e2d86ff5bfa06cfc1fea312818803fdd8142c55e0251e90bb2dc7f9d1df05c25

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 06:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260601-hgrf5sd16v
SHA256 e2d86ff5bfa06cfc1fea312818803fdd8142c55e0251e90bb2dc7f9d1df05c25
MD5 7d2a5fbb1b535c1dc0eb4ea80bd15016
SHA1 fd94569f328fba99ae0f925d281a7835e78236dc
SHA512 a08a501c1cc86470beedab06ee883338969693eb44c87c6db256a93ca065a22dc28553bbe8e7500d674aa49de3abd6fb941ac4601eb5a87e530df0fde1596efe
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T19134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2888	CP.exe
6140	usmkecxuph.exe
5592	CP.exe
4028	CP.exe
4024	i_usmkecxuph.exe
1988	pjhbzurmke.sys
3680	CP.exe
3532	ecwupjhbzu.exe
2268	CP.exe
3780	CP.exe
3832	i_ecwupjhbzu.exe
5076	ztrljhbztr.sys
4300	CP.exe
4388	rojhbztrjg.exe
4604	CP.exe
5220	CP.exe
2532	i_rojhbztrjg.exe
4360	ywrojhbztr.sys
3232	CP.exe
4376	geywqoigbz.exe
3116	CP.exe
4540	CP.exe
1216	i_geywqoigbz.exe
4840	qojdbvtolg.sys
1660	CP.exe
4080	dbvtolgdyw.exe
5176	CP.exe
5116	CP.exe
4864	i_dbvtolgdyw.exe
4552	dysqlidbvt.sys
232	CP.exe
5008	tnigaysqki.exe
5012	CP.exe
4768	CP.exe
2896	i_tnigaysqki.exe
4048	sqkidavsnl.sys
4404	CP.exe
3988	ifaxsqkica.exe
2948	CP.exe
2200	CP.exe
5556	i_ifaxsqkica.exe
3332	qkicavsnki.sys
3976	CP.exe
4772	xspkhcausm.exe
5292	CP.exe
416	CP.exe
5196	i_xspkhcausm.exe
5388	faxspkicau.sys
3376	CP.exe
5516	rpkhcausmk.exe
5868	CP.exe
784	CP.exe
1476	i_rpkhcausmk.exe
2844	wrpkhczusm.sys
5524	CP.exe
644	mhezwupmhf.exe
4904	CP.exe
4396	CP.exe
2992	i_mhezwupmhf.exe
5544	ojhbztrmje.sys
3476	CP.exe
4912	hbzurmjecw.exe
4716	CP.exe
4988	CP.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_811894340\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1423664762\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_811894340\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\ranked_dicts	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\male_names.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1423664762\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\surnames.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxuph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnlgay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxuph.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnigaysqki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
552	ipconfig.exe
4712	ipconfig.exe
4552	ipconfig.exe
5800	ipconfig.exe
5536	ipconfig.exe
5868	ipconfig.exe
4956	ipconfig.exe
3840	ipconfig.exe
4128	ipconfig.exe
5740	ipconfig.exe
2544	ipconfig.exe
3496	ipconfig.exe
1388	ipconfig.exe
3848	ipconfig.exe
4132	ipconfig.exe
4856	ipconfig.exe
592	ipconfig.exe
4132	ipconfig.exe
3880	ipconfig.exe
5732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257041"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1969170120"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247697727063622"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{86A43D09-D030-4833-A76B-844A5AF7B3EE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	msedge.exe
5028	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	i_usmkecxuph.exe
Token: SeDebugPrivilege	3832	i_ecwupjhbzu.exe
Token: SeDebugPrivilege	2532	i_rojhbztrjg.exe
Token: SeDebugPrivilege	1216	i_geywqoigbz.exe
Token: SeDebugPrivilege	4864	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	2896	i_tnigaysqki.exe
Token: SeDebugPrivilege	5556	i_ifaxsqkica.exe
Token: SeDebugPrivilege	5196	i_xspkhcausm.exe
Token: SeDebugPrivilege	1476	i_rpkhcausmk.exe
Token: SeDebugPrivilege	2992	i_mhezwupmhf.exe
Token: SeDebugPrivilege	3340	i_hbzurmjecw.exe
Token: SeDebugPrivilege	2212	i_trljebwtom.exe
Token: SeDebugPrivilege	2544	i_rljdbvtolg.exe
Token: SeDebugPrivilege	5540	i_jdbvtnlgay.exe
Token: SeDebugPrivilege	2840	i_xvqnigaysq.exe
Token: SeDebugPrivilege	2376	i_pnhfaxsqki.exe
Token: SeDebugPrivilege	2212	i_kicausmkfc.exe
Token: SeDebugPrivilege	2448	i_hfzxrpkhcz.exe
Token: SeDebugPrivilege	2844	i_wuomhezxrp.exe
Token: SeDebugPrivilege	2840	i_ojhbztrlje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4036	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 4036 wrote to memory of 3100	4036	iexplore.exe	80
PID 3100 wrote to memory of 5124	3100	msedge.exe	81
PID 3100 wrote to memory of 2920	3100	msedge.exe	82
PID 3100 wrote to memory of 408	3100	msedge.exe	83
PID 3100 wrote to memory of 408	3100	msedge.exe	83
PID 3100 wrote to memory of 408	3100	msedge.exe	83
PID 3100 wrote to memory of 4636	3100	msedge.exe	85
PID 3100 wrote to memory of 4636	3100	msedge.exe	85
PID 3100 wrote to memory of 4500	3100	msedge.exe	86
PID 3100 wrote to memory of 4516	3100	msedge.exe	87
PID 3100 wrote to memory of 4500	3100	msedge.exe	86
PID 3100 wrote to memory of 4500	3100	msedge.exe	86
PID 3100 wrote to memory of 4516	3100	msedge.exe	87
PID 3100 wrote to memory of 4516	3100	msedge.exe	87
PID 3100 wrote to memory of 1804	3100	msedge.exe	89
PID 3100 wrote to memory of 5508	3100	msedge.exe	90
PID 3100 wrote to memory of 1804	3100	msedge.exe	89
PID 3100 wrote to memory of 5508	3100	msedge.exe	90
PID 4560 wrote to memory of 2888	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	91
PID 3100 wrote to memory of 2388	3100	msedge.exe	92
PID 3100 wrote to memory of 1944	3100	msedge.exe	95
PID 2388 wrote to memory of 5520	2388	msedge.exe	96
PID 6140 wrote to memory of 5592	6140	usmkecxuph.exe	98
PID 4560 wrote to memory of 4028	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 4560 wrote to memory of 3680	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 3532 wrote to memory of 2268	3532	ecwupjhbzu.exe	109
PID 4560 wrote to memory of 3780	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 4560 wrote to memory of 4300	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4388 wrote to memory of 4604	4388	rojhbztrjg.exe	118
PID 4560 wrote to memory of 5220	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4560 wrote to memory of 3232	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4376 wrote to memory of 3116	4376	geywqoigbz.exe	127
PID 4560 wrote to memory of 4540	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 3100 wrote to memory of 2240	3100	msedge.exe	132
PID 3100 wrote to memory of 2144	3100	msedge.exe	133
PID 3100 wrote to memory of 3572	3100	msedge.exe	134
PID 4560 wrote to memory of 1660	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4080 wrote to memory of 5176	4080	dbvtolgdyw.exe	139
PID 4560 wrote to memory of 5116	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 4560 wrote to memory of 232	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5008 wrote to memory of 5012	5008	tnigaysqki.exe	148
PID 4560 wrote to memory of 4768	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4560 wrote to memory of 4404	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 3988 wrote to memory of 2948	3988	ifaxsqkica.exe	157
PID 4560 wrote to memory of 2200	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4560 wrote to memory of 3976	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 4772 wrote to memory of 5292	4772	xspkhcausm.exe	166
PID 4560 wrote to memory of 416	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3100 wrote to memory of 5888	3100	msedge.exe	171
PID 3100 wrote to memory of 5888	3100	msedge.exe	171
PID 4560 wrote to memory of 3376	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5516 wrote to memory of 5868	5516	rpkhcausmk.exe	178
PID 4560 wrote to memory of 784	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4560 wrote to memory of 5524	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 644 wrote to memory of 4904	644	mhezwupmhf.exe	187
PID 4560 wrote to memory of 4396	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 4560 wrote to memory of 3476	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 4912 wrote to memory of 4716	4912	hbzurmjecw.exe	196
PID 4560 wrote to memory of 4988	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 3100 wrote to memory of 5836	3100	msedge.exe	201
PID 3100 wrote to memory of 5836	3100	msedge.exe	201
PID 4560 wrote to memory of 2492	4560	2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe	204
PID 684 wrote to memory of 936	684	trljebwtom.exe	206

C:\Users\Admin\AppData\Local\Temp\2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_7d2a5fbb1b535c1dc0eb4ea80bd15016_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x30c,0x7ffba31cc188,0x7ffba31cc194,0x7ffba31cc1a0
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,16834717072747115900,10962871473310868030,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
      4⤵
      System Time Discovery
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,1490854528353186202,16188392588441568946,262144 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1342713419847225998,5147998789275396056,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11488708723453711823,8259335342037073492,2097152 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,10708428654290965482,198395538811433286,2097152 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,18330669687173482952,6991782253061176958,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,5773515034834540322,2691692073714493277,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,6117377334649632163,4233524679112623979,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17229799148794036147,6587242121328693654,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,17229799148794036147,6587242121328693654,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14420453886879578751,15185039551524573679,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,8492263769488944009,17552600463511465710,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,15364729639329290535,17993318272477101031,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,6792602057597985569,1784279407687316084,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,10204708855765500632,10556458698448032784,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9615392557778873268,2559632353869719067,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,4467340230802094977,6824878195482058805,262144 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9345037635197496392,4146665008939200645,524288 --field-trial-handle=2020,i,17521369462857969378,14073346351791894039,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxuph.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2888
- - C:\Temp\usmkecxuph.exe
    C:\Temp\usmkecxuph.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxuph.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4028
- - C:\Temp\i_usmkecxuph.exe
    C:\Temp\i_usmkecxuph.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupjhbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3680
- - C:\Temp\ecwupjhbzu.exe
    C:\Temp\ecwupjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupjhbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Temp\i_ecwupjhbzu.exe
    C:\Temp\i_ecwupjhbzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrjg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Temp\rojhbztrjg.exe
    C:\Temp\rojhbztrjg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrjg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5220
- - C:\Temp\i_rojhbztrjg.exe
    C:\Temp\i_rojhbztrjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3232
- - C:\Temp\geywqoigbz.exe
    C:\Temp\geywqoigbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\i_geywqoigbz.exe
    C:\Temp\i_geywqoigbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\dbvtolgdyw.exe
    C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\i_dbvtolgdyw.exe
    C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:232
- - C:\Temp\tnigaysqki.exe
    C:\Temp\tnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_tnigaysqki.exe
    C:\Temp\i_tnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2200
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3976
- - C:\Temp\xspkhcausm.exe
    C:\Temp\xspkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:416
- - C:\Temp\i_xspkhcausm.exe
    C:\Temp\i_xspkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3376
- - C:\Temp\rpkhcausmk.exe
    C:\Temp\rpkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:784
- - C:\Temp\i_rpkhcausmk.exe
    C:\Temp\i_rpkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezwupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5524
- - C:\Temp\mhezwupmhf.exe
    C:\Temp\mhezwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezwupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Temp\i_mhezwupmhf.exe
    C:\Temp\i_mhezwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3476
- - C:\Temp\hbzurmjecw.exe
    C:\Temp\hbzurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\i_hbzurmjecw.exe
    C:\Temp\i_hbzurmjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljebwtom.exe ups_run
  2⤵
  PID:2492
- - C:\Temp\trljebwtom.exe
    C:\Temp\trljebwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljebwtom.exe ups_ins
  2⤵
  PID:5444
- - C:\Temp\i_trljebwtom.exe
    C:\Temp\i_trljebwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtolg.exe ups_run
  2⤵
  PID:5736
- - C:\Temp\rljdbvtolg.exe
    C:\Temp\rljdbvtolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtolg.exe ups_ins
  2⤵
  PID:5844
- - C:\Temp\i_rljdbvtolg.exe
    C:\Temp\i_rljdbvtolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtnlgay.exe ups_run
  2⤵
  PID:2984
- - C:\Temp\jdbvtnlgay.exe
    C:\Temp\jdbvtnlgay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtnlgay.exe ups_ins
  2⤵
  PID:488
- - C:\Temp\i_jdbvtnlgay.exe
    C:\Temp\i_jdbvtnlgay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvqnigaysq.exe ups_run
  2⤵
  PID:1772
- - C:\Temp\xvqnigaysq.exe
    C:\Temp\xvqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvqnigaysq.exe ups_ins
  2⤵
  PID:5544
- - C:\Temp\i_xvqnigaysq.exe
    C:\Temp\i_xvqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run
  2⤵
  PID:2852
- - C:\Temp\pnhfaxsqki.exe
    C:\Temp\pnhfaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins
  2⤵
  PID:3340
- - C:\Temp\i_pnhfaxsqki.exe
    C:\Temp\i_pnhfaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausmkfc.exe ups_run
  2⤵
  PID:1676
- - C:\Temp\kicausmkfc.exe
    C:\Temp\kicausmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausmkfc.exe ups_ins
  2⤵
  PID:3956
- - C:\Temp\i_kicausmkfc.exe
    C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhcz.exe ups_run
  2⤵
  PID:2080
- - C:\Temp\hfzxrpkhcz.exe
    C:\Temp\hfzxrpkhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins
  2⤵
  PID:724
- - C:\Temp\i_hfzxrpkhcz.exe
    C:\Temp\i_hfzxrpkhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhezxrp.exe ups_run
  2⤵
  PID:4260
- - C:\Temp\wuomhezxrp.exe
    C:\Temp\wuomhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhezxrp.exe ups_ins
  2⤵
  PID:2144
- - C:\Temp\i_wuomhezxrp.exe
    C:\Temp\i_wuomhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:1592
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:5804
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5568

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:1988

C:\Temp\ztrljhbztr.sys
C:\Temp\ztrljhbztr.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
- Executes dropped EXE
PID:4360

C:\Temp\qojdbvtolg.sys
C:\Temp\qojdbvtolg.sys
1⤵
- Executes dropped EXE
PID:4840

C:\Temp\dysqlidbvt.sys
C:\Temp\dysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\sqkidavsnl.sys
C:\Temp\sqkidavsnl.sys
1⤵
- Executes dropped EXE
PID:4048

C:\Temp\qkicavsnki.sys
C:\Temp\qkicavsnki.sys
1⤵
- Executes dropped EXE
PID:3332

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\wrpkhczusm.sys
C:\Temp\wrpkhczusm.sys
1⤵
- Executes dropped EXE
PID:2844

C:\Temp\ojhbztrmje.sys
C:\Temp\ojhbztrmje.sys
1⤵
- Executes dropped EXE
PID:5544

C:\Temp\mgeywrojhb.sys
C:\Temp\mgeywrojhb.sys
1⤵
PID:5028

C:\Temp\bwtoljdbwt.sys
C:\Temp\bwtoljdbwt.sys
1⤵
PID:5740

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
PID:2284

C:\Temp\lidbvtniga.sys
C:\Temp\lidbvtniga.sys
1⤵
PID:3256

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
PID:5440

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:3216

C:\Temp\pnhfcxupnh.sys
C:\Temp\pnhfcxupnh.sys
1⤵
PID:1816

C:\Temp\hbzurmkezw.sys
C:\Temp\hbzurmkezw.sys
1⤵
PID:4976

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgdyw.exe

Path C:\Temp\dbvtolgdyw.exe
Size 226KB
SHA256 23d9fd798e0a3c28c60690f690f431bf2368940c5b0f517feafa042c7d4eb65c
MD5 79727073ecde2782b0baef4dbcb5adea
SHA1 1f2eaba3a54012412d39a3d7d308473afb29adde
SHA512 df4528c0269c329a21ffe9ab969b13c6c505b77b8428a9d052f2b94730a0bd7c4e9f58fe552385bb052e43a40d2fbb4868eda8ea0cd96ba0a0d6d2c855f0fd84
SSDEEP 3072:tGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:MXY4LK+a3lLNngoqRttA7
TLSH
T10834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqlidbvt.sys

Path C:\Temp\dysqlidbvt.sys
Size 141KB
SHA256 1cdba6318f65265e4c0a3ebe397454ae241d4299f18a908f597a76d20a056a3b
MD5 28e0cc36505630f6c483fe12926f096c
SHA1 99c1ae846bc59cdb5c22f682ad79d4454d4fd7a8
SHA512 0111b70445dbe992b25e3b9789247d66a9bb2cba0929f5010248e86ce5d677053748ca03adc64b3aa6f1c1987282a5babb44e0ace91e1cec1342fa419710fad1
SSDEEP 1536:ea3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ea3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupjhbzu.exe

Path C:\Temp\ecwupjhbzu.exe
Size 226KB
SHA256 d5d9877c292f33037c6e81e2b70d7e332c9e16bef42123b706e5132abbdfeeed
MD5 235a0ce8316138ae8d61b28b0a26a9ce
SHA1 40e697c5bb5223c28b8f47cda11f643e9023d759
SHA512 322e233711c204fc2cab57d1162c74d7f878713d7db5d440e6b1835e7d656106ab90b171714b6946396681ae75ed9be6bd0f6fd5e377de0601b928c40e90f3c5
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T17B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigbz.exe

Path C:\Temp\geywqoigbz.exe
Size 226KB
SHA256 8f17d9fef98c57dd4edbd9934abe6088db892ff7ef1a1903611f428564837cfd
MD5 3d39191366b2acfe25d0ebc619ff288d
SHA1 53003c5ec4200a4958be285286ee8bf60f7796d4
SHA512 b0ade0904a1c7ae8474a131ad68a47a7777784613795ca8c1fdb36112a0a9f1f41f3de20d35ca13d618c70e7b4c43a14c89c137095bde996e2eb6dc06312e4ec
SSDEEP 3072:9GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:cXY4LK+a3lLNngoqRttA7
TLSH
T12634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtolgdyw.exe

Path C:\Temp\i_dbvtolgdyw.exe
Size 226KB
SHA256 437c2e5af43e924fd0f547d27b2e780dea37a276df802040d58de7c02051214c
MD5 3e795f147ef5c1906e18d7077a0ef6fc
SHA1 0146daecb7516d7b8d31809735c8080599f025a3
SHA512 b211d3356e0236caba8e45c0bea6817b7fc15db56e4afdd70c03ce9006205f8f1b5a307d5fc6c34180431bea19565ed37c54e5b454016f7a4ea7df54f7b949df
SSDEEP 3072:yYGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7I:yXY4LK+a3lLNngoqRttA7
TLSH
T11134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwupjhbzu.exe

Path C:\Temp\i_ecwupjhbzu.exe
Size 226KB
SHA256 414df6f6609d8526348acd3c64be4c341286fad9b2a208d63c623d046b7f3e16
MD5 f5ef4221ffaf6ce81d1b4d56aa4aed47
SHA1 a782accd1869828a040d216156a217855ea030e2
SHA512 0fcf6e1d45cbf53a2d9561bc7e0a4971003881418386aa0575f9b101ee743db538f3206bc22063fe96311ee85893b6966f45aab7932ac183ef6a741d206d357a
SSDEEP 3072:UGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:7XY4LK+a3lLNngoqRttA7
TLSH
T1B134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigbz.exe

Path C:\Temp\i_geywqoigbz.exe
Size 226KB
SHA256 0bd3d81dd83eca2309cf26afd45c576820885302b49235863b7d318b67467739
MD5 eae0ae71bfe770c4981e11a594a945e6
SHA1 87fd596badd8f706d1e970b62575357254a84df2
SHA512 0afa25c1485698a7e4298bfe04bba9de5368063fef166a53f527f8173661015fa88ff6d0d25c2bab0de4305f3a83c6d69a7998f6a96dc86e3a096f0a7af62d94
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T10E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrjg.exe

Path C:\Temp\i_rojhbztrjg.exe
Size 226KB
SHA256 a5ca2c40f7c192dc3c52e1d03ac1590783e51c93cdde70815048b966a3d00796
MD5 2dfa29e2550789e4bffe94b119494093
SHA1 de3eb9961aa8ec0bf74e59c0d36010cdc839d0eb
SHA512 a62fa77c3eee77f7f01261c3400706f0a7fbef89dc18152db5fb66cb967e4f34a354b961ef47a98a439a6a247a9a38475f5b65aacbac7477768f298af0174369
SSDEEP 3072:bGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:aXY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnigaysqki.exe

Path C:\Temp\i_tnigaysqki.exe
Size 226KB
SHA256 10a051333e8004ddcff7bd954763533e75d2187c82be7e64672cf6e5f6b6c7e9
MD5 73f699aeed2547f1534fbd29f3a39391
SHA1 200a12b6724b02f723d33951f8fd0916c9342a59
SHA512 138470a5edc4ec0a106bca0d9b8c553eff9976e75262580e7c6af79ab0dd1b742e9dab0742e172fceec94ffd06f942eaf022077448491e2744cdc6d6b454bf2f
SSDEEP 3072:0GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:bXY4LK+a3lLNngoqRttA7
TLSH
T13734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecxuph.exe

Path C:\Temp\i_usmkecxuph.exe
Size 226KB
SHA256 a1dc7ededf4cd2606ccd293bc57b962187e9892340718d2eec3c34e11a40d8d7
MD5 5841e92c679b81f9ace1b44c2ea6c020
SHA1 85750a0cf15eb0954bc43aac7325b92dfb467521
SHA512 6d33c3ea34c8f308dcd85d317bf00ba523c6483bbce2cf16cef37ebcce70d8027eb3376c804f4cd50efdb79ffcb81ebea170b9711c37bc9a7c107d1f41971bff
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T16634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkica.exe

Path C:\Temp\ifaxsqkica.exe
Size 226KB
SHA256 85c1d67cd58d578f364d1d7da92bbb6c55a6908f3c6f322cb20d49a050a6e83f
MD5 fd43e7c2d669dc3f4997f9f6c003256c
SHA1 0cb4448bf150359283e3b03c2bb3557f568afc07
SHA512 c9fe3d7ba76b6737b0214844353f7de8d35b99f3e44801f34b6c5dec5b22c9c46a66923c036041aed9598f2cde8ef6328f59f05059bf0392fae48c33f2f9ec83
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T10B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmke.sys

Path C:\Temp\pjhbzurmke.sys
Size 141KB
SHA256 6f217a8fd0eeaefb3333649225a28240e10765a31ae5a858dad19068a4075c52
MD5 1ec75e8743f2474a38bcff0f50d5bbd8
SHA1 97e1e1686de27df922f63bec06054eba66269c1d
SHA512 bca004431bdb192859a0bc21931b1c18329b750d7f9483b843bd98189092ef750f3c7f050fba6317302680813e1cceb8bee8f7f90b3729c1eb3a6d044c2ec94e
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T160E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojdbvtolg.sys

Path C:\Temp\qojdbvtolg.sys
Size 141KB
SHA256 519ecf849b7134d04bb06dcd452625219668581806de50decefc065e863338bc
MD5 066f07f46d04b289b399f53bff88fdcb
SHA1 2ea54683f10dfced2a5131485b4fc943d207df33
SHA512 9eab6fa5d5b2083f3f088236da2081e62e96af83fdf804c5c20a28d757c447998d665990b7fda0b817710029f4574a76f33a845467423d343a11364638a51f0b
SSDEEP 1536:la3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:la3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T149E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrjg.exe

Path C:\Temp\rojhbztrjg.exe
Size 226KB
SHA256 f0cc2447dfa3fb487ec90aef7c2a34fe2fcd19cebf894d3adc6d71edf1f7ec62
MD5 519be095c1f8f9c27839d33de365ace0
SHA1 e32520f061cb364bdcfaee1c828ea98fdc42b7de
SHA512 177e830590861485113d1bb37c5f6b2d97afc140777a39bd0920a7ea4c0492df3c6db991dfeec6e1d6ddbc01e5e979643c2b570b6cabe7c5ab4bf9b7bc72170e
SSDEEP 3072:AGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:nXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavsnl.sys

Path C:\Temp\sqkidavsnl.sys
Size 141KB
SHA256 dc1b04c8597c449b4ca64ef4c57760aed83d9b944ad4abfb50d4b6631880213b
MD5 0e673f58f6860b43ef51593acbe4287d
SHA1 589b014c9255528ba9835484fb57d461c3b70bc0
SHA512 7b8a3d6bc52250730513762a43623835772a8934d3e71e27ab0a656fbc77aebadce588d9cef91017617677232b08f9581b25cb5fbc33e95cdf5e6b59ed629459
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CCE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnigaysqki.exe

Path C:\Temp\tnigaysqki.exe
Size 226KB
SHA256 04ccc4b9826cbb7119c00d4755a675db5452109d3e794ff09a6936083f1fadf2
MD5 d083f4d799341cc57b7f4c9be81b4a2d
SHA1 aaeb8b9910f4ac93441eb50926d09f3f3a61c40c
SHA512 5e6aac72f04a553061cbe3d02b3e52576b219ae2e4c85890da907b73c5c33e92991d9eb900fccd105e7f76751b12e56407e3fa1eb0e6fed65e34ee0188c0ba1a
SSDEEP 3072:jGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:CXY4LK+a3lLNngoqRttA7
TLSH
T1C534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxuph.exe

Path C:\Temp\usmkecxuph.exe
Size 226KB
SHA256 cfd42775b1405de97f7b9b868216736e890bea354bb9799ee7f593e8753ea6de
MD5 7aa47cdc347ce7076cdfee0fe73393bf
SHA1 3f4b59d2dc73e4ab045fef8d5893e2595684a09a
SHA512 915a240e36ef7f6378a08f9fca86dcaaad5d03924aab5391d20dc66c092882e4378279d4d427937154a8c4d8241e3884160a1e340d09493887d7f523ede87f28
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T1E334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztr.sys

Path C:\Temp\ywrojhbztr.sys
Size 141KB
SHA256 70937d907da0533e5862d8a94f8337a0c61d345867c6b9ae822366dc0c522d89
MD5 c02348687caf263f813bed6afd833097
SHA1 0289a37e0bc85e4f3d201748b18c2da6ac8c82f4
SHA512 cd2b567af43d332b4ed77068aa69d515db444ee6e4878ff68304da7e8867fd46f7f2d8f88441e2d4d0fa1e56bb26884a08e421084fc662bc3fa3031ff4af65ed
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T106E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljhbztr.sys

Path C:\Temp\ztrljhbztr.sys
Size 141KB
SHA256 ecdcdbf2fa14f0a25f03b4feab0b8f20df1f233c03d30db28b6b0c8efaaa23b6
MD5 901f46faf2a6e4e554c39464616b10a6
SHA1 7a5693c62307b513113d3b053261210ea1591ae7
SHA512 74aa41bfe087bcaa4503af5eda6525ab11ad8fb075a04e9601de3afeaf6fef17c87471e7da72ae01865557c92942269a27d492caf1969dc9587710ad097d7d3a
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D8E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 4085ab5a49ed4ad4247247d53c363b34de08105b6300f52ab30a635bf24c3d17
MD5 ba4df210f34d2291493aa5b3d7c388ac
SHA1 bf6e836fb556c2841c220d267a59a23619af2d0a
SHA512 21ab3930595f2be0233635d2d1356a889eae4d1b2aeebd7d284b847f7f21da3cc0020d8ea96782c374c9e06583c7931dd84c3919d483a3def2eb0751879f9c5a
TLSH
T11EF0F9AAC920EC2718FD0B1970A5474AE79013572780885F3B3D420C4FB563B468581C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3b633ebc9d1743516782618d5860d6d9c4fa942787556fcb9a793381e0cd51ef
MD5 9a2b48843ed28166dea40f1450d15e0e
SHA1 1b099e657a5317112aab6c26e94976d5e178e129
SHA512 ebfdc635dab3f61707c527c45c0b41f9aa8e8d4cda469d3a7e22496765a72ccc9d0703b6f954d789a09155535a2eb26664239c5b51c268718d10bc0912e98b16
TLSH
T16A419EF7C7E8856DCA0195F0BA187E2BCE2D0914432C3D9A85E4EF1B93E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b98f6d9e66d67901e2167a44bc8b69f4a14dea528faad9dc76be617d95aeac7c
MD5 823133d5ca275b10f4a54bcdd4858d94
SHA1 9b97c07d18859023e481c5d12b3337f5438409c0
SHA512 a0a23ee055133b81ae0c1f832cd220580f92f333094a8338ea7b5f623d5c153c2b95f18a334176c4b2d955e0637f3d09fbc55e373ef64ea59ce842010cb1b719
SSDEEP 192:sxZSR3yMqZjK1Ml8McN/f0s8OlAxE0CXUyynDOzodpZAbJ/W6+WNsWC/Y0d6DxTC:sxZS40N/f0s8OW60Ly8VmV/bA/5mxGjP
TLSH
T15A62F906AA3859778CDBD319FA457F53D3F9156392404E48AAFCCB0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 44b1bc087a5c37a28414a2fa5c94a96780c2b632c7061765924738d629756012
MD5 ccb3458f2f6fa8cb5ff4a8043e258074
SHA1 e3f479d8f23db93a7bd0d406bb0bc25de125db21
SHA512 cc45bf61615660923845e3b44ed60db583dbd00e31fff789897a1b1ba95f6cbad91442ec300206276bede9a69ac924dcce900fdd1135bf018e9f0eef18c2934d
SSDEEP 192:sxZSR3yMqZjK1Ml8UQScN/f0s7lCE0CXUyynDOzodpZAbJ/W6+WNsWC/Y0dgzDxG:sxZS4qhN/f0s7v0Ly8VmV/bA/5UxGRd
TLSH
T1CF72F916AA38597B8CDBD319FA457B53D3F9156392504E44AAFCCF0C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 8a926ec26759fffaabb4603075f5c94538a657bf5b88476d0cdaa3b935c95882
MD5 570392ff9199333c535482b37ae2b127
SHA1 21ab04a241581efc6476e34d974de04bba8d3473
SHA512 2bf95d98ffe12009cc396257d725983d32b42b8315b32859faa3b7227d85306537a4f0c3636fc429743d61e34d576d11bb342ace17d5b828cc41ed6bf317fd75
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3M3pQLlz:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKM3pI
TLSH
T15E031B3B680CCB7E4F805E9CED266F9A6EE8018B6698895447FA844C03C76EF55170DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 47286517b1b16802bb3fef654b13557b0fc9da10ee14f1726aa2cf126737327f
MD5 a418a795718fc2385edad36c2069a457
SHA1 538d84b3eea8197afb00dbc931384e9898e442b9
SHA512 bd11d650728396578399ba65c878ff8e759719cadafc0553d5a4ac49768732da1bf426c7fb8f245b0207d69e5c260544174a38061ea671d3dad3fb935953e1e6
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv76p7:AFBHhTofhno2mB21q3Llbfe3sLDdeEp+
TLSH
T1DCB29F56717B12033C3E291CA7A29B370E4272A33558A56F7BB800BA4E67E115DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b6a23c0a527d46cc7122e3c88599ea9bffa9227b1d42a598f70a0021199a7e93
MD5 17e939337c69b43c1844621498753b4f
SHA1 3d4dbfcd0a2223c170b6064ade59b5ee8a639dc8
SHA512 0c824190832b32c2ed18c9c1e61596a801f044297b0373f6438261352ceffebdb81ff71f214638c5ee5b6f63af5d9d746ba02b8344c6269043764dbfe156dca4
SSDEEP 384:yWiFKtNnNnb9F38Nh8TUNTUlIRCyeEldjf+8oQAfhCclSm3vh+qooTzsp9QHy/7U:8FKjZb73mwgrpoQAx13vhGoPuIb
TLSH
T141E2A2F198E79977E8AE4B87673D6E029EFCC153B5881984B7C44D0DCC862BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 c106b8b8ad95c41f9579cfb1b647c13daefe95983bc537eb04d1bd91fa96e5a6
MD5 696fed74e2c3c6d371b55ff1c7793a94
SHA1 190c98854226f25146ae01bb05d163d4fd3a08e5
SHA512 53ffbdb2e2a41f349b38df04e603093e2156ee631065c7695766eaddf7171fbd5061e0432bfb090e7536553e261f4ca6a3312a1942c6d473b7265b24fea5bf46
SSDEEP 384:n59iF9CcmyWCs38Nm8TUNTUlIxBydvAoBadjf+8oQAfhCclJ7hkP+lFYS/llHy/C:WFccps3pwg5sOoQAxr7hkoFYS/pow
TLSH
T191B23932EC59CABBECE65FD9A74A7A07EFE00163C5885AD4DAD81D0D00DB29D1707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 71a467a9eb4cb98841a7e90be3f59ce202ce26493af6bd3e2e2d2e3370d4fc88
MD5 248be043ab1ec4d1a2815b654b5c16c2
SHA1 c20be975f8eb14deb23b1e6500972d41e095bb54
SHA512 06f7e55cd03216ebcc49539b97610cf85ab4b7171f8427ef178c858b92410ddea14fd2087f0a565242fcebdadf84dd91fa43ae7b1ebdd6281606b56ee99499c3
SSDEEP 384:y5aiF9CcmyWCs38Nh8TUNTUlIRLyxdldjf+8oQAfhCclSmTvh+qooTzsp9QHy/7k:6Fccps3mwgWpoQAx1TvhGoPug
TLSH
T1E7D24B31EC699AB7EDE75F89B74E7603DFE0426386CC5AD4CAD95E0D009B29D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c1779ebe51e098050bdb42a4e807d550dde2c3bca1e4faf39dfdaf999945d4a4
MD5 9a8053a69927c27edb0408ee970a96b3
SHA1 aa1ba5a2a4d22fc05796a9bcc877ce9990bd68a6
SHA512 c60a7a4c294927d7b0fa19ea0aaf228105fe6b780f2819ee1131876bbcbd5cb5febe1f7df22bc2ae786cce50ee3a70afc49f189423ae4500c4697afed7bdd9f1
SSDEEP 384:y5aiFKtNnNnb9UR38Nh8TUNTUlIRCyjdldjf+8oQAfhCclSmQvh+qooTzsp9QHyw:6FKjZbK3mwgLpoQAx1QvhGoPuIb
TLSH
T13CD24C32EC65DAB7EDF79F89B74A7607AFE0026385CC5AD4DAD85E0D008729D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4776f29d41d4bfb961ec1134cf29aba44b4b2d26c8c51877a564fb965c78d501
MD5 2f5812eb643e20b21db7134475a6361c
SHA1 878db77198e91e537d7c12f6be3ecbab9ebfa759
SHA512 15b65ac2f44134513523b0db4d796ab4854d428c2a77b75fd168826c4bbbebe7c70c87ac66144a34980ed4ad70ef24fea9e4341f23ca779cf9d2b5e73652a166
SSDEEP 384:ydiFKtNnNnb9f38Nh8TUNTUlIRCyRdldjf+8oQAfhCclSmQvh+qooTzsp9QHy/7U:tFKjZbZ3mwgtpoQAx1QvhGoPuIb
TLSH
T188D23C32EC69DAB7EDF75F89B74A7647AFE00263858C5AD4DAD85E0D008729D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 47b923f3039f1f00c6e115995a740b893deb6e35f389808d6ebd173927ffd108
MD5 dc83af603a2e9596baa3ea30f045123f
SHA1 1368967c6d0c9520522db81c157c122212cb7f9a
SHA512 ad06ebc20ca7127ccbc7e378a96e893c0b5b7ae3a8e8f85c8707c698340b0bc2355d98be6914cdcee3598f0d1b023244b7795ed5b7a56baa476d4bcc091e4423
SSDEEP 384:y5aiF1tNnNnb9X38Nh8TUNTUlIRCyTdldjf+8oQAfhCclSmVvh+qooTzsp9QHy/I:6F1jZbN3mwgfpoQAx1VvhGoPuIb
TLSH
T1F7D23C32EC65DAB7EDF79F89B74A7647AFE00263858C5AD4DAD85E0D008729D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ranked_dicts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ZxcvbnData\3.2.0.0\ranked_dicts
Size 865KB
SHA256 5820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
MD5 959460a18173908111523bbf4c39073e
SHA1 c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA512 291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
SSDEEP 12288:8WG0mOflZV35OtQm/b1Ed7pJPR3cjqKMjgP/pwH6sKFbEb3d4CPLsVQCcekWpH6m:k0m0lH35mVb1AJPtOl/06s6Wd4iBSsG
TLSH
T1AB15B071E714177E5A9F23AF98856B4546799302982204EAF7A6034D810BDCC63BFB3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3c1daae277930596bf6adccc61f0d7c500d7625ee459c35b78d8b2ff45c204d8
MD5 c96990202b54432c65b12a16bcc645c1
SHA1 e8b3da409f3e09b9d8a4da95605b659c829a3169
SHA512 c689641e5c477cc81f756e85f92e3dd78d842e8ff1abac03e05f9faca2eaee2f3c60286d2f9cb460a893c1053b8839fdedd13c4d721fc4503730ad694daa2fee
TLSH
T1C73131E15D3C2AC1D0BE0E6F644B38FC91E8D326F46470396444EE94163920D614187F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7519eddef098615ac6cf21f088ed72c28f1131aea778579895823ab520890fe2
MD5 248976e1c1606c262223250bb5d37df3
SHA1 57b236853e26cd29cd084cbf145d51554bebb070
SHA512 af855758032917fa6233abd6a428cb60cd055b009cdeaeb36384209b874799ff403ede4bb0f170449cfcd98bd0d42f19894958392dfa87960e22ac28ada33764
TLSH
T1ED3123E15D3D2AC1E0BE0EAF644B38FC91ECD726F4A430796444EED8163960D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 7fd73687e0262676f3a4c17e0ed2c5bca48b021f88fa343e0bbbd54a1a22a5ed
MD5 c89ad3b6da65e4acb04e7fd8d84098cb
SHA1 7ad19097d3cb94f0e6e31114f57c37671f7cf94e
SHA512 161e5bfacaab0546353fdcfade24f007c4dc9c63a40bfabc5cc272d0eeaf09c3bb3685a0a09b088174cad3ce5205c972371db5e37e81e0e5eb493a63b22289e0
TLSH
T1E24130E15C3D2AC1E0BE0E6F645B38FC91ECD32AF4A430796848EED8063960D654147F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1423664762\data.txt
Size 146KB
SHA256 bcf1a17189b6ae7371429804a2df2ba36c798b142dbc4f7f06a7332834405408
MD5 7a8bee21ef52bf7f962551770605aace
SHA1 8f205bb793c0269f210f7e8cbfdf594f089c7d0f
SHA512 8a2706485d3408e09242d59cd72ad367eeeccc948d7c3a74b3c7f8c7a2b22ad44b94ba426a341da606dbc53c4d8c519df921e879347018ca809d1ee63d13e7fe
SSDEEP 3072:cPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYErqsZo+Eog7TAMy3nBt5rd:wX1aI5aZoKzMJ07NrpoTZ8My3nld
TLSH
T1A3E3F1218EC01FDDDFA8261C50BF0B1DA7D0878D443A6686EB63BD4EBF9B50856274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_1423664762\manifest.json
Size 52B
SHA256 5a708ec5a10762801001cca55997ce9813d9c312a009b3c4fa197426c752fe90
MD5 4fb639ca1de22fb121f954c14c414349
SHA1 a6a124dbf473075e287557494d3a0375e8d42c2a
SHA512 c5cf5e55ce9ce6c86d0d346afffee7ecabee609ff6c4303c3fcf21f3d46fe2f770636ecfac5fe165b777bc93ecc90e55992254fadefe8b8f2e5b17a2bab6a643
TLSH
T1C2900260442491171AC10E506670F8C59391661955850D1D04451548029546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_744111794\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3100_811894340\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1816-532-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1944-191-0x000001F1A0CE0000-0x000001F1A1CE0000-memory.dmp

Download

memory/1988-166-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2284-410-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2844-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3216-465-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4048-300-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4360-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4360-223-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-244-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4840-293-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4976-531-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5388-328-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5440-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5544-357-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5740-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download