576	3032	msedge.exe	90
PID 3032 wrote to memory of 4576	3032	msedge.exe	90
PID 3032 wrote to memory of 3828	3032	msedge.exe	93
PID 3032 wrote to memory of 4024	3032	msedge.exe	94
PID 3032 wrote to memory of 3576	3032	msedge.exe	95
PID 3032 wrote to memory of 3828	3032	msedge.exe	93
PID 3032 wrote to memory of 3828	3032	msedge.exe	93
PID 3032 wrote to memory of 4024	3032	msedge.exe	94
PID 3032 wrote to memory of 4024	3032	msedge.exe	94
PID 3032 wrote to memory of 3576	3032	msedge.exe	95
PID 3032 wrote to memory of 3576	3032	msedge.exe	95
PID 3032 wrote to memory of 3268	3032	msedge.exe	96
PID 3032 wrote to memory of 3268	3032	msedge.exe	96
PID 3032 wrote to memory of 3268	3032	msedge.exe	96
PID 3032 wrote to memory of 3360	3032	msedge.exe	97
PID 3032 wrote to memory of 3360	3032	msedge.exe	97
PID 3032 wrote to memory of 4716	3032	msedge.exe	98
PID 3032 wrote to memory of 4716	3032	msedge.exe	98
PID 3032 wrote to memory of 2100	3032	msedge.exe	102
PID 3032 wrote to memory of 1484	3032	msedge.exe	103
PID 3032 wrote to memory of 2100	3032	msedge.exe	102
PID 3032 wrote to memory of 1484	3032	msedge.exe	103
PID 3140 wrote to memory of 576	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 3032 wrote to memory of 220	3032	msedge.exe	106
PID 3032 wrote to memory of 1940	3032	msedge.exe	108
PID 1488 wrote to memory of 1012	1488	spkicausmk.exe	110
PID 220 wrote to memory of 2116	220	msedge.exe	112
PID 3032 wrote to memory of 3500	3032	msedge.exe	114
PID 3032 wrote to memory of 3500	3032	msedge.exe	114
PID 3032 wrote to memory of 3220	3032	msedge.exe	115
PID 3032 wrote to memory of 3220	3032	msedge.exe	115
PID 3032 wrote to memory of 1716	3032	msedge.exe	116
PID 3032 wrote to memory of 1716	3032	msedge.exe	116
PID 3032 wrote to memory of 2440	3032	msedge.exe	117
PID 3032 wrote to memory of 2440	3032	msedge.exe	117
PID 3032 wrote to memory of 3656	3032	msedge.exe	118
PID 3032 wrote to memory of 3656	3032	msedge.exe	118
PID 3140 wrote to memory of 3392	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 3140 wrote to memory of 1068	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 1416 wrote to memory of 1504	1416	pmhfzxrpkh.exe	125
PID 3140 wrote to memory of 2252	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 3140 wrote to memory of 3232	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3448 wrote to memory of 1940	3448	zxrpjhbzur.exe	134
PID 3140 wrote to memory of 2056	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3140 wrote to memory of 4588	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 460 wrote to memory of 1168	460	bztrmjebwu.exe	143
PID 3140 wrote to memory of 4604	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 3032 wrote to memory of 2456	3032	msedge.exe	148
PID 3032 wrote to memory of 764	3032	msedge.exe	149
PID 3032 wrote to memory of 232	3032	msedge.exe	150
PID 3140 wrote to memory of 952	3140	2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe	153

C:\Users\Admin\AppData\Local\Temp\2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-29_3576c65e1a2dc95140be507fbf40ff1d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x344,0x7ffb5e59c188,0x7ffb5e59c194,0x7ffb5e59c1a0
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,2693076449779210683,17219390213032770266,262144 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,1629522903842202245,15156345965536147909,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,7076105520041246368,8874830526175558754,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,318185412992329907,16684627473578174220,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5029016962597306170,16706316584120514915,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,13889496637317568593,10846520716296859385,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,6119836815749877023,2634330001787110496,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4224,i,17847159351348515092,8022456584832270922,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4252,i,14307053363646948283,2070011692064638380,2097152 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,2686137606271697632,9843658797506139785,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,5524332241557376286,7139220852195252638,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,6669826250115346802,11610961252712217851,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,11648671003679941114,17997911118773499762,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13103002885118109673,14022700271053634844,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15997031331450223367,6598961911862650186,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15997031331450223367,6598961911862650186,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,8794591514263487632,15048523745059761671,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,13565093104377946139,10864698971311527187,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8544997771960122817,1009872583373977091,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,11858920712375194921,10275080208791333235,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,2614046627932887537,17167719249621850477,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,7004821091408063759,396161887828367946,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,14263454638427915562,17026675842512855483,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,13107933766595021029,10796577225207697685,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,6394743133938578814,10035733140385945205,524288 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2292,i,3590727023288350466,12381804211935438792,262144 --field-trial-handle=2144,i,9134252746218392983,14297213176343035369,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:576
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3392
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpkh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1068
- - C:\Temp\pmhfzxrpkh.exe
    C:\Temp\pmhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpkh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Temp\i_pmhfzxrpkh.exe
    C:\Temp\i_pmhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Temp\zxrpjhbzur.exe
    C:\Temp\zxrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2056
- - C:\Temp\i_zxrpjhbzur.exe
    C:\Temp\i_zxrpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\bztrmjebwu.exe
    C:\Temp\bztrmjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\i_bztrmjebwu.exe
    C:\Temp\i_bztrmjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:952
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3108
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtolgdvtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Temp\ywtolgdvtr.exe
    C:\Temp\ywtolgdvtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtolgdvtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4676
- - C:\Temp\i_ywtolgdvtr.exe
    C:\Temp\i_ywtolgdvtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4064
- - C:\Temp\dxvqnigays.exe
    C:\Temp\dxvqnigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1944
- - C:\Temp\i_dxvqnigays.exe
    C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkfdxvpkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2092
- - C:\Temp\qkfdxvpkic.exe
    C:\Temp\qkfdxvpkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkfdxvpkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1852
- - C:\Temp\i_qkfdxvpkic.exe
    C:\Temp\i_qkfdxvpkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3840
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upkhcamkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\upkhcamkec.exe
    C:\Temp\upkhcamkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upkhcamkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1972
- - C:\Temp\i_upkhcamkec.exe
    C:\Temp\i_upkhcamkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpkecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3024
- - C:\Temp\urpkecwuom.exe
    C:\Temp\urpkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpkecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:572
- - C:\Temp\i_urpkecwuom.exe
    C:\Temp\i_urpkecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhbz.exe ups_run
  2⤵
  PID:5100
- - C:\Temp\gezwrpjhbz.exe
    C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
  2⤵
  PID:2776
- - C:\Temp\i_gezwrpjhbz.exe
    C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomgeywqoi.exe ups_run
  2⤵
  PID:5032
- - C:\Temp\qomgeywqoi.exe
    C:\Temp\qomgeywqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomgeywqoi.exe ups_ins
  2⤵
  PID:3820
- - C:\Temp\i_qomgeywqoi.exe
    C:\Temp\i_qomgeywqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tgdyvqoiga.exe ups_run
  2⤵
  PID:4176
- - C:\Temp\tgdyvqoiga.exe
    C:\Temp\tgdyvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tgdyvqoiga.exe ups_ins
  2⤵
  PID:844
- - C:\Temp\i_tgdyvqoiga.exe
    C:\Temp\i_tgdyvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdywqoigay.exe ups_run
  2⤵
  PID:2644
- - C:\Temp\gdywqoigay.exe
    C:\Temp\gdywqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdywqoigay.exe ups_ins
  2⤵
  PID:5004
- - C:\Temp\i_gdywqoigay.exe
    C:\Temp\i_gdywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnifaysqk.exe ups_run
  2⤵
  PID:1268
- - C:\Temp\vpnifaysqk.exe
    C:\Temp\vpnifaysqk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnifaysqk.exe ups_ins
  2⤵
  PID:8
- - C:\Temp\i_vpnifaysqk.exe
    C:\Temp\i_vpnifaysqk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run
  2⤵
  PID:1336
- - C:\Temp\hfzxspkica.exe
    C:\Temp\hfzxspkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins
  2⤵
  PID:4248
- - C:\Temp\i_hfzxspkica.exe
    C:\Temp\i_hfzxspkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:2064
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:2916
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run
  2⤵
  PID:1824
- - C:\Temp\upmhfzxrpj.exe
    C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
  2⤵
  PID:2768
- - C:\Temp\i_upmhfzxrpj.exe
    C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khbzurmkec.exe ups_run
  2⤵
  PID:2860
- - C:\Temp\khbzurmkec.exe
    C:\Temp\khbzurmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2440

C:\Temp\xrpnkecxus.sys
C:\Temp\xrpnkecxus.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
- Executes dropped EXE
PID:460

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
- Executes dropped EXE
PID:4740

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
- Executes dropped EXE
PID:3656

C:\Temp\lgbytrljdb.sys
C:\Temp\lgbytrljdb.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
- Executes dropped EXE
PID:3688

C:\Temp\aysqkidxvp.sys
C:\Temp\aysqkidxvp.sys
1⤵
- Executes dropped EXE
PID:572

C:\Temp\usqkicavpk.sys
C:\Temp\usqkicavpk.sys
1⤵
- Executes dropped EXE
PID:1740

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\rmjebwuomg.sys
C:\Temp\rmjebwuomg.sys
1⤵
PID:232

C:\Temp\jgerljdbwt.sys
C:\Temp\jgerljdbwt.sys
1⤵
PID:1996

C:\Temp\bvtolgeywq.sys
C:\Temp\bvtolgeywq.sys
1⤵
PID:5000

C:\Temp\qlidbvtnig.sys
C:\Temp\qlidbvtnig.sys
1⤵
PID:1708

C:\Temp\gavsnlfdxv.sys
C:\Temp\gavsnlfdxv.sys
1⤵
PID:2916

C:\Temp\aqkicausnk.sys
C:\Temp\aqkicausnk.sys
1⤵
PID:2916

C:\Temp\pkicausnkf.sys
C:\Temp\pkicausnkf.sys
1⤵
PID:1360

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:348

C:\Temp\uomhezwrpj.sys
C:\Temp\uomhezwrpj.sys
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjebwu.exe

Path C:\Temp\bztrmjebwu.exe
Size 226KB
SHA256 ce66033c9ce1e834619665f34ab0674a5397cdb39a4c21443bcd5df48f2238d8
MD5 68998ab81c4d9429c1977c514f96d2f4
SHA1 05773f9943f76c5ff214bf057713f89a5a7add93
SHA512 161a4ecb6ce309ec97534d20d1827e87505adbb95333b4cb4ebac0200746600ec79acf079b3eb362e0ecceef27c3566736dc536fa87bef0d786cb3b1b435bd90
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T14634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.sys

Path C:\Temp\geywrojhbz.sys
Size 141KB
SHA256 8195bc0abb685e36ea5ee5c4bee0cd8413ce19450548502a6a4bbea0c2ec28a0
MD5 500fb161be279670fa49bd412250cfc6
SHA1 2746aad439c9cbb71038dcfec1162a11c4cbb069
SHA512 4b1a4883e3831fa12a8a51a41dc8271048e7ea9399aac54a3cf60ad1af8083eba79ee19080c96b93546a2d0ce3a2d4325d3c32886fd26e2e9295727c16ac0b6d
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E1E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmjebwu.exe

Path C:\Temp\i_bztrmjebwu.exe
Size 226KB
SHA256 b940e3483283ac0f6bd3bec319e59eeab72d72ab3117c9185c221e4715f7fe50
MD5 32c082ffc6bdb710e8fff02cabdd7ecb
SHA1 4d67f415c7294691e81cace5e43303c33a65d9ca
SHA512 e98f8fd17232c4a68724ae9f62cbe20bdc644ceea02d2ecfb51ae0e8cdf44680310fbcad92acada358b5b95a97d10c819c1c4d217d250d47a83125612ca02f8e
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqoig.exe

Path C:\Temp\i_olgeywqoig.exe
Size 226KB
SHA256 fa63bfa3be0c8afbd1d789c393c241039309134661c38dcb2ba59e77a594de23
MD5 3053248bdaa2dc8a7a3fa3bfe1a958c9
SHA1 cbbd841eb76f9f9fb3f3a9e357b37afd6cad97b9
SHA512 b5ca660678c395d07b90e6f03eac5f93a017ae9cdbbd1c3f64a0447906be33d2fb88104179959762f761e1e93abad4297c3e940796a9c0ebce0fd8d5178c39ca
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T1F434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhfzxrpkh.exe

Path C:\Temp\i_pmhfzxrpkh.exe
Size 226KB
SHA256 aaf9f6090c9396105141ef6181dccc41b13b77f1106bb7dfe74fe5525ff5b8b9
MD5 295eadf5c65a83749311a36788eb7cfd
SHA1 c46f7dde3013343a7b1c3f36a7ad6b982b840928
SHA512 b8897065848319891f8f88618337f801dfbc056b0b136f822cd75b65d460951a9da016fff6deb83bd8e7c0bc6ea09742d0779b448f77c9bb39d671e870f42c57
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T14534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausmk.exe

Path C:\Temp\i_spkicausmk.exe
Size 226KB
SHA256 66bccd86e410ded7afd9c63ee114d8aaf0ea0dc2924b1bf7c9bf1446693aadd4
MD5 a672ccf8d97ce53134ddaa03c35514db
SHA1 90b4d7cc13c7efe13a97cd5e45ec536b28f873be
SHA512 2e15b6979464644cd0e5f18fea824b99882b474750424876033adaa860dc952a0f3382ae13fc3417c1a72a28bd8991d48d63e9220de8f8932a210da7d3f9460d
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T10A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhbzur.exe

Path C:\Temp\i_zxrpjhbzur.exe
Size 226KB
SHA256 4c0e7a9513d46aca57ba6ce79dd7936f06432fec8302ebd9a4a1e70547a12e3d
MD5 88f1cfe9b4aff286d9492db207a315c0
SHA1 c318439ae363a4a25b64cfbd11ada50fe6df8bfe
SHA512 bfccc2641c8aad808eb38be80595e13ca3aafc803bd87e3ea0075fe6623ef94f34b545725b89d14fa56b58ac0e82f2319ca24b8879b08307d19932f0092cf13e
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T12B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczusmkec.sys

Path C:\Temp\jhczusmkec.sys
Size 141KB
SHA256 9d77438d2eeffce7cf7d49c1c9e6c3e2a0875680dc76ccdf84e731e3eac36b13
MD5 ecb096c38f6f60da59a8208c2ee4bc36
SHA1 e49d633eed59c86a6727927e3b01443a6bcaba74
SHA512 6798b4d37fdf1a77d71091d839ef11fd6cd012ef03b2c939a0378ea21b0d2c67ee26b66694248cb6c08df8d2279bdbaee6d1c720cfad4f29f37b3e5aaf7857dc
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T190E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgbytrljdb.sys

Path C:\Temp\lgbytrljdb.sys
Size 141KB
SHA256 47c740486867088a0ccddeed20c4c6860cad96b6ca365887a35e0c3e88645e46
MD5 9233c2a5ca5cd4e537c7bb30119b9d60
SHA1 b92bfb3e8b109daa3f0902ff8e300c2496de90f5
SHA512 ab61a3781b13722eba7ed35e7cc39c2306990b043e43cc5a2fec519543aaef0b5eac96e29486ba692d726ae814a9db86bb70df85db2844f40bb5249c55f809a6
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T191E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomge.sys

Path C:\Temp\ljebwuomge.sys
Size 141KB
SHA256 755d2b94a03d146be326e41320f366b72dba4d525e3ad53b4befcfa4b3a5c82d
MD5 84fca3d3fef521fe11b89ce84b22bccb
SHA1 9bed783d02adb469992942b1143f122fd4693133
SHA512 bb6a0cbaa39ad5cc76ab7f0c8bd40b21b83f94a471785d83d181d4e5c861084adc5d7b6ec38b8c7bf4fe6202138568456ee848933dd6969a4eab5133d8d1ab6b
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T181E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.exe

Path C:\Temp\olgeywqoig.exe
Size 226KB
SHA256 0a1bf7b73818adbc6010914fde7fcb9182d4ecb4d80b2b181ed39b54343ef151
MD5 f35ad1f5dfc181dca34e9af0be0a40b0
SHA1 490d97b1db95f86354ebcdc9f3cdd4f02e2744d4
SHA512 6565f82cf048b5277eef91c448d8f52477ab8be16c00270e468f4d288efd80c0d77799166ce25684b4fe2de6c81bbf06785ae87fcc177891841d8bba0ecb6e50
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T11034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzxrpkh.exe

Path C:\Temp\pmhfzxrpkh.exe
Size 226KB
SHA256 678b4f110d6c97d3798226e47b1b373b4b13721d18c3e04fbe52caad1d227bb5
MD5 d94ac5f99258755289df953b02ede5bc
SHA1 5e1c91fe1a57b1bbb73f736a81db902e981396a0
SHA512 f065281562b93baa58c7aa50260ef759f6bc86c44e47651bb630209bf6845575918340b44f324ad3ebd6a92532ab8c04c656d79cc31f5b61c5e6d9fbb4b07f7a
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T11634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 226KB
SHA256 4c0cbeb270e9d96901b2e8f25dc48819856bf024bb11aa73a361f0ad30f77d93
MD5 75cce1da0d906f8326a8572de8a703c5
SHA1 7ba2ad34abfdefa6d1b8a0b3376e4bf39931553f
SHA512 69b483c9defe693494731cac1e7c713aeb5e90131bedbe0c2808e8eda66fa8fb8f591c7c820cb647aacff680a1d94f8a19a7f0fcd9f823c518c371330b87cd14
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T12634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpnkecxus.sys

Path C:\Temp\xrpnkecxus.sys
Size 141KB
SHA256 34abfcd38f106225f3bfe7e53c4c8549f266aefa534b4f720d7d148778bab07e
MD5 d8fe82262b05f33c3ee3267f002b1760
SHA1 f0fbbfcfd33117c636ab18ff2e6cef276c72185c
SHA512 0abce53c7aeaa576201b86fbdbdcd6fe19db688918ca6b4ad9e1548587568afeef51e2d87404136b53473e2221228167b960026dccc652233a82d621ca8c77df
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtolgdvtr.exe

Path C:\Temp\ywtolgdvtr.exe
Size 226KB
SHA256 0e5a10b0a6519d2c9d4c419f57f1833cdabb1db45d01d6983423a680a18b28eb
MD5 9f9d3ecca0573a85deb59106f329bfe2
SHA1 7b24041ac232a229d52b3f403337b3d82f248bb6
SHA512 9077eeb09758652e84a4ddf4fb945b6d066e7909e8bf8540dca47af74e91d739d59f5520e3e1ab454886b0d2c39169b5bc81603c9d1e8796f72186470e26efcf
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T18534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.exe

Path C:\Temp\zxrpjhbzur.exe
Size 226KB
SHA256 50e4a0a5173215a757d764bcbda80c905b26c2a37d82f8b00d74808126ecead1
MD5 b83dfe671ab2d77448803643192fac9f
SHA1 2087bde59883e5d0d7751100ecebc707e0a78075
SHA512 15ef0ec2a494849dc2ad701fee06ee0bb7bdaf93249d36340eed56a680b76bf944a90e3d4952596bca41421d236dbc3171588908db0db99449aecbfc0615e496
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T19A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f3e7b21a90ec9dc161e38032137570d1802402c4874704d7c8239db4c09dfeb
MD5 9aefbd2085b70e2b6b9e417e88a8f602
SHA1 809f3e3827df5aa7ef168a59d856bebea1e9ab11
SHA512 674662d0b369d264c7f11f5f46ba0025117a01b19d91254b52d12c7f8ed4f58435c251f8968e639600765bc37b674076de7730199d1c441404618fea7769d913
TLSH
T1B8713A1D03B24168F3712630BBD0122D35B6C4E94E133E82D7C298B6F52EB66ABDC508
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58408e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58408e.TMP
Size 3KB
SHA256 2529017195000d75d65ceb4ca35641ad4becfe1216c4ec57b42ef354e27f16d8
MD5 8405ba11497567b36a659c23aeca3c81
SHA1 ffac393637afa21dd5196377e992e06b5ee03e26
SHA512 1405393386aa5ac7cb7b96c1ebd887e76c740c62cb458242ebe962d0d9718477f9580fef6815a402f108ef869ddd1c18f8670a264860f0438b43383668090bc0
TLSH
T148713A1D03B24168F3712130BBD0122D35B6C4E94E033E82D3C258B6F52EB66ABDC108
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 448010a64904cda68de3f1dafba1c2e23f81325632d406eef1d6345e4bd47f7b
MD5 2f50f838cd8608c3e3aaddc73b2a79f2
SHA1 a366ec0d4306b060b7fed3cddb54feeab0d05ee2
SHA512 916e7e7373761695b33a2e814361bcef5c0a6ebc49cc361a4a7521752b01c940312a93773e8f97ca0f1ea9f5eb51d2aa80fd8911c09edeaccdf9f655666d9d83
TLSH
T15F418FF3C3E8866E894156F0A714AE2BCE2D0A14432C3D5AC4E8AF5B93E2471D14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 557ad103a6b128f279603198ee27ed3ea379b948a6d74b0bfa5f0c6cc706b8d1
MD5 73cc328da224674f3d94a5dcd9cb7a68
SHA1 951429aeb9c32ee6ac2ec7d043d68aad1aed6719
SHA512 b0ddd161bca1bf162423281a3590c53e4f5e0e4a1a98245fa7f38bde8a204894debe40afbdd15ed0f58428aaa82ca2627eb5b266cbc8594b1a5cd4010986fc60
SSDEEP 192:sxZARAyM/jK1Ml8Mcc/fYssmXut+CIdp/t/W6+WNskD/Y05558Ig4J:sxZAm0c/fYssmXg+rV/bv/5ac
TLSH
T16D52E816AB349977CCDFD20DBA55BB53D6F9156292900E44A9FCCA1C00E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5e5ce82b911643dbad4171a38d51c79845d18f481b80ca191a31b8021a2fe6ce
MD5 11730cf5392ab02ca2f9dcb8a84e6622
SHA1 8244e8878c5d3b346cb29d9741c75a4a24088cde
SHA512 ae0664e40c14643087df0b2b9aca7ce7278b4638b256b72a26fd20481c11cb299add507ea0ba18c96cbffc5f175da371f7a81900930aa141313375626ea70f18
SSDEEP 192:sxZARAyM/jK1Ml8UQlcc/fYsQmzeut+CIdpZt/W6+WNskD/Y05W58Ig5dJ:sxZAmqKc/fYsQmzeg+rv/bv/5NN
TLSH
T1B362E816AB349977CCDBD20DBA557F53D6F8156292940E44AAFCCB0C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 0b0f587d58d5d84b02db89bb5a2f751f0e2360b1eeae5301921366ebfcef9085
MD5 76c63721d1c3e78d9a33209f7eb5ce38
SHA1 0c1566972b08f030a6f2742b1bc6114150a93daf
SHA512 7ad47b235a54afd2a18007cb5903e8399c11b1d233e1606e4ccbcad688e4cf6d183517e11b51abb845d03c06a39d023318a8e78b0c31f02a1de16004a0ae90e0
SSDEEP 768:DGzXl8pZ2607pLuLXJ1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Sd1/Ll0:DGzXl8pZ264EXJ1WRmsYQL0u1jaKSd1q
TLSH
T11A031C7B284CCB7E4F844EDCED267F9A6EE8018B9698895447FA480C03C66EB15171DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f762639f83e2c531f6e5108199ca739a46bab02c6c94806a9f05ee7ca794eaa
MD5 af1d56745bc79c607c4e8a37be2cc78e
SHA1 f34d3e58259adb4185d74386e01bdd475f169661
SHA512 2176a18ecc370b85f5e9f6c46e5a08662b2b83d6a9f57241d4d23900d84b1c367ffe888ae4f916e9cdcabbabcbd504b840b0d778419752532713e9e3688aef5b
SSDEEP 24:KdffmtkaBd1FV4hd+oIjBVKiShaPV1EnFSmPMK8FuyXYAfnUFaqdSSu4Ce+1IjIL:KUgI7KVqcLyldIVK2QIavIJK8gUzyRz
TLSH
T11891895631BB1A013C7E74088376D6975A8271A33078B43B37A851762E27E622FFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

117f880b-2e52-4164-87d3-b7b1dbca1e42.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\117f880b-2e52-4164-87d3-b7b1dbca1e42.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c4e877257ee19117c492ab921fd01bfcf64ac33c6c4d67c2c4065289e4e3d683
MD5 7df29347d45bc83bc4f796533c0b90b4
SHA1 54f63838187acf84f8a56d9082794b22c0bc91f5
SHA512 6abba16065cc3575d7016ee7445540a0a19053e779478f707bd0f97b751e3610451905eb4069a39e70e1bceed921f155a86513fabe82632e2e6dd1dd054f7669
SSDEEP 384:yrtNnNnb9x8NlkFCyEXutOK/xGtOBSTK3RlUVJA1xu:KjZbztC+Z/otOBST+R2fkxu
TLSH
T1CB927D325875AD3A49E7A558B54B3657AF7811BB99C42F44E6EC5F0E00C639C230B81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 725c43ad1394142378fe0985f8d7541b44552193bcfb200cf565085f8100198c
MD5 3a0887a50ccbc4da722fc96b03ca3f49
SHA1 c69829eed30562c68e03d1e49568c84bb583a92c
SHA512 f40c0b90a52a107bff1e53d671cefdaa9c165f988a1fe888d5d790e1a24a05d6dc0f3fb5ebf3a6bc46a7ad38f16253fe0f9be9f40f6c7a925e62640b0149bc2d
SSDEEP 384:y2tNnNnb908Nl3FCyECutOK/xGtOBSTK3RlUVJA1xu:pjZbeWCrZ/otOBST+R2fkxu
TLSH
T18D927D325875AD3A89E7A558B54B3697AFBC10BB99C42F44D6EC5F0E00C739C230B81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ef96e08747f3beb1a1b2963e239739a835543f8755aa5aeb75cae675380ce309
MD5 4fdf80eff29a8e2f54841b39379c3431
SHA1 a7a2242b2cf2c096a4dd833a7572bbf9943e5dd3
SHA512 79b0c8b55d511aa6898e910095d9dcd1131b5c9262b96ff2d50a4413a77d2d434a7a30aa6560c05e0125869c345a653b66628d086fc5c480dfa8216cc6b521ce
SSDEEP 384:yrtNnNnb9E8NlkFCyECutOK/xGtOBSTK3RlUVJA1xu:KjZbytCrZ/otOBST+R2fkxu
TLSH
T158927D325875AD3A49E7A558B54B3697AF7811BB99C42F44D6EC5F0E00C739C230B81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 9bf62717940c9c51b59f01c01c117e196a35264bdddfb0c0d13aae085412fafa
MD5 2005954d88a56f243c3bef89420a907b
SHA1 62c28250f240d295a3e3d45f58df8281e08b9afe
SHA512 cce177f255cf2a80b1175986ac30bf76e41328580671e463cb147a858b266d242a2b409575ba04edb8b9a9b04b209d22fd589c676e051ac4b271349acb201b58
SSDEEP 384:y1iFptNnNnb9b8NE8TUNTUlIl3FCyEtbPtOjDf0c/xOeOBSTK3RlUVJA1xu:NFpjZbRXwgbCHvc/geOBST+R2fkxu
TLSH
T18BD2C6F198E3893AD8AE4787A73E7D469EBCC16774885984F7C81E0DCC821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cc7e9bf00b00cef832037a0c8a2c79843e6b2142bc68f5f40715ad1f1f1fc68b
MD5 f34cc39356ddb4cc380f0786df0047b3
SHA1 a46971bffc016d8587eecf81c190b678268efbd2
SHA512 82d42d972ea73294218a4067900c30ce33364355344d7a2824cf465064813a1a7b6a9a8e2352e51b289fb13e0cc5b3e3a8c41fb272adc10790c5b633082d028b
SSDEEP 192:7GNy6fNNQmiUyDzHfPL/GPTrXRkV7qCcU6:7GNy61Lsz/PL/RUDU6
TLSH
T1D2020A35ACA86C7B8EE2AE59F58737175FA4206BDAD52F44C6E82F0C00D769C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 3c2dc6e991ba3fdb5492449c21a0f4cc012a8db8f84c27d8216396da94bd6ef3
MD5 bf1b74badc552eda919355681469bf51
SHA1 fa73fee75e1a43f147952a0cb3059aafd312bdcb
SHA512 4d32a4e174d04829e460192a28b76aec0a6429716a4cb8fcfba338f1108aedb5469f23483ebd3e63d29ef8c86f1868799569151b3ea4c64662505970382d0841
SSDEEP 384:y1iFvtNnNnb9C8NE8TUNTUlIl3FCyE9bPtOjDf0c/xNeOBSTK3RlUVJA1xu:NFvjZbAXwgbCnvc/TeOBST+R2fkxu
TLSH
T16CD2C6F198E7893AD8AE4787A73E7E469EBCC16374845984F7D81E0DCC821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 09cdc2ebfb1bd3a98cd582ac3d2ecbcfc055deae115b3fb12aac8468e6a86f41
MD5 7d4479e24923f7ad7b0f187bbb0294bf
SHA1 c908a7bc847f03443aae374c841a17a6b0e2f0d1
SHA512 29987f1efb5cf8fdde0af4004d600ce0d111ed0a82d01ea7009dc603b9f130148b8590312bd807864b51b2f74c287526cef0e3819b1e87f7196184515b1a65b5
SSDEEP 384:y1iFKtNnNnb918N/8TUNTUlIl3FCyE/bPtOjDf0c/x5FOBSTK3RlUVJA1xu:NFKjZbrawgbCpvc/XFOBST+R2fkxu
TLSH
T1A2D2C6F198E3893AD8AE4787A73E7D469EBCC16374845984F7D81E0DCC861BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 926fc47c24e7fba7aefafbdac4fc1460c3c4a6ada0f4002d0c90da4cec33c1bc
MD5 d16ebd392decd58f020b157c00223496
SHA1 edda370c040890f8a97fc73afdc440d6d872b703
SHA512 d4c209e8a50a8a845b58735a4c7ed46325d4b13804dbbbfa461bae96edf58f31da84d8953c61ba44e8aa22330b0f832159e9fce161fb1bc796a461abfb1f3ed9
SSDEEP 192:7GNo6fNCQmiUyXSfqL/GPTrXR4qYWV3ZA/GyU6:7GNo61+C6qL/xyLOU6
TLSH
T1B4122A30A8A8EC3B4DE6A569F58336975E6420B7DE855F54D2E82F0C00DA6DC270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4631bbb68c0af4fee50e14635079668b92c562d63e534b996b19c0a30fecbcca
MD5 f51f82d1e9ca1b454f7f14fb905a24e2
SHA1 bfdcac5cb6aa993d3be291354f503a3c775f41f8
SHA512 5fe7b9b314213fda79593b4005166996c7da873731473b081581feb22dfd0a84d5855be2b4bfa09a13460628bdc5d006c2c312071548caa7c54ff72c8e1930d5
SSDEEP 384:yRtNnNnb9Q8Nl3FCyEJutOK/xStOBSTK3RlUVJA1xu:GjZbKWCsZ/4tOBST+R2fkxu
TLSH
T1C5927D325875AD3A89E7A558B54B3797AFB810BB99C42F44D6EC5F0E01C739C230B81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 49bec243b99ccadcb91c0e6c90d3f4ca1dd65be389d6b902f62c924aabece8ba
MD5 416569b0196aeef8eb4c6169bd6aff12
SHA1 37e19f91d253854b028b54b2e7745230f0ce4b8e
SHA512 f0eafbd4b21be085e48c304e5930055e8080d4cf281108dcea3014c3dbe1355eada54ce333b7fa7b171b24076abce47709e7973155f67565c7c683ce54ba85ab
SSDEEP 384:y1iFKtNnNnb9u8NE8TUNTUlIl3FCyEhPtOjDf0c/xAseOBSTK3RlUVJA1xu:NFKjZbEXwgbCPvc/xeOBST+R2fkxu
TLSH
T1CED2C6F198E3893AD8AE4787A73E7E469EBCC16374845984F7C81E0DCC861BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 730fd8f4c309b7d7e86665b1f4bf7c81f50be54c3a1e22421ccbc443c0b9c764
MD5 cad71574bcdea20484fce9137a005bb8
SHA1 3d0185fae47356cc0bc816301a54be3ec64c21c5
SHA512 b174bf8a53b2bffcfa81a4bb72a4f1410be5472626a40f1368cc8d2596dd456403034a4d69419d92e61985333edcff652e2facae9b05f1e59078f2440960c1a2
SSDEEP 384:y1iFftNnNnb9p8N/8TUNTUlIl3FCyE/bPtOjDf0c/xSQOBSTK3RlUVJA1xu:NFfjZbXawgbCpvc/kQOBST+R2fkxu
TLSH
T184D2C6F198E3893AD8AE4787A73E7D469EBCC16374885984F7D81E0DCC821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d37b8b6c-3271-441c-b970-4c46d373d874.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d37b8b6c-3271-441c-b970-4c46d373d874.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

c7cf4e99-e9b9-4b7b-9651-101469e2f98b.tmp

Path C:\Users\Admin\AppData\Local\Temp\c7cf4e99-e9b9-4b7b-9651-101469e2f98b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

c98baa9d-a22f-4b7e-aae0-090997d44017.tmp

Path C:\Users\Admin\AppData\Local\Temp\c98baa9d-a22f-4b7e-aae0-090997d44017.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74878ed2-00a6-42da-a3f0-0341d1c4434f.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1491076296\74878ed2-00a6-42da-a3f0-0341d1c4434f.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1497969506\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/232-667-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/348-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/460-495-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/572-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-743-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1360-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1708-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1740-614-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1996-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2092-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2916-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-656-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3656-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3688-579-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4740-523-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-692-0x0000000000010000-0x0000000000083000-memory.dmp

Download