systex | 27e99b717fc45d597c4c6f9e791f7e7ddf82805202a8426e92c9e4f9154d5d15

Analysis

max time kernel
148s
max time network
143s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260423-tkga5ahs9p
SHA256 27e99b717fc45d597c4c6f9e791f7e7ddf82805202a8426e92c9e4f9154d5d15
MD5 2bd936b766a1db146509a10eafdead9c
SHA1 fb09401c808b9a27bc73aaef054d1546efe0e039
SHA512 cedf76d7e0ff211158b203f6e5f6eb3d839e741a627674072deee3684bbb0e14b38341299d3423560f6be64e52379b2adcb8013887e51062835663fc32a959b4
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T121344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3252	CP.exe
588	usmkecwupm.exe
968	CP.exe
4768	CP.exe
4024	i_usmkecwupm.exe
2488	cwrojhbzur.sys
2336	CP.exe
4828	ecwuomgezw.exe
4876	CP.exe
2448	CP.exe
1132	i_ecwuomgezw.exe
5556	bwtomgeywq.sys
5416	CP.exe
5356	rljeywqoby.exe
4244	CP.exe
3084	CP.exe
2076	i_rljeywqoby.exe
5360	geywqljdbv.sys
6068	CP.exe
2604	lgaytqljdb.exe
5488	CP.exe
4012	CP.exe
2032	i_lgaytqljdb.exe
5552	bvtnlgdyvq.sys
4412	CP.exe
4852	oigaysqlid.exe
5324	CP.exe
232	CP.exe
4016	i_oigaysqlid.exe
2664	vqnifaysqk.sys
3844	CP.exe
2056	kicavpnifa.exe
1804	CP.exe
3212	CP.exe
5372	i_kicavpnifa.exe
2428	nlfdxvpnif.sys
4360	CP.exe
4832	spkicausnk.exe
4912	CP.exe
3672	CP.exe
5812	i_spkicausnk.exe
5628	spkifausmk.sys
5684	CP.exe
5888	ecxupnhfzx.exe
2372	CP.exe
6012	CP.exe
5236	i_ecxupnhfzx.exe
6100	zusmkecwup.sys
1616	CP.exe
5968	mhbzusjhfz.exe
5016	CP.exe
2480	CP.exe
2356	i_mhbzusjhfz.exe
3548	wrmjebwuom.sys
5332	CP.exe
4396	jebwtomgey.exe
1904	CP.exe
3008	CP.exe
5536	i_jebwtomgey.exe
4584	jecwuomgez.sys
3692	CP.exe
3728	ljdbwtomge.exe
2172	CP.exe
3740	CP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_17812645\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_17812645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\v1FieldTypes.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_17812645\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_17812645\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\LICENSE	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywqoby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzusjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywqoby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzusjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavpnifa.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1452	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4388	ipconfig.exe
4796	ipconfig.exe
5176	ipconfig.exe
3764	ipconfig.exe
5192	ipconfig.exe
1508	ipconfig.exe
1780	ipconfig.exe
1752	ipconfig.exe
408	ipconfig.exe
5936	ipconfig.exe
1192	ipconfig.exe
4540	ipconfig.exe
5372	ipconfig.exe
5584	ipconfig.exe
428	ipconfig.exe
5996	ipconfig.exe
5400	ipconfig.exe
3256	ipconfig.exe
1148	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31249342"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1484087435"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214481814220334"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{91781E85-40AB-40BC-989E-3DC350A8ACB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe
588	usmkecwupm.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	i_usmkecwupm.exe
Token: SeDebugPrivilege	1132	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2076	i_rljeywqoby.exe
Token: SeDebugPrivilege	2032	i_lgaytqljdb.exe
Token: SeDebugPrivilege	4016	i_oigaysqlid.exe
Token: SeDebugPrivilege	5372	i_kicavpnifa.exe
Token: SeDebugPrivilege	5812	i_spkicausnk.exe
Token: SeDebugPrivilege	5236	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	2356	i_mhbzusjhfz.exe
Token: SeDebugPrivilege	5536	i_jebwtomgey.exe
Token: SeDebugPrivilege	2148	i_ljdbwtomge.exe
Token: SeDebugPrivilege	5672	i_ywqojdbwto.exe
Token: SeDebugPrivilege	2948	i_lgaysqlidb.exe
Token: SeDebugPrivilege	4700	i_qkicaysqki.exe
Token: SeDebugPrivilege	2060	i_vpkicausnk.exe
Token: SeDebugPrivilege	5932	i_hcausmcxrp.exe
Token: SeDebugPrivilege	5672	i_khczusmkec.exe
Token: SeDebugPrivilege	5388	i_pjhbztrmjh.exe
Token: SeDebugPrivilege	884	i_wrojgbztrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 2964	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 5988 wrote to memory of 5888	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 2964 wrote to memory of 740	2964	iexplore.exe	81
PID 740 wrote to memory of 4484	740	msedge.exe	82
PID 740 wrote to memory of 1452	740	msedge.exe	84
PID 740 wrote to memory of 5632	740	msedge.exe	83
PID 740 wrote to memory of 5632	740	msedge.exe	83
PID 740 wrote to memory of 5632	740	msedge.exe	83
PID 740 wrote to memory of 5328	740	msedge.exe	85
PID 740 wrote to memory of 5328	740	msedge.exe	85
PID 740 wrote to memory of 2460	740	msedge.exe	87
PID 740 wrote to memory of 1128	740	msedge.exe	88
PID 740 wrote to memory of 2460	740	msedge.exe	87
PID 740 wrote to memory of 2460	740	msedge.exe	87
PID 740 wrote to memory of 1128	740	msedge.exe	88
PID 740 wrote to memory of 1128	740	msedge.exe	88
PID 740 wrote to memory of 5148	740	msedge.exe	90
PID 740 wrote to memory of 5148	740	msedge.exe	90
PID 740 wrote to memory of 5148	740	msedge.exe	90
PID 740 wrote to memory of 4380	740	msedge.exe	91
PID 740 wrote to memory of 4380	740	msedge.exe	91
PID 740 wrote to memory of 4380	740	msedge.exe	91
PID 740 wrote to memory of 660	740	msedge.exe	93
PID 5988 wrote to memory of 3252	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	94
PID 740 wrote to memory of 3392	740	msedge.exe	96
PID 740 wrote to memory of 5592	740	msedge.exe	97
PID 740 wrote to memory of 5072	740	msedge.exe	98
PID 740 wrote to memory of 3392	740	msedge.exe	96
PID 740 wrote to memory of 5592	740	msedge.exe	97
PID 5072 wrote to memory of 5552	5072	msedge.exe	100
PID 588 wrote to memory of 968	588	usmkecwupm.exe	101
PID 5988 wrote to memory of 4768	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 740 wrote to memory of 5412	740	msedge.exe	108
PID 740 wrote to memory of 5412	740	msedge.exe	108
PID 740 wrote to memory of 5412	740	msedge.exe	108
PID 5988 wrote to memory of 2336	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4828 wrote to memory of 4876	4828	ecwuomgezw.exe	113
PID 5988 wrote to memory of 2448	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5988 wrote to memory of 5416	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5356 wrote to memory of 4244	5356	rljeywqoby.exe	122
PID 5988 wrote to memory of 3084	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 5988 wrote to memory of 6068	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2604 wrote to memory of 5488	2604	lgaytqljdb.exe	131
PID 5988 wrote to memory of 4012	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 740 wrote to memory of 3124	740	msedge.exe	136
PID 740 wrote to memory of 4160	740	msedge.exe	137
PID 740 wrote to memory of 4756	740	msedge.exe	138
PID 5988 wrote to memory of 4412	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4852 wrote to memory of 5324	4852	oigaysqlid.exe	143
PID 5988 wrote to memory of 232	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 740 wrote to memory of 5292	740	msedge.exe	148
PID 740 wrote to memory of 5292	740	msedge.exe	148
PID 740 wrote to memory of 5292	740	msedge.exe	148
PID 5988 wrote to memory of 3844	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 2056 wrote to memory of 1804	2056	kicavpnifa.exe	153
PID 5988 wrote to memory of 3212	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 5988 wrote to memory of 4360	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5988 wrote to memory of 3672	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 5988 wrote to memory of 5684	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 5888 wrote to memory of 2372	5888	ecxupnhfzx.exe	171
PID 5988 wrote to memory of 6012	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 740 wrote to memory of 5956	740	msedge.exe	176
PID 740 wrote to memory of 5956	740	msedge.exe	176
PID 5988 wrote to memory of 1616	5988	2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2bd936b766a1db146509a10eafdead9c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x314,0x7ffec6a7c188,0x7ffec6a7c194,0x7ffec6a7c1a0
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,10179375879491873644,9717450865512208412,262144 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4841361319434528068,11262436767298114359,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
      4⤵
      System Time Discovery
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,2413061629249916951,17110716683809911031,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11842685638905410326,7390507481942501353,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,14589563220291849495,3574159704655955200,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2464,i,13230133497333466939,11356923269571723585,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3576,i,17639930644435329335,15691793013373289401,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4023890436366883264,12785614492881036395,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,4023890436366883264,12785614492881036395,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,10714737430331197268,114843874303581396,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,13861159007113102813,15547850558993112837,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:14
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,9551412259703720137,5819626936984162686,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6240,i,16563721898556099547,14427328118102555385,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,18207842403712525746,1624582141106551970,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,18420092719566307805,5005851941153112286,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,14741606301746040645,17279356870166849057,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5760,i,15205151570967990910,10174519285755261289,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,1827303900353576871,5108606418904093963,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2868,i,7016976963452521456,3505102619069041640,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5104,i,6812564650109811585,6315898606455013722,2097152 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,9207665912662074892,9995436936037941809,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5052,i,195148035045792699,9836219372204774347,262144 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:10
      4⤵
      PID:1152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,11912970955968194950,1696068370905154234,524288 --field-trial-handle=2412,i,11671903182306334096,1948614541992241668,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:728
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecwupm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3252
- - C:\Temp\usmkecwupm.exe
    C:\Temp\usmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecwupm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_usmkecwupm.exe
    C:\Temp\i_usmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2336
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2448
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljeywqoby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5416
- - C:\Temp\rljeywqoby.exe
    C:\Temp\rljeywqoby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljeywqoby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3084
- - C:\Temp\i_rljeywqoby.exe
    C:\Temp\i_rljeywqoby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6068
- - C:\Temp\lgaytqljdb.exe
    C:\Temp\lgaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4012
- - C:\Temp\i_lgaytqljdb.exe
    C:\Temp\i_lgaytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4412
- - C:\Temp\oigaysqlid.exe
    C:\Temp\oigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:232
- - C:\Temp\i_oigaysqlid.exe
    C:\Temp\i_oigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Temp\kicavpnifa.exe
    C:\Temp\kicavpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\i_kicavpnifa.exe
    C:\Temp\i_kicavpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\spkicausnk.exe
    C:\Temp\spkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3672
- - C:\Temp\i_spkicausnk.exe
    C:\Temp\i_spkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5684
- - C:\Temp\ecxupnhfzx.exe
    C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6012
- - C:\Temp\i_ecxupnhfzx.exe
    C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzusjhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\mhbzusjhfz.exe
    C:\Temp\mhbzusjhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzusjhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2480
- - C:\Temp\i_mhbzusjhfz.exe
    C:\Temp\i_mhbzusjhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5332
- - C:\Temp\jebwtomgey.exe
    C:\Temp\jebwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\i_jebwtomgey.exe
    C:\Temp\i_jebwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\ljdbwtomge.exe
    C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3740
- - C:\Temp\i_ljdbwtomge.exe
    C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojdbwto.exe ups_run
  2⤵
  PID:2044
- - C:\Temp\ywqojdbwto.exe
    C:\Temp\ywqojdbwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojdbwto.exe ups_ins
  2⤵
  PID:6128
- - C:\Temp\i_ywqojdbwto.exe
    C:\Temp\i_ywqojdbwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaysqlidb.exe ups_run
  2⤵
  PID:5400
- - C:\Temp\lgaysqlidb.exe
    C:\Temp\lgaysqlidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaysqlidb.exe ups_ins
  2⤵
  PID:4188
- - C:\Temp\i_lgaysqlidb.exe
    C:\Temp\i_lgaysqlidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicaysqki.exe ups_run
  2⤵
  PID:5852
- - C:\Temp\qkicaysqki.exe
    C:\Temp\qkicaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicaysqki.exe ups_ins
  2⤵
  PID:4932
- - C:\Temp\i_qkicaysqki.exe
    C:\Temp\i_qkicaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpkicausnk.exe ups_run
  2⤵
  PID:3388
- - C:\Temp\vpkicausnk.exe
    C:\Temp\vpkicausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpkicausnk.exe ups_ins
  2⤵
  PID:3312
- - C:\Temp\i_vpkicausnk.exe
    C:\Temp\i_vpkicausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmcxrp.exe ups_run
  2⤵
  PID:2248
- - C:\Temp\hcausmcxrp.exe
    C:\Temp\hcausmcxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmcxrp.exe ups_ins
  2⤵
  PID:1732
- - C:\Temp\i_hcausmcxrp.exe
    C:\Temp\i_hcausmcxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khczusmkec.exe ups_run
  2⤵
  PID:5240
- - C:\Temp\khczusmkec.exe
    C:\Temp\khczusmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khczusmkec.exe ups_ins
  2⤵
  PID:4956
- - C:\Temp\i_khczusmkec.exe
    C:\Temp\i_khczusmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmjh.exe ups_run
  2⤵
  PID:3044
- - C:\Temp\pjhbztrmjh.exe
    C:\Temp\pjhbztrmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmjh.exe ups_ins
  2⤵
  PID:4508
- - C:\Temp\i_pjhbztrmjh.exe
    C:\Temp\i_pjhbztrmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrl.exe ups_run
  2⤵
  PID:3148
- - C:\Temp\wrojgbztrl.exe
    C:\Temp\wrojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrl.exe ups_ins
  2⤵
  PID:2212
- - C:\Temp\i_wrojgbztrl.exe
    C:\Temp\i_wrojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4172

C:\Temp\cwrojhbzur.sys
C:\Temp\cwrojhbzur.sys
1⤵
- Executes dropped EXE
PID:2488

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
- Executes dropped EXE
PID:5556

C:\Temp\geywqljdbv.sys
C:\Temp\geywqljdbv.sys
1⤵
- Executes dropped EXE
PID:5360

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Temp\vqnifaysqk.sys
C:\Temp\vqnifaysqk.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\nlfdxvpnif.sys
C:\Temp\nlfdxvpnif.sys
1⤵
- Executes dropped EXE
PID:2428

C:\Temp\spkifausmk.sys
C:\Temp\spkifausmk.sys
1⤵
- Executes dropped EXE
PID:5628

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
- Executes dropped EXE
PID:6100

C:\Temp\wrmjebwuom.sys
C:\Temp\wrmjebwuom.sys
1⤵
- Executes dropped EXE
PID:3548

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\ojdbvtolgb.sys
C:\Temp\ojdbvtolgb.sys
1⤵
PID:5860

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
PID:4184

C:\Temp\aysqkigays.sys
C:\Temp\aysqkigays.sys
1⤵
PID:4760

C:\Temp\qlfdxvpnif.sys
C:\Temp\qlfdxvpnif.sys
1⤵
PID:4144

C:\Temp\usnkfaxspk.sys
C:\Temp\usnkfaxspk.sys
1⤵
PID:1340

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
PID:3440

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
PID:2296

C:\Temp\gebwrojdbw.sys
C:\Temp\gebwrojdbw.sys
1⤵
PID:1656

C:\Temp\rljdbwtolg.sys
C:\Temp\rljdbwtolg.sys
1⤵
PID:3828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdyvq.sys

Path C:\Temp\bvtnlgdyvq.sys
Size 141KB
SHA256 e96235cb4c70d8b6de8855b7579c0b19774fa99af0220b6b50c622de24263f60
MD5 095ec92dd9a81ca14d260b720d342421
SHA1 5692eb13cbd85d91efd2eff0b50c8cf855650587
SHA512 1183f07fd990d532d7d5f0f4961f7bd2934553a095ee1f01fea906d4499a8cfbedab0730caa5efb58b4476b53637f58a6d3889fd303b1218a3004fc0ae0cc441
SSDEEP 3072:JsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:JsQmpcF8BzXfwV
TLSH
T1BFE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywq.sys

Path C:\Temp\bwtomgeywq.sys
Size 141KB
SHA256 754a0b2285fa318139e8a286f0233af73a0527616a16978b46b537877855c1ef
MD5 9c4d82f9caaad781949480c8e272483f
SHA1 00b9ac83bf63b08bf626bc9126df8aa7fe901906
SHA512 84cf018f02095a9ac9f70e2353fe9d6fb25d032f1b71ad3025a93ef48c6ebf957fd05be2948757eea7f7f4078c6864d40be15335e55f9737a836a0bffc0a10c5
SSDEEP 3072:xsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:xsQmpcF8BzXfwV
TLSH
T1AAE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwrojhbzur.sys

Path C:\Temp\cwrojhbzur.sys
Size 141KB
SHA256 3415f7b83f4bd7fe01536089c32c02cc5ad5e3f4ab3a24db188f4cffaf0de50a
MD5 492e76f60ca19dcda0a87c5f47e244b0
SHA1 c3d84ba5382025617326e293b93777068564bd54
SHA512 c254c5cf97628ba774b474e3b117ecd0b52831e9b0c34ac064c29c14a8ddf572baa6537eb2dd89bf649e5e6f4947892e439a72f8614ce556c935cb12455bbec0
SSDEEP 3072:EsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:EsQmpcF8BzXfwV
TLSH
T182E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.exe

Path C:\Temp\ecwuomgezw.exe
Size 230KB
SHA256 05d962af58619764f7db929df17729e59a6cb67a71e0eedcfaf285e26456623c
MD5 194d9a19ef4e828e358beefd5bb30ca0
SHA1 d6d1b53b0c9f9a75a7116cbf5bf2cbb068ab1911
SHA512 feb8259d784f615c1aa476ec4a5eb2a6d5b6781f53b796932730ea1e45e62d0c995e31e4760526f12ae97cfdb49c190887470bc7af4b6d74a57e1a40d55043a0
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqljdbv.sys

Path C:\Temp\geywqljdbv.sys
Size 141KB
SHA256 1819722bce9838a82ba1d6f7fa4524571da7b8eaeee6b65b16cbed1f0fc3e1cc
MD5 3dd462d34910d3b03e81ef0e2eab37cc
SHA1 a8bec97aa55a510ae2cb0402e635b2ceee0fbb42
SHA512 cbd149d93e2ea5d9d44ce51c84d8d3bac8d0ec1a00b2c1c3760b2923023f5f3874872b0e01eaf082a6ff9895e3390442ce49f37d611ccadde8ba215b86c13ed4
SSDEEP 3072:JsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:JsQmpcF8BzXfwV
TLSH
T1A6E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgezw.exe

Path C:\Temp\i_ecwuomgezw.exe
Size 230KB
SHA256 1f0143e2578ae695fa84cbf55635942059de5eac420b0d6660382f8d544126a1
MD5 105a15caf3170d8a687cb9a501a12cad
SHA1 7d2546871f716ea8edd07453dd1c2e7fe8dbf111
SHA512 8dd690ae3527c09ef8ed00a46758ce91ccffdcdc423b5a0f0a8f6c476308980c2cff732d9ad2595fa8ffd6c6a333756c10f09483e2d6f499d192ba622eb840fb
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T105344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicavpnifa.exe

Path C:\Temp\i_kicavpnifa.exe
Size 230KB
SHA256 1592e926faf109e070d8c6525d11891e6a450213f4464baea4a0ddeb8ba2a4bb
MD5 5cb7a631a7e6a0b975918ebc78d5036a
SHA1 e014ed325d4fd74ac69366f7634590e28dc7c7a9
SHA512 105e0a5072748f1533e7a3906d3b3de07c6fcc7d68b2e2dcd217a83d3bd6f1ba249de1de60404af9535208682c2c076502c7f4c8aaa8279e2d0d47aec2cbb80c
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T129344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgaytqljdb.exe

Path C:\Temp\i_lgaytqljdb.exe
Size 230KB
SHA256 ef0841f567da424acaf27641d7a8937054edfc22dee7eb78383ccb3913bec064
MD5 e080a865b7d0a5c2b9c1b8a40ce8539d
SHA1 eb3b27479b24e85bc5bec9f0e2a02c516037ce49
SHA512 95ba8b522164abe4c85d5c3bd500140293b83d1d3024d2c1a5b5b10e626a0781c822918b3d200452df4012a9db5900526450e32a6d9f606f62f9be1ce0307a3f
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T151344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigaysqlid.exe

Path C:\Temp\i_oigaysqlid.exe
Size 230KB
SHA256 f3307785ace6a04f2fc1ee01d4ac5d01fd1cc3b4be151a940cb5b00488545701
MD5 c9ceccc2eeae9e9fe6dd75d95ceafc21
SHA1 bd442d7e4068e6d38f01f56a2b42980665c48b7b
SHA512 331f9f78e9738f7713c869070d51f43d256d30d338767f7cd2af4d9d872aa96300e2c4ffea69ecb5df0c8f01fd7907b39d024efdb226820ac944db18de15dd1a
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T162344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljeywqoby.exe

Path C:\Temp\i_rljeywqoby.exe
Size 230KB
SHA256 09a9dee84bd77e1dee8ca6e8effd2d3e89f2f927e3a2978c24bd11c6ded1451a
MD5 fa9303788b467b5054239909447de210
SHA1 554f2570575a7204fb545a6d3d2380c5069b46f2
SHA512 8306b1ac9776545910f91e8a9f16374ab29071a26e29ed8275ea2e155f245413addc5aab8881b0ed871f16c13100630111a2d4773432aac6dd6e5b2238fea23d
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkecwupm.exe

Path C:\Temp\i_usmkecwupm.exe
Size 230KB
SHA256 be77f94036b5e10b65a374809804f1e6189f2b4f921dda2e779d433866542a5b
MD5 871cedd817d5533a8915251a3c4c649a
SHA1 99d45fc887f02d9f1175db25c230f336a4aa7ac1
SHA512 a3d0bc2bd540a5bc0f53918bb33e09f1bea31198779e00163c6c3894e95ba930ab51b7d59c632acb85a51f14042a5f00c650eae61dd9f0d168278708250b38ea
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T104344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicavpnifa.exe

Path C:\Temp\kicavpnifa.exe
Size 230KB
SHA256 19ccbe9e55bd599a5bee483c47e0376bd0d7e559fa8831b449cf0c1382751e27
MD5 c399aba76f3ccdb6908afb5fc7a7597a
SHA1 c613c1ac48cfea116062fee5472fd7189105b18b
SHA512 2e1522ed883892b4ab6384e6cec07a309833523b013a30d4db1d8b55ed6caea093fa7097f91e66a776e1e4c6d03fc8b9f1f5f8135737fc640274928b3a5183d7
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaytqljdb.exe

Path C:\Temp\lgaytqljdb.exe
Size 230KB
SHA256 540f530ff20d505ef53ea3e6e3b2afde400611e667841358f0a71c594f616a89
MD5 f76454412f7829c07c473f9333ce1612
SHA1 67f451701e280e6d99ecc02bcf6679ece9459b9a
SHA512 194c7377a3e4cec0ab499b5b7f406335e5e96af87ce066d70f6a4ff96469ca3c58a5c7f8f0c47342e004c0d80cdf16978c8bae646a65452e643032b67538ebae
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T123344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqlid.exe

Path C:\Temp\oigaysqlid.exe
Size 230KB
SHA256 b56006131820f4ca37f3bded5c8614a5fc642ec30c9718d695a772e001724066
MD5 8c3d45c3426a75be2fec660b3d943bef
SHA1 c3d18de7c7cc1459784816fa5c09300e7765afc2
SHA512 2c861b3eca17746c3e27569f689e0601bf33c779089d4d9eaa2a2778e5bd89996f064aadf7f22b8b2e71e30b08b9dfa788c30fb341d9b05ba59ad7fc9abbee5c
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljeywqoby.exe

Path C:\Temp\rljeywqoby.exe
Size 230KB
SHA256 3f38f8c4a1adf54b531b4c9aa8d3fd4dbce7e04bc865357e0316f12162fe4e6c
MD5 ced300431b8315312a1208c69c7b082a
SHA1 f6abed58d600d1b5a5157cf69de3838131fcf20b
SHA512 a428626002aea05ef3a697aa532ae4f416455eef97921a55b3b0859abc2f533714bb1de3ae99496e3aa18e3bdea4b6644d832bd6fb80ea5d8654e6a0b080ea96
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupm.exe

Path C:\Temp\usmkecwupm.exe
Size 230KB
SHA256 2160860537abce00d42adf490094cae30ddfb6e7a45dde767ed2acdc45d2d69c
MD5 9a549661893f6349d2b7bf41a801d5ac
SHA1 c0fbc5c44d7b968c6e61e8e54ea9dc064c27632f
SHA512 2e1191098781c6e3b50fe8cd3a853ec8600df36ae3bc48483656c725981e8c8b0eecee163a56527cc5920d0f4a29dd04b4841e6c1679c37f79765ecd127ec9e9
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T164344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifaysqk.sys

Path C:\Temp\vqnifaysqk.sys
Size 141KB
SHA256 789a2cf476ccb0ab0cc983a7c9c978afbbbaa716edefccf80f3cf3aac651e68d
MD5 1e39d0bee6cc8ce85d170bc458940686
SHA1 9f12d062a25367bad190b9d482481299e725aef1
SHA512 13239b26c62cba101774f917f26ded9a8820d257dcce62ef5164b744c04459eb589b665e2e592cf8c5b2ae82c3efaf0c2da9820076e3fe63a9514f09015ed006
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T1B0E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1a1c20b3f9bc221c12a871bd404c5678054bb7c5a6a69166588280c2d5607681
MD5 2a81837326b04c1375748bb9769ce8e3
SHA1 3957e1068c456e3292e042f2b53b647e95893b69
SHA512 4db72fb94ae92a30c696206bef99d4183fff3fa5f4a7286d17e24218ac1454454973632abbc84450ef02f86aef1e435149d03d03c8fcd10fc45df6b872cd6986
TLSH
T15FE022EAC862DD2B08FD572960514A47EA11132B6F51A65F3B3C820D8FF0B3B06858AC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4bb95b8e71036edf3859d3ab77bc41d710c9f0fae6a52f2964e641494be113c2
MD5 fae54cb0b598a114b05d6fe4242d0ee4
SHA1 a30a08fcb00edf9774483a3a3430474ae2e22179
SHA512 beaedb54f80000802e0f69db0a569567b5c2e59a7667cf100d3583f6b8105faebf2c5a62a01ca58b69ff16aaa29776d5eac85a3240dacd48bfd5715c7ff9c808
TLSH
T1D941EDF383E4856E8A0195F0AA187E2BCE1C0910432C7D9AC9E4AF1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6541162674fa94a5f10e9020b586e4daf2d9fa6573554612990787b0826be4f9
MD5 4ca1b740032ca9872a54fcf850e156c1
SHA1 957d0666b7ac11067a5351a9331c81323356dfa9
SHA512 06e844a37f7a3b9b6d934bf1720d814dcbae3ac84eb21842b23ce47d497a7c5e70b7e91b5ea609d2b1edbe54c66dcac48aab1ff8fb26352935815d3e2e5a83e6
SSDEEP 192:sxZ10+RuAyMqZ/K1Ml8Mc+h/fees+l1UtQ2GIo2tzpIIDP1D3HzodpZV/W6+WNsv:sxZ/u0+/fbsy1UO2xtLqP/br/5wHktu
TLSH
T18072F90A6A348E778CD7D219FA45BF53D6F9116392904E44AAFCCB0C04E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0d11d0f6c0791bfc7483167dfdd5601df237e6e2bffa631aa09878b9e97c0165
MD5 436943f432180dbb17202cbc53b34d51
SHA1 d3a8f40e813b4f6e664796110c3734aaca6673aa
SHA512 d9f5bdd593553d9a425c35ec8c23ccaab940ecf6e82d39bd7f6a4bac3200f5d833bfbf7a378305ba247f4c5c785fe8273d4f23e92d07ee8e83f74165f77e12ac
SSDEEP 192:sxZ10+RuAyMqZ/K1Ml8UQhc+h/fees+l1UtQ2GIo2tzpIIDP1D3HzodpZV/W6+WO:sxZ/uq2+/fbsy1UO2xtLqP/br/5wHktu
TLSH
T18E72F91A6A348E778CD7D219FA45BF93D2F9146392904E44A9FCCF0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 acecff397d8e56c836ab713731fd6cf74fd1192a832fd7380fa6e38f3cc492df
MD5 95e8c4f2c4f48e8b99770cbf64768349
SHA1 7ecd9c25ff56f1099fd1367af483f2a7e4e3e59f
SHA512 0a0761d2189fdac1fd92639423966a96a3922f3d15437b80d38fb21dfda5db8a09f93f2310401c0ed8581f2f948fe282b1e960e8b233231d6916d6d12f4f3fe4
SSDEEP 192:sxZ10+RuAyMqZ/K1Ml8Mc+h/feesE1AtQ2GIo2tzpIIDP1D3HzodpZ1e/W6+WNGu:sxZ/20+/fbsE1AO2xtLqq/bG5wLj3
TLSH
T17262FB066A388D77CCD7D619FA45BF53D6F9156392904E44AAFCCA0C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 9da504174c10fab57f5d97a8770128ce7ae55a76f126d08d8e22381186c81f77
MD5 bb77364636524a652d03d1091cd58a3b
SHA1 0aa923aa0feb552fcc95360065cabd9ff6c29547
SHA512 769256cb6642dd5178e13cf1eec3f7020faa016cd04f391b8b26476374c0acec0162a14290f8fb234ab821904e90f5617d112a361cff7d8531954200f042199f
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3xDwvLlO:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKxDwE
TLSH
T107030C3B680CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 6c91fa184ae8dbe501fd875112547daf306625a14a5ea023c514fba4ca2cd2b5
MD5 b0fa03fa4edb820b2eac7c853e623679
SHA1 b9d65b6cdc03c66577f80848d2abd50d13cf396b
SHA512 ff9db3ab9e8eb5cb0ee48ed0d00101c1f69b0ef4702084bb8e761453553fc32b0e6b8172fcfe9a8ca0395421826b8fb1fb2b8b7ea27accc14e2da08bbc93e299
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa20c:ardVTNBbfw8nM9fgzNJ9dvz9dTPO
TLSH
T1EDB23911353B13C13ABE259A81A1B5AF56C230633118E53B7BF850AA4F67E24DDFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bce8073b3eba62d1836978f978c58cc6f2ca49a28e488d7ca13c6c5a67639ba5
MD5 91f140e87ea361a8b61f6390b2c3c009
SHA1 b7a232d8903cd22cbe5467e803347fd1b2977351
SHA512 e9a42ac866ee899e028f63eb38baa34dbcc9e271552df5e8454ba626635cff2b726d774097ee98149cc2e54807011b60ed403bf6780b8daae82b4ad49b6bffec
SSDEEP 384:nNiFJjccCs+Bt0S3x38NX8TUNTUlIRYuvHrpHlBrfRKDhGAtTBbRQryaYKPpctqy:EFJccQR3EwglHVKDhGCBVeyaRBFyp
TLSH
T13CD25B35E8A5CDB7BCEA8ED5B35A3643EEE00163898C9AD4D9C85E1C009B1CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cd3c66dfcb92c69669adfe2618040bacb89619c664906a05ff55ca8919c6a7ea
MD5 289d22382a815085bdcf96766f547dcc
SHA1 23ee8dff37a202fafc0decb749cffd9d8dc3afbd
SHA512 347e35a8f6ceeb6f58638fac0ff1272626eb9209c548f2495543dc70d4aacfc147941a32b59fbbde0d1c93b1f4fda97410c7ab392769fd26a6b43be192d8eb39
SSDEEP 384:nMiFavqMg38No8TUNTUlIxBvHTPv8GBrfRKDhGAtTmQdnS4mtmo+KrNlk+5vI+W:3Fayv3HwgTv8+KDhGCmQdS4smrqq
TLSH
T16AC24C35EC68DEABEDEA8F96A7497A07EEE00157D99C4AC4CAD81D1D00DB1DD130B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f7da060fd2ed5f52744d8b9a0d8d4cfe36e6a5e2e2c706750e53d1d11694bc03
MD5 5136943a50e5f8e459b9dc75a82f8f03
SHA1 34b114b883d01f02f1670cea06737c3ab59fb411
SHA512 fff74801886e4dab581880f51c7104a255b8224352cafccb636bc101e43e26f708c48425bd10307816574f5b9c0eb2ecfeaa8b6588af5f489a26659f435353a1
SSDEEP 384:nRiFavqMg38NL8TUNTUlIxBvH/r8GBrfRKDhGAtTBbRQrfYKdnS4mtmo+KrNlk+Q:4Fayv3UwgL8+KDhGCBVefRdS4smrqq
TLSH
T12DC25B75E868CEABACEB8ED5A7497A07EEE00167D98C4AC4C6C85D0D00DB2DD170F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bb6a7a5d49b38ed9035b5fb79b7af90ef2b055d85883239a1898bcb367e3609f
MD5 98dfc991cccefcd863cb547fb8aa88d0
SHA1 185b511d677ab219425941b526532dcbbf4871ef
SHA512 68bfb332cacf5e3e50c3f029c4c606130297dc25c661b6f5ae4535ad1cd00bb179b0106f1bd38f1812e18553cd123120e3417f86491e8335545da25efbc50f6e
SSDEEP 384:n1iFJjccCs+Bt0S3J38NX8TUNTUlIRYuvHqpHlBrfRKDhGAtTBbRQrkYKPpctqHS:8FJccQp3EwgmHVKDhGCBVekRBFyp
TLSH
T181C25B35E8A5CEB7BCEA8ED5B35A3643EEE00163898C9AD4D9C95E1D009B1CD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d94393a2bd19fb2fb63cfa5a241943e4fffaa8e97fec55001fa932e2bf6935ee
MD5 b0b1c9605a0732af8ba16d9373d348c3
SHA1 bec0c626722a56e2f348691d0a42abc87044c581
SHA512 103e1017f51f5ce1a9aaf5568f422fc6e89a054a273411e50f6dc7b0f4b0ebb3e3db02ef440ee185f3508781eca11b005ea01abe73b6cc220f09e27d1196c77c
SSDEEP 384:nFiFJjccCs+Bt0S3V38NX8TUNTUlIRYuvHdpHlBrfRKDhGAtTBbRQrkYKPpctqHS:MFJccQ13Ewg3HVKDhGCBVekRBFyp
TLSH
T1A9C25B35E8A5CEB7BCEA8ED5B35A7643EEE00163898C8AD4D9C95E1D009B1CD170FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f1d63c89fe2fe91eef4ea596ac4f8f1b7dfa4ea002d7855d20b10eb1048fd0dd
MD5 197f77defd3cf971773cf74b9887ef40
SHA1 3c28e6f28df56ef3a5e1960678c90fa1362679a5
SHA512 572d7da8a5610fd1f7f27d1ff36a16279b033b28f66b135345e13f240858aad549da5ff4407d556d736a3894e4a5ae7a2af8e594e5b3bfabffbf46b017a3bbb4
SSDEEP 384:nFiFavqMw38NX8TUNTUlIRYuvH3pHlBrfRKDhGAtTBbRQrfYKPpctqHrNlk+5vIu:MFayD3EwghHVKDhGCBVefRBFx
TLSH
T1BEC25B35E865CEA7BCEA9F85B31A7603EEE00193898C8AD4D5D85E1D00DB1CD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 f62345482c0c454329c0d955bc01b59207007b1d67cfbd5e164da9130b58aa3e
MD5 d8aa95e424449173f7c7c9cf7324dc7a
SHA1 ebb04e050c9521f2cc299dbabcf79b00c34635e7
SHA512 7abecd9437fd46a627d135d7f5a5f2e9ef69e9887f1086b0d7699e07f4446a707180e1639199aff5fc8c8419e08710ede33034c16abf52ae7eeca680854910be
TLSH
T195414FD15C3D1AD1D1FD1A2EB48B38FC92DCD72AF4A4347D6824EE984A3A61D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 485572d15a1d9458b743364ad3c58dd375f31661783ea8d32c933a9a1225c83f
MD5 b71cb86aae148f86dc8cee4e4fe4d896
SHA1 420ccdc6c3099b4668ce663ddd1f517406d90fe0
SHA512 adba6a81942940cfe3a27b6011f8e9305aa3030e2702c8670afe77e8a353b2ac7d424ac98064433963c41b7ce77f6bec15e12d215c0670624199947be33bd114
TLSH
T1994150E05C3D2AC1D1BD1A2FB48B38FC91DCD72AF4A4347D6814EA98463A20D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fcde7c6957b5d403992e4d55e7e639e41989caee045682949379d8af361f90a9
MD5 82001f1a7efa46e9cd2b856ff741012c
SHA1 78fd744f3e593dc10f332c7f00792d733e412521
SHA512 4223f6d8f4e297cc8a7c6562e75b58c7cf47358433ee6c383dc71c7d7c9349a10224ea4d0c57b7c4f76443444a73549019f0f7ec585259cf7fa1e1693a99c25c
TLSH
T1CA414FD19C3D2AD1D4FD1E2EA48B38FC91DCD72AF4A4347D6828EA88463A61D604083F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_1210948129\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_17812645\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping740_675188765\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/232-296-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/660-215-0x000001C665470000-0x000001C66551F000-memory.dmp

Download

memory/920-602-0x00000000009C0000-0x0000000000A82000-memory.dmp

Download

memory/940-547-0x0000000000880000-0x0000000000942000-memory.dmp

Download

memory/968-89-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/1340-529-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1368-492-0x0000000000AE0000-0x0000000000BA2000-memory.dmp

Download

memory/1616-362-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/1656-615-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1732-552-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/1804-321-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/1904-389-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/2044-444-0x0000000000A40000-0x0000000000B02000-memory.dmp

Download

memory/2172-431-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/2212-629-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2248-548-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/2296-592-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-210-0x00000000009F0000-0x0000000000AB2000-memory.dmp

Download

memory/2372-346-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/2424-27-0x000001904CB30000-0x000001904CBDF000-memory.dmp

Download

memory/2428-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2448-226-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2480-381-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/2488-188-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-298-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-412-0x0000000000A20000-0x0000000000AE2000-memory.dmp

Download

memory/3044-603-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/3084-249-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/3148-626-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3212-328-0x0000000000A10000-0x0000000000AD2000-memory.dmp

Download

memory/3252-91-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/3312-528-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3388-525-0x0000000000A10000-0x0000000000AD2000-memory.dmp

Download

memory/3440-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3532-524-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/3548-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3672-343-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3692-432-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/3740-435-0x0000000000A00000-0x0000000000AC2000-memory.dmp

Download

memory/3828-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-322-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4012-273-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/4144-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4188-472-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4244-234-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/4352-468-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4360-340-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/4412-282-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/4508-606-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4584-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4768-186-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4876-209-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/4912-339-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/4928-625-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/4932-512-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/4956-591-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/5016-361-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/5240-556-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/5304-555-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/5324-281-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/5332-390-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/5360-251-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-469-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/5416-235-0x00000000008B0000-0x0000000000972000-memory.dmp

Download

memory/5488-265-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/5552-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5552-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5552-84-0x000002888B100000-0x000002888B1AF000-memory.dmp

Download

memory/5556-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5628-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5684-347-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/5852-493-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/5860-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5860-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5936-443-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/6012-358-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/6068-266-0x0000000000620000-0x00000000006E2000-memory.dmp

Download

memory/6100-359-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6128-456-0x0000000000A00000-0x0000000000AC2000-memory.dmp

Download