systex | 028944a0e2eabd8e089bd82c0e1ac5013d7329374b0fb37162d4ba05667db563

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260606-pgp2msdy4w
SHA256 028944a0e2eabd8e089bd82c0e1ac5013d7329374b0fb37162d4ba05667db563
MD5 221bfc91141423bab14bda81cd558892
SHA1 7fcc98e67bed1980575ba6da1673553c6ec585b6
SHA512 18952d28c41154a33e9512c111ee3acb9c5f89a7d3e9c6a20857cc1e7efb5537985a34ece52fc427759e2f9f2be6cd73d9650a05d598bf5ae616b4630630df58
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T195344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6076	CP.exe
1788	uomhfzxrje.exe
2140	CP.exe
1532	CP.exe
3348	i_uomhfzxrje.exe
4396	mkecwuomhe.sys
4100	CP.exe
2676	uomgezwroj.exe
4356	CP.exe
3456	CP.exe
5792	i_uomgezwroj.exe
2436	ztrljdbwto.sys
5156	CP.exe
5480	omgeywrojh.exe
2392	CP.exe
3692	CP.exe
5816	i_omgeywrojh.exe
4524	qoigbytrlj.sys
2272	CP.exe
1696	igbytrlgdy.exe
4064	CP.exe
6000	CP.exe
3040	i_igbytrlgdy.exe
892	gdbvqoigay.sys
5140	CP.exe
2456	vsqoigavtn.exe
3820	CP.exe
2680	CP.exe
3936	i_vsqoigavtn.exe
5748	idavtnlfdx.sys
2524	CP.exe
5736	qnifaysqki.exe
6100	CP.exe
864	CP.exe
5144	i_qnifaysqki.exe
1376	xvpnifaysq.sys
408	CP.exe
244	qnlfdysqkf.exe
1912	CP.exe
4076	CP.exe
5476	i_qnlfdysqkf.exe
3348	smkfcxupnh.sys
6040	CP.exe
1476	ecxupnhfzx.exe
4120	CP.exe
4072	CP.exe
5308	i_ecxupnhfzx.exe
4956	kecxupnhfz.sys
2060	CP.exe
4676	wupmhezwup.exe
5024	CP.exe
1824	CP.exe
5756	i_wupmhezwup.exe
3884	kebzuomhec.sys
3400	CP.exe
4656	wuomjecwuo.exe
2896	CP.exe
4540	CP.exe
4724	i_wuomjecwuo.exe
5568	mjebwuomge.sys
4512	CP.exe
2816	bztrljebwu.exe
2604	CP.exe
1224	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1592373981\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\product_page.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\edge_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\edge_tracking_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\shopping.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_467812038\_locales\or\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhfzxrje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lavtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytrlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdysqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytrlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhfzxrje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lavtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdysqkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfrmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqoigavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfrmkecwuo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3744	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2196	ipconfig.exe
5268	ipconfig.exe
2008	ipconfig.exe
4536	ipconfig.exe
4424	ipconfig.exe
3268	ipconfig.exe
6132	ipconfig.exe
2820	ipconfig.exe
3192	ipconfig.exe
5796	ipconfig.exe
4796	ipconfig.exe
2484	ipconfig.exe
4636	ipconfig.exe
5872	ipconfig.exe
3472	ipconfig.exe
648	ipconfig.exe
3592	ipconfig.exe
4512	ipconfig.exe
2064	ipconfig.exe
5044	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3719071630"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31258094"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134252219022050759"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{470AF307-B54C-4AD8-889A-F91C26D3D2A0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe
1788	uomhfzxrje.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	i_uomhfzxrje.exe
Token: SeDebugPrivilege	5792	i_uomgezwroj.exe
Token: SeDebugPrivilege	5816	i_omgeywrojh.exe
Token: SeDebugPrivilege	3040	i_igbytrlgdy.exe
Token: SeDebugPrivilege	3936	i_vsqoigavtn.exe
Token: SeDebugPrivilege	5144	i_qnifaysqki.exe
Token: SeDebugPrivilege	5476	i_qnlfdysqkf.exe
Token: SeDebugPrivilege	5308	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	5756	i_wupmhezwup.exe
Token: SeDebugPrivilege	4724	i_wuomjecwuo.exe
Token: SeDebugPrivilege	2916	i_bztrljebwu.exe
Token: SeDebugPrivilege	1472	i_omgeywqljg.exe
Token: SeDebugPrivilege	1396	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	1960	i_lavtnlfdxv.exe
Token: SeDebugPrivilege	5796	i_dxvpnifdxv.exe
Token: SeDebugPrivilege	780	i_usnkfcxvpn.exe
Token: SeDebugPrivilege	2720	i_nhfzxspkec.exe
Token: SeDebugPrivilege	444	i_hfrmkecwuo.exe
Token: SeDebugPrivilege	4644	i_xrpjhzwuom.exe
Token: SeDebugPrivilege	4752	i_mgebwtrlje.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2612	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 1948 wrote to memory of 4344	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 2612 wrote to memory of 5328	2612	iexplore.exe	82
PID 4344 wrote to memory of 5344	4344	iexplore.exe	83
PID 5328 wrote to memory of 4112	5328	msedge.exe	84
PID 5328 wrote to memory of 3744	5328	msedge.exe	85
PID 5328 wrote to memory of 3840	5328	msedge.exe	86
PID 5328 wrote to memory of 1008	5328	msedge.exe	87
PID 5328 wrote to memory of 3840	5328	msedge.exe	86
PID 5328 wrote to memory of 3840	5328	msedge.exe	86
PID 5328 wrote to memory of 1008	5328	msedge.exe	87
PID 5328 wrote to memory of 5408	5328	msedge.exe	88
PID 5328 wrote to memory of 5512	5328	msedge.exe	89
PID 5328 wrote to memory of 5408	5328	msedge.exe	88
PID 5328 wrote to memory of 5408	5328	msedge.exe	88
PID 5328 wrote to memory of 5512	5328	msedge.exe	89
PID 5328 wrote to memory of 5512	5328	msedge.exe	89
PID 5328 wrote to memory of 5332	5328	msedge.exe	91
PID 5328 wrote to memory of 5332	5328	msedge.exe	91
PID 5328 wrote to memory of 5332	5328	msedge.exe	91
PID 1948 wrote to memory of 6076	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	93
PID 1788 wrote to memory of 2140	1788	uomhfzxrje.exe	96
PID 5328 wrote to memory of 2928	5328	msedge.exe	99
PID 5328 wrote to memory of 4328	5328	msedge.exe	100
PID 5328 wrote to memory of 2928	5328	msedge.exe	99
PID 5328 wrote to memory of 4328	5328	msedge.exe	100
PID 5328 wrote to memory of 1388	5328	msedge.exe	101
PID 5328 wrote to memory of 4408	5328	msedge.exe	103
PID 1388 wrote to memory of 3256	1388	msedge.exe	104
PID 1948 wrote to memory of 1532	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 1948 wrote to memory of 4100	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 2676 wrote to memory of 4356	2676	uomgezwroj.exe	113
PID 1948 wrote to memory of 3456	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 1948 wrote to memory of 5156	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5480 wrote to memory of 2392	5480	omgeywrojh.exe	122
PID 1948 wrote to memory of 3692	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1948 wrote to memory of 2272	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1696 wrote to memory of 4064	1696	igbytrlgdy.exe	131
PID 1948 wrote to memory of 6000	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5328 wrote to memory of 5860	5328	msedge.exe	136
PID 5328 wrote to memory of 5820	5328	msedge.exe	137
PID 5328 wrote to memory of 2916	5328	msedge.exe	138
PID 5328 wrote to memory of 5696	5328	msedge.exe	141
PID 5328 wrote to memory of 5696	5328	msedge.exe	141
PID 5328 wrote to memory of 2416	5328	msedge.exe	142
PID 5328 wrote to memory of 2416	5328	msedge.exe	142
PID 1948 wrote to memory of 5140	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2456 wrote to memory of 3820	2456	vsqoigavtn.exe	145
PID 1948 wrote to memory of 2680	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 1948 wrote to memory of 2524	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 5736 wrote to memory of 6100	5736	qnifaysqki.exe	154
PID 1948 wrote to memory of 864	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 1948 wrote to memory of 408	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 244 wrote to memory of 1912	244	qnlfdysqkf.exe	163
PID 1948 wrote to memory of 4076	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 1948 wrote to memory of 6040	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 1476 wrote to memory of 4120	1476	ecxupnhfzx.exe	172
PID 1948 wrote to memory of 4072	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5328 wrote to memory of 4812	5328	msedge.exe	177
PID 5328 wrote to memory of 4812	5328	msedge.exe	177
PID 1948 wrote to memory of 2060	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4676 wrote to memory of 5024	4676	wupmhezwup.exe	184
PID 1948 wrote to memory of 1824	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 1948 wrote to memory of 3400	1948	2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_221bfc91141423bab14bda81cd558892_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff895f8c188,0x7ff895f8c194,0x7ff895f8c1a0
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,13855457264231151966,12675168738179404944,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,13556888633416657365,12610705804262648689,262144 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,14758614445807995015,12327024089136106694,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,1511244489923884373,11627911284525792089,2097152 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,16122003258643171295,11058815328369466719,2097152 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,4292670331232013436,5082581908054848243,2097152 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7757807181058620217,16066038944359899792,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,15691919968411419696,180247054248281012,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12221787808481854787,17866629179181116934,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1140
        5⤵
        
        PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11751521483526270755,14436491785479368663,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11751521483526270755,14436491785479368663,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,1424180628081756054,7052512015795228110,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,6873268063812493115,10572521054409026520,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9014275410369748734,18446097615880327125,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,12073824712481306478,7952127426018323187,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,3667491587458440605,12779838553553083720,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,12778192378497852324,11305055875226140114,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,15988066328664765586,9688969520961883657,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14948086277621614323,566550379691035935,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,15735408824456916429,16559367326726811881,262144 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:10
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,15449529574979267055,11685390178386338224,524288 --field-trial-handle=2252,i,9788796045113871748,12028768392553273008,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
      4⤵
      PID:6016
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhfzxrje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6076
- - C:\Temp\uomhfzxrje.exe
    C:\Temp\uomhfzxrje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhfzxrje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Temp\i_uomhfzxrje.exe
    C:\Temp\i_uomhfzxrje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwroj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4100
- - C:\Temp\uomgezwroj.exe
    C:\Temp\uomgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwroj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3456
- - C:\Temp\i_uomgezwroj.exe
    C:\Temp\i_uomgezwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5156
- - C:\Temp\omgeywrojh.exe
    C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\i_omgeywrojh.exe
    C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytrlgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2272
- - C:\Temp\igbytrlgdy.exe
    C:\Temp\igbytrlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytrlgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6000
- - C:\Temp\i_igbytrlgdy.exe
    C:\Temp\i_igbytrlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqoigavtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\vsqoigavtn.exe
    C:\Temp\vsqoigavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqoigavtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\i_vsqoigavtn.exe
    C:\Temp\i_vsqoigavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2524
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:864
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdysqkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:408
- - C:\Temp\qnlfdysqkf.exe
    C:\Temp\qnlfdysqkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdysqkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4076
- - C:\Temp\i_qnlfdysqkf.exe
    C:\Temp\i_qnlfdysqkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Temp\ecxupnhfzx.exe
    C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Temp\i_ecxupnhfzx.exe
    C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhezwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2060
- - C:\Temp\wupmhezwup.exe
    C:\Temp\wupmhezwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhezwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1824
- - C:\Temp\i_wupmhezwup.exe
    C:\Temp\i_wupmhezwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomjecwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\wuomjecwuo.exe
    C:\Temp\wuomjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomjecwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\i_wuomjecwuo.exe
    C:\Temp\i_wuomjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1224
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqljg.exe ups_run
  2⤵
  PID:1464
- - C:\Temp\omgeywqljg.exe
    C:\Temp\omgeywqljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqljg.exe ups_ins
  2⤵
  PID:4848
- - C:\Temp\i_omgeywqljg.exe
    C:\Temp\i_omgeywqljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlgd.exe ups_run
  2⤵
  PID:4396
- - C:\Temp\ljdbvtnlgd.exe
    C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
  2⤵
  PID:3076
- - C:\Temp\i_ljdbvtnlgd.exe
    C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lavtnlfdxv.exe ups_run
  2⤵
  PID:3420
- - C:\Temp\lavtnlfdxv.exe
    C:\Temp\lavtnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lavtnlfdxv.exe ups_ins
  2⤵
  PID:5344
- - C:\Temp\i_lavtnlfdxv.exe
    C:\Temp\i_lavtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvpnifdxv.exe ups_run
  2⤵
  PID:1440
- - C:\Temp\dxvpnifdxv.exe
    C:\Temp\dxvpnifdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvpnifdxv.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_dxvpnifdxv.exe
    C:\Temp\i_dxvpnifdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcxvpn.exe ups_run
  2⤵
  PID:1980
- - C:\Temp\usnkfcxvpn.exe
    C:\Temp\usnkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcxvpn.exe ups_ins
  2⤵
  PID:4976
- - C:\Temp\i_usnkfcxvpn.exe
    C:\Temp\i_usnkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkec.exe ups_run
  2⤵
  PID:388
- - C:\Temp\nhfzxspkec.exe
    C:\Temp\nhfzxspkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkec.exe ups_ins
  2⤵
  PID:5772
- - C:\Temp\i_nhfzxspkec.exe
    C:\Temp\i_nhfzxspkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfrmkecwuo.exe ups_run
  2⤵
  PID:1396
- - C:\Temp\hfrmkecwuo.exe
    C:\Temp\hfrmkecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfrmkecwuo.exe ups_ins
  2⤵
  PID:5620
- - C:\Temp\i_hfrmkecwuo.exe
    C:\Temp\i_hfrmkecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhzwuom.exe ups_run
  2⤵
  PID:5032
- - C:\Temp\xrpjhzwuom.exe
    C:\Temp\xrpjhzwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhzwuom.exe ups_ins
  2⤵
  PID:3460
- - C:\Temp\i_xrpjhzwuom.exe
    C:\Temp\i_xrpjhzwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgebwtrlje.exe ups_run
  2⤵
  PID:3248
- - C:\Temp\mgebwtrlje.exe
    C:\Temp\mgebwtrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgebwtrlje.exe ups_ins
  2⤵
  PID:4776
- - C:\Temp\i_mgebwtrlje.exe
    C:\Temp\i_mgebwtrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:972

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:2436

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\gdbvqoigay.sys
C:\Temp\gdbvqoigay.sys
1⤵
- Executes dropped EXE
PID:892

C:\Temp\idavtnlfdx.sys
C:\Temp\idavtnlfdx.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\smkfcxupnh.sys
C:\Temp\smkfcxupnh.sys
1⤵
- Executes dropped EXE
PID:3348

C:\Temp\kecxupnhfz.sys
C:\Temp\kecxupnhfz.sys
1⤵
- Executes dropped EXE
PID:4956

C:\Temp\kebzuomhec.sys
C:\Temp\kebzuomhec.sys
1⤵
- Executes dropped EXE
PID:3884

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
- Executes dropped EXE
PID:5568

C:\Temp\ztrljdywqo.sys
C:\Temp\ztrljdywqo.sys
1⤵
PID:5892

C:\Temp\bvtgdbvtnl.sys
C:\Temp\bvtgdbvtnl.sys
1⤵
PID:1292

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
PID:1556

C:\Temp\qkidxvqnid.sys
C:\Temp\qkidxvqnid.sys
1⤵
PID:3272

C:\Temp\fdxvpnifax.sys
C:\Temp\fdxvpnifax.sys
1⤵
PID:3248

C:\Temp\causmcxupn.sys
C:\Temp\causmcxupn.sys
1⤵
PID:5080

C:\Temp\upnhczusmk.sys
C:\Temp\upnhczusmk.sys
1⤵
PID:1508

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:840

C:\Temp\ztrljebwur.sys
C:\Temp\ztrljebwur.sys
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvqoigay.sys

Path C:\Temp\gdbvqoigay.sys
Size 141KB
SHA256 8433eeab8984564965253acb72627be4c960386258242d301d85da9207518a12
MD5 0910608c24bf4a9084a25a63c256fc44
SHA1 ec154b868f7fb619bfc66682c1032c9cae17be30
SHA512 25979cc1f450ff709ccff1e858ef30ad82534435e96a4096c7b84721c65c2f8ae0f8d8102d72652cfa588ecdb3fdadb1eef4a280514c2b30ab620f6f427a2f86
SSDEEP 3072:TsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:TsQmpcF8BzXfwV
TLSH
T126E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytrlgdy.exe

Path C:\Temp\i_igbytrlgdy.exe
Size 230KB
SHA256 48d133506169cf0d131321a6281ea20678c9f5bc62701d10722e3e43e17df006
MD5 d20467df85ebb696d8ded564be06293c
SHA1 428fab073788e400603e3c0e703ab924901bc289
SHA512 bbb5a0594c60fa5e408b5b47d5773fa2e9a8a2423bbd8d68cec5f1951a80a8483650341b462088a8331e000fbcf677735a383f62f2cf3c1ddc6f6979e19cae4d
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:SghLQ0sQmpcF8BzXfwVfAI
TLSH
T151344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywrojh.exe

Path C:\Temp\i_omgeywrojh.exe
Size 230KB
SHA256 a18926381e61f82de9f7c9464abc92d274b21054a2601e0c10995a5edeef4a29
MD5 6b3848d136580e4211a0bca93ae0d4f1
SHA1 8745cac1e13f0c40398f5b7ef99ef841e9ba17b3
SHA512 2703277f267d4de0bbd3fd6959b2cae45b65926b81163c69417a736cfdbb9bbf3811f85225d93b8e7f4003a66816e43a24fa2c6dc870be41dd66bbe88dc3d480
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifaysqki.exe

Path C:\Temp\i_qnifaysqki.exe
Size 230KB
SHA256 81a71209e06e9e9a9a47271e77acc837a993f6a40dad8c6d41999c4b559133fe
MD5 c4c24e00a1cafb560ca98bb43d7e567d
SHA1 7c7d0e02beeb9bfb66ecfb39a77167c364707b8f
SHA512 4ae6cd8a8f3887a164e2df12c455c452705e4c81bbf3c9835641b091d06fdcd89533c919329ddc66167bae29a8efac9a0bbf224fa544b88a5ebb72e3a39b0701
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:oghLQ0sQmpcF8BzXfwVfAI
TLSH
T167344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgezwroj.exe

Path C:\Temp\i_uomgezwroj.exe
Size 230KB
SHA256 434df59dcc264c02a8419d7cafba08a9c860ef9a44a8a7558975a10e7c29c6a4
MD5 615c313a395d9d99846a293e3bed24e1
SHA1 21bea764b1b7436ac7e87fb06b1ecdbd05735bd8
SHA512 8017d871cc72e3aca4d86146f0e4479a60cdc6c3e832b0820e0e24404059a0b67c45e56b95c4c53a65fc73b7d1298793d472fbd0ba94cddb92c974b39558771e
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T171344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhfzxrje.exe

Path C:\Temp\i_uomhfzxrje.exe
Size 230KB
SHA256 4bca151cafd0123bb237ba685c18671b6d53af54651ebedfb1f444162e72bc38
MD5 6101c90f1f96d811f8163d1ff46d02db
SHA1 ff299233ec59b705b51dc7093fb0952ab79c4031
SHA512 9b1dfea630b0e0018a43853e002f1fbd0ba9f6ad4eebf910a61b28e5902d03d137cbdac521cb24fc0d99e95d50d5a0d5d9a04f4579b985e2d810b0e7b518b9d3
SSDEEP 3072:NNJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9p:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T179344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqoigavtn.exe

Path C:\Temp\i_vsqoigavtn.exe
Size 230KB
SHA256 884c238345292741141bcc223a17e6b5f0c35e0a47f55dbb56907d7db27f1d52
MD5 3e801693f84616550bc9b83566ca58a9
SHA1 b2fddf6c199757e665dac468d227760656e319b1
SHA512 03464e4a626ddca16b1a3b2af01ea6ec259d88ef751b053feb28873e76125d3dec259a219fa8b4b96f25ba2dd59343a7f452ce3a343d2fd57b1dbf278ea2be35
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FA344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdx.sys

Path C:\Temp\idavtnlfdx.sys
Size 141KB
SHA256 ca6cfc17988b376f4265db14d0dc645c14c098ac82a311795efc1445f5b61d3d
MD5 8bc509be9d3288165da7d36e48545f17
SHA1 0bc68b76cbeffbfd7fc96ad76eb0d794a35b699a
SHA512 6fa14774fa5b91fd8dc060c014ee4787f07f784f86078aaca8f09779ca418c5c772988c17c4b903610812704565b0839e39b6736bf42b8eba44bd9045a727b7a
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T138E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytrlgdy.exe

Path C:\Temp\igbytrlgdy.exe
Size 230KB
SHA256 915f1bfa074685b9e45576e430fddee0651666fd8731675753c929866c21fa56
MD5 bfde83f7a305ecaccb32e77cb47728b3
SHA1 33a0fba2699c2c0920300a5c6c6a37ae58a15d39
SHA512 ae0bacd92669f150f1885cabc9a765e8b42c93e43287a53b9c0fd7f1fdd5d9abab83d080cefc36b1429d99594c49a4cca8fab0e694eda253e9cbc0912604544d
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T13A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwuomhe.sys

Path C:\Temp\mkecwuomhe.sys
Size 141KB
SHA256 89b53fc6abeb3ef88a372abe2ce8e0fa493962f89071bbbc6ff49fc505b9fc08
MD5 ec2c95c18225aee7763f6e08a4a6a568
SHA1 961ac4361e22c34bc5faf485daceb933b4620006
SHA512 e93d1835457b854a3bc2932a1579ff634153fd2803ddff402c6c83989c841ebfd3dc9e5091dfe78632de736f1b49cc890548cb1a58c3aa7a11752226a95d8c1e
SSDEEP 3072:DsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:DsQmpcF8BzXfwV
TLSH
T1D3E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojh.exe

Path C:\Temp\omgeywrojh.exe
Size 230KB
SHA256 43d5c76f1413988720cc9cc90e3a395f82fa29e2b7ac59107edc043ee55de15b
MD5 c36f82358c273b000e9d42bfef0bed3d
SHA1 b91e23f7d96e73842f743193e9637023669e79c3
SHA512 d8d570e1d9b79b629212eb87c3e2d3833ef92713ec3a912a5240a886e084dceae68320b8c24ae4119adbfcfaa787959590421bb0824df42008a7dd0470f795de
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqki.exe

Path C:\Temp\qnifaysqki.exe
Size 230KB
SHA256 39de4270d505d6418f72798b232f13cf8c15a5f88eee308c4998841ae3cfae19
MD5 2ec14f25a6f980e9116f56c445fd5d67
SHA1 84ce8317f6d6b36513a1ea2413229a37e607c814
SHA512 c5dfc5ff6988e177e28b3f615bb518b177105a79ae3f98c948b6775510aae7f0729be2bbe39950ad16ed78f6d53e71382cc375def957a0033ef98b5224f59726
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T163344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytrlj.sys

Path C:\Temp\qoigbytrlj.sys
Size 141KB
SHA256 1b3e4c3b01fc02ca72ce6b93e4349661db0e9211636c31b0aebb3d80ea454101
MD5 224d41da89709b770d85d11ccdd61e6a
SHA1 3dc3db2ebe1d234385df19b2d12e7523878e01cd
SHA512 895623ea9eccafd1c6364e900af9da88323db42a9b7f6dca9270bc4e6dde4464ff938b162119b9472248b1b5894f29846af73ee5e1269e3de5107084463d48f0
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T10FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwroj.exe

Path C:\Temp\uomgezwroj.exe
Size 230KB
SHA256 4435cfb85c1336479943e77da14d7f16008ee90cd1364436c13468d76a5ab5ee
MD5 14ece96f1354d075dd191d5d3cae72e7
SHA1 2a0e8e38b34ded716433aacaf4c0bf7e6233f8cd
SHA512 b771013d96e69dd3a0f3c22366f4dc3297174b4a7c8335e1fc7a7b359351c1b4595ad4026432ba1dc2c7f0617b3a8ed8077a28750423bfb21d13860852f0be12
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T14E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhfzxrje.exe

Path C:\Temp\uomhfzxrje.exe
Size 230KB
SHA256 b25adf60356bdaf2c685475fe5736ebb7f1624a3fde6c16970d5da43d9afe7fb
MD5 29d67d7713022c048b9105bd7b1fc207
SHA1 b390ff6c5f696984ff8f22f2e500737c0ddbce16
SHA512 7be4006e86faef8da277543276cd05ab5cf5f936db2dc7e6ac7ec78b56aec4dd81a26e5a459178434ea419358085b92856a127efb4bbb7d83b7570921093d147
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T118344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqoigavtn.exe

Path C:\Temp\vsqoigavtn.exe
Size 230KB
SHA256 b08efe9abf55c95ac43c2b43b0e2f87dca83a8b7aac17dd0f867bc7b4a3ac58d
MD5 472f819c993f72be58db8637647e7462
SHA1 c4ffc0817fd20ea96ed93df1762b962f8a4a0cb2
SHA512 acb7dfbd35a961e95a2a9e3eff83eb0a5fb6260e374c7931a146ca7b0e48cff6509d87987e4a81ccdc61624fe11ad19352d564d2df3077a6c1f8b933ba618833
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T176344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaysq.sys

Path C:\Temp\xvpnifaysq.sys
Size 141KB
SHA256 55e16ea6c9d7c4a77e3083cd68a687fcc726ae6ae07e0ca3afc38362739310e8
MD5 3b714bb9f79530b611c2af4ed38fc109
SHA1 509440ffb7f3f10d87a4e9f8b5631ff378402244
SHA512 da636798b50e241c09b20decebaf67d6816e7070c50e27bb1dca018fbeb701cebcc3607e0aec6799bc05a1c9cda2844fd28c7b3bab0727c0a7e03514dc606486
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T12CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 ea2cdd423c6911b018abda260806642fb206f1205f8a7695051a4614107fee1e
MD5 18264fbd88a6b5d79e60607835490692
SHA1 6c30efb4175d867c0f89b5eeeb76a883b360c9f8
SHA512 8e391b1394021588069708ddb9218fc72679eff42228d97a993066b2266f405c92221e7580cd6b2f2badbe6569f33ffd4e07560d7f79bb62bf034924a1bcbd9e
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T170E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b90cd0da8d03b4343393e04ad0ff4b10e90c8583a5880dcc483627da1db3d861
MD5 dbb623d6302139279367451ed932d84e
SHA1 3cfde6742fa02dc3d4fb3fcf7be0a90bfaf33f06
SHA512 0efc96e573aa107c4a995783acd77dcbc3c81bca23a1c9a55075757f1e794d56bd3250d04353a9e0e9573022456876236ed5c5b28f5ffc5d0729691636019db3
TLSH
T13DF0F9B6C921AC3B08FD1B1970A56746E74013572F41495F3A3DD20C8FB4A3F4646C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0fa5584cd4f830a33a18f2dee5f70832cb0c35c2f68fb9130f4348d2d3e0ae15
MD5 1473c23b419d54697d223d13487c9f85
SHA1 a136e3b8487bd5fce7c877a5568d9ebbf9fb50db
SHA512 f8f5194b1025ee78707dabf487eb8071e18b17ad4eebb7807b02ed170fbc677bd85ecc8a2ed0d96c9f6153f7932162a56a307d744b0a929488a24a68fa50b4f7
TLSH
T1344190F7C2E8856DC94196F0A714BE2FDE2D0914832C3D9A89E4EF1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9d9b454d08f8ef258dd63e3791f6461f78e86f5d90ba2b64c686384b28eb07c2
MD5 d072e64f7f4695f15be930a783873d6e
SHA1 0652550008edbb58e93078936d72aec8a8dd94f9
SHA512 0af4aaa3d2d0586367261655c0608edcd60f8fe468f280cba24f5a80cae86c6c1d03fa1649cb4e5e7ef13686c288e806d3c37dbad673682765ccede3df6ada8e
SSDEEP 192:sxZMR2yMqZjK1Ml8UQQc//fvsPQkJKTG5GN2/wpzodpZK/W6+WNs2efY0hdGeIgg:sxZMPqv//fvsPLJUei2nw/bUf5NmtX
TLSH
T16372F806AA64597BCCD7D219F695BB53D6F8157291804E489AFCDF0C04EAAEC2203C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 934d7cddef42fd6057368aee4272a03d3d622b02e9eda7b99db7d98ea35a57e8
MD5 399c233dc32d2e77d797d02b809bf77e
SHA1 3e05900d527bf44ce7c0fbc229022c834bcbad36
SHA512 53edf9b5aa52e3a120f90d46dfcfa1cb9acf988dc54b423bcb26dcbc741c9b39c98721b02a85faff151dd66d4ca1e19920a5b6d734eded0b9171c8233a0f06bf
SSDEEP 192:sxZMR2yMqZjK1Ml8Mc//fvsUkOKTG5GN2/wpzodpZK/W6+WNs2efY0htGeIgj+bJ:sxZMP0//fvsPOUei2nw/bUf5Zj+t
TLSH
T14362E8066A64597B8CD7D219FA95BB53D6F5157292804E489AFCCE0C04EAAEC2213C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 be6ffca7cd189a80d65a414815528b916b6b89fed1db52fd2252f1d00df706a6
MD5 7a14bbd14c25237b1f9aeb9eadca4e65
SHA1 16d2c079a27c39972daabe1239d9fc0021bc8249
SHA512 e1dad11ef0bc36e86c4655c6ff000b41eb645e2abd227a6786761da3c7f923278e2632c4d0fc8a21ed7b9ba720232657af6d308f97e42edbf942ac0121424ed8
SSDEEP 768:wQAKq8y02yS7pLuLnjbWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Ezx4Llc:wQAKq8y02yqEnjbWRmj1QWTu1jaKEzxf
TLSH
T14D03FA3B6C0CCB7E4FC04E9CED267E8A6DE8028BA698C95447FA444C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 b0eeb3696d325c7276a1974200adb37d36c1a536c3a8d2b9e45d9810b071e950
MD5 162ed46ca717b4cd93102808b01152e2
SHA1 9999fe14eaf22d0e59ae583008f087415d98d402
SHA512 53ec07c38c4799311606e87ac71dd2f86ed48b00712d0e236f9b4a9a78c2bdaeeccac9bd06709ff90a3065be3af609ed8d46a64348a32e707f33697be25bd46e
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F50:GZLVDJjEDPV0/Zd08g
TLSH
T110A2470272BA02023C7D390C93968B675A42F1633459ED7F7BA900B54E67E225EFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7fc150aa2cd92234febe60e25c8e26f19f075cb45b5ae0c421a7a6f1a6f444ff
MD5 e98ae52a16e76a0f9ee6e1dacaeff88f
SHA1 927e07e7781060480ad992fcd02fd82c757f9c5c
SHA512 b9341b98bfda937fced953bc17700f5765caddbd8cab6c0ce8f7e21a9cd95f0ed28ea043e4388e40423d4248f30c7804f66109c24c4a3798f05e782af2c811a9
SSDEEP 384:n6iF9CcmyWCs38Na8TUNTUlIxBPm3ek32nn9BUQus4Jfb8GmrEcgwLFFze4KV8p5:xFccps31wgPKekmMBwGkEc/TzI8p0C
TLSH
T1E8B25B36EC58CABBECEA4FD9F74A6A03DEE01267859C59E4DAD85D0C00971DD130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 690db1844dc3810da68acadbdef5a0543726ade392eae7566cad051694fa79ca
MD5 b573e1153b1268f705dd994fa5c06b39
SHA1 6bcc4591b4da1650f4af8b36c79c4097bdb5e13a
SHA512 934db81a8da64d934cc3cc00e59c8593610d014e5136b149e55132f0a893c621a39677378ff1e209593228a545d9da661509041709b89f1e1171e5f13617c3b6
SSDEEP 768:nFKjZbO3kwggPQKekmZhmGkEc/UcYeun9TJxi:MC3NPokaOU7eun9TJxi
TLSH
T1B4E2C5F598D79977E8EE4B87A37D6E429ABCC15374885994F7C40D0CCC861BFC20A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2c12e3f11c37e339998df6fbfd4dabbde35fdb7b31e486072526476d05941ad1
MD5 2714d3f95ccfc4a2afc25dd6b5143d64
SHA1 68f959bb81f4a9d11ac558cc702d1d56ff38fe8f
SHA512 14a52459de1acb182ff982c1487484c6a061d905f96ee83f2c827757322c6f7aae3892e198304febdb7a2bedccef104699010c4f46e1819e9d11662680301067
SSDEEP 768:OFKjZb53kwggPQKekmAhmGkEc/PYeun9TJxi:3N3NPokTOgeun9TJxi
TLSH
T1C5D23A36DC64DDABEDEB4E9AF74A7783EEE001A3858C59D8D9C85D0D00871DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 80ff659a1de0dac1d126bde36405246362a24c7c68f680827d737bb9231e1440
MD5 c5b3ae68fbb50ba05fb939347f4f148a
SHA1 873528a6c68a4a74e7b983746c44ef88bc46b4e6
SHA512 f13b7ded8370a624e3fef2243a4428e5e6bce867a308aa299c2e7d0968c4bd960106a17bdcc73802383f7b79297d8d1ccd5d1147f21cc8a95afdfaacb3b7cb3a
SSDEEP 384:nEiF9CcmyWCs38NT8TUNTUlIRyPm3ek32nn9WJw4Jfb8GmrEcgwLFF4p+Be4KV8G:fFccps3kwgAKekm8cGkEc/gYI8p0f
TLSH
T166C24A31EC58DABBECEA4F99B74A6643DDE05163858C9DE8DAC85E0C00971DD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 2e81799c6f2867ec3d70b286d605392545b13322c12d5ec2438487a84766b8ab
MD5 29c810dbf27caffda1aa3dabf282838e
SHA1 a589d49c729ff476a107500ff4b941da8f0205d8
SHA512 cd0a1bc3f0076972225b35b335abee3f3107ea2a84419939a14cb8881f600cb3823b9cf2465e24f09b59518d09cad8173e05ce404849864772c2adf21afd14f9
SSDEEP 768:fFVjZbL3kwggPQKekm1hmGkEc/nYeun9TJxi:533NPokSOYeun9TJxi
TLSH
T198D23A36DC64DDABEDEB4E9AF74A7683EEE001A3898C59D8D9C85D0D00871DD130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.6.6.1\typosquatting_list.pb
Size 555KB
SHA256 b95639cf9dc46683acccb9ead8440ae9d6a852a37407cc7cd9c0b309acf7af1a
MD5 fa2f059815f3357487cf7fc8f93e5252
SHA1 d7affd654c8571ba0177750adb5f63ab3443496e
SHA512 729e3443b5da00521d52c60acdc9056b11229d8ce69d47e2a1e1c12cb1784dac58c51f49e5f3423a687aecdcf5ed79697e855a353d5c253756857b7ad186d136
SSDEEP 3072:s04GzK1JtjtczmMtOQvGz1XVK3RqkkGZD9zTiZJil1CN75QG4lsx049WRAOGQxDh:yGKJtjtKRG6qxciXtN7OlsxXU6sVKhfk
TLSH
T1F3C4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 52b9e203bf72f8500937d696cf38faf3abf025e5c7a2ce9379f003be274a41d6
MD5 6791419f1e22b7b698c83d172dc880fa
SHA1 d61a4882aa5e2aa9558a8fd6c48dcc2bc1dfe21a
SHA512 9a29bb9fbc82a7fa362d502ee6bf027c1931469bd643187e5a2c573742a0ee5112fe6f6c6c47b9658a924985a4316a6a7d4655a6296386a752d0c2b61eb7fb26
TLSH
T112514EE05D3C6AD1D4BD0E6FB08B34EC81E8DB26F5A0747D6C58E9984A3964D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0458544dea9a1d5bb37ccd2c8752b974ed7c28f5ae23c1f9bc6d94df09dc65da
MD5 2d0817b2ae034d0a4156ceef2bd85128
SHA1 9db0f4333c8683b6fea3f0367015107c35964e7d
SHA512 5c70618e5e4d040f8d5962241c6e900cc8d1cf365c6e7a7a664f6cef1e9ff6759f06ea576f487ec37ba93a47eff2efb8ab631f96167aa0445e61080cfb28e8f9
TLSH
T190513FE15D3C6AC1D4BD0A7EB08B34FC81E8CB26F590747D6C58EA984A79A4D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 631f942584ebd5bfe107f075061c3560379b2ebe91f32cdeebe2c3960cab1cc6
MD5 17b8f5894dfb4f17684816456c161409
SHA1 78a6084a7975b210a24a307395abb70315a5167f
SHA512 c7653ed750afb0ebe069f734287b6da6c863e60ff1358d138749badcf12eb7119a65578003dadb6493fbe49c6fed6df1cc69a029d836ae29a192be8b6662bdbc
TLSH
T19D513EE10D3C6AC1D4BD0A7FB08B34FC91D8CB2AF594347A6C58EA984679A5D248183F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

edge_checkout_page_validator.js

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\edge_checkout_page_validator.js
Size 1009KB
SHA256 a4dfd6a3adecc01debbd3ece3d700d10b5802cc1c7b54c7e08b04d4ad62e4cf9
MD5 afc838115db31a9856dfa9b4c7c7c5fa
SHA1 9d4383ee8600346afca5c9fde4dd7b7779f59b0a
SHA512 6ee89e0f22f9aff074598b35b44f23b252ffe9eb6ef306e74ad0669cb6ca2bfd97492c4dae4a8b48d6860f42480d77b5cff1513f9b4ad36fc8e2edaf36b824a1
SSDEEP 24576:cs4ymRAbsvvG3kJ6ARjiQixwaErn9OUfWEo0EQ1Xp8C9T0dK/vzHEiJsfaG81E9/:cs4ymRAgvvG3kJ6ARjiQixwaErn9OUfq
TLSH
T18E252B84E1E2253466D74CB960B7D2C4B5DC04583399F1E8FA6C68CADB0F94723F663A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1047235078\manifest.json
Size 146B
SHA256 111f63d9ee7042599d375bc997c0283a18fb0324f61b38c1bf00e193a62260d6
MD5 c74281305ace78892111149b1b11a6e2
SHA1 5c753fadde54afdd9a6eb6e8d33497b037d7ac21
SHA512 d74a5ea1aa973adcd634734ad5d9d671b5fd22a5999f6103e032987bcfc8a53c6a05ea9bdb7ffeebe9c0ed11dd47ee08fb61ef21dca46a299698b284131c5982
TLSH
T10DC09B73C931AC71557507D449F59745EB74578BF511B0563730018D0B3D57550606D1
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1592373981\data.txt
Size 146KB
SHA256 ca6b9158b966a4245500d5ba10ea6e123b65f82a4cac4e207cdc21a96406114b
MD5 e28f6cc38e9dfcbb14a5d49174b0e6e5
SHA1 e2f3ee57ee5d91232ac5d1b934c865d8a2a2676b
SHA512 3dd75928b8f59a28fa4ddad1aa08e261318ec4e35a9db9af28b3a5ce09097128088dbfc8946b35d80ce293cdc431a9c27b6ffa8e2dd166ed48f4beb7a9892fd8
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEFq5IDI45/y:4X1aI5aZoKzMJ07NcQI456
TLSH
T1E2E3F115CEC41FDDDEA8261850BE0F1E53D0835E442B6AC9E763BD497F9BA04863B1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1592373981\manifest.json
Size 53B
SHA256 76daf0ebbaf97179fc4ab99dd6cace2b80ede8e39dd50c153e97e6649f6f5773
MD5 58aa82c06223ecd1156ff2fb420bd991
SHA1 8c8b8bb475ab624cf0a2fa4eb88f7053e0992423
SHA512 4e96250fa556ab86538518843cd0455f9df2af58174219b17cc7d64871d5305e011896b454406492b5c5eef6e905e7967fe68c612ae16ab91a47d4fa71081f54
TLSH
T1389002704424951716C20E5065B0B8819391661995854D1E0445155D039546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_2120149439\manifest.json
Size 117B
SHA256 0f38d58679ba75ccf1b80144c998549e09e08e8fce7e1c6ecf35142ef004131f
MD5 5836d59405b134944c3f2b02fb148539
SHA1 c577f1816960edd81a8fb469bc1ceb4e05bd0c55
SHA512 cb8c568105000d84c46aaadb4ab34c5a3747c9e588707dd4f3a5dc24ee3458983aec3e1ffca1a108ae47408daa6c96a0625dcc6e4a6970c8114f62eed82f20cf
TLSH
T1B3B092B00C0AA03B22849320EDA06A8283F80218E8021B1E088036481F8917880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/840-763-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/892-239-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1292-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1508-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-635-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2436-206-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3248-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3272-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3348-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3884-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4396-171-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4956-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5080-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5568-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5748-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5844-767-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download