systex | 779b15c488b7c9187c923cf9c95d5fcfdb3893be6cf2162fca216a84f1aef648

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260506-mbazesfs7s
SHA256 779b15c488b7c9187c923cf9c95d5fcfdb3893be6cf2162fca216a84f1aef648
MD5 11974fbc3bcc8f9db41e7fc6545c4669
SHA1 cf9d954999d292b0f1977197b2dcabc919507cdc
SHA512 231ea799f65bf88a564558bc3687763d205f2fc89b033d2a5c12e2b7f44b2a42c02a08d8e3badc2413f779973c9d25f0382fdb6fead9d0dfea78a681ce2d8ae4
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T15A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4804	CP.exe
4336	pnhfzxsmez.exe
484	CP.exe
1676	CP.exe
3872	i_pnhfzxsmez.exe
2548	ezxrpmhbzx.sys
4800	CP.exe
2624	zxusmkecwu.exe
1376	CP.exe
2688	CP.exe
4316	i_zxusmkecwu.exe
1752	mhezwrpjhb.sys
3412	CP.exe
3796	wrojhbztrl.exe
3872	CP.exe
856	CP.exe
1992	i_wrojhbztrl.exe
1100	ywrojdbwto.sys
3372	CP.exe
3272	omgebwuomh.exe
3184	CP.exe
3012	CP.exe
4244	i_omgebwuomh.exe
1556	ljdbwtolge.sys
3248	CP.exe
1564	bvtnlgeyvt.exe
2500	CP.exe
4436	CP.exe
4956	i_bvtnlgeyvt.exe
3664	dbvtnlgdyw.sys
4816	CP.exe
1916	sqlidbvtnl.exe
1800	CP.exe
2480	CP.exe
3244	i_sqlidbvtnl.exe
2328	aysqkidavt.sys
1392	CP.exe
3676	ifaysqkidx.exe
4656	CP.exe
4244	CP.exe
4860	i_ifaysqkidx.exe
4460	pnifaysqki.sys
5096	CP.exe
768	fdxvpnifay.exe
5008	CP.exe
4464	CP.exe
2052	i_fdxvpnifay.exe
4176	zxspkicaus.sys
3808	CP.exe
2412	pnhfzxupnh.exe
3244	CP.exe
2252	CP.exe
1196	i_pnhfzxupnh.exe
4580	smkecwupmh.sys
2604	CP.exe
892	hfzxrpkhcz.exe
3084	CP.exe
4456	CP.exe
3716	i_hfzxrpkhcz.exe
2312	hcwuomhezu.sys
3148	CP.exe
3828	mjhbzurmhb.exe
5004	CP.exe
2536	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_189779061\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_189779061\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_189779061\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1333158525\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1821329733\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1821329733\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_100407295\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_100407295\nav_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxsmez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqligaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxsmez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqligaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fayspnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgeyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgeyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkidx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fayspnifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkicaus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2428	ipconfig.exe
5064	ipconfig.exe
3384	ipconfig.exe
3120	ipconfig.exe
3060	ipconfig.exe
2336	ipconfig.exe
3872	ipconfig.exe
2572	ipconfig.exe
1488	ipconfig.exe
3892	ipconfig.exe
3972	ipconfig.exe
1588	ipconfig.exe
3544	ipconfig.exe
3172	ipconfig.exe
2548	ipconfig.exe
3120	ipconfig.exe
2152	ipconfig.exe
4644	ipconfig.exe
2024	ipconfig.exe
4984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251793"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "4017491973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225362230756221"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{7DA316A1-0586-4B5D-BB35-B46E87B57D3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe
4336	pnhfzxsmez.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe
2472	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	i_pnhfzxsmez.exe
Token: SeDebugPrivilege	4316	i_zxusmkecwu.exe
Token: SeDebugPrivilege	1992	i_wrojhbztrl.exe
Token: SeDebugPrivilege	4244	i_omgebwuomh.exe
Token: SeDebugPrivilege	4956	i_bvtnlgeyvt.exe
Token: SeDebugPrivilege	3244	i_sqlidbvtnl.exe
Token: SeDebugPrivilege	4860	i_ifaysqkidx.exe
Token: SeDebugPrivilege	2052	i_fdxvpnifay.exe
Token: SeDebugPrivilege	1196	i_pnhfzxupnh.exe
Token: SeDebugPrivilege	3716	i_hfzxrpkhcz.exe
Token: SeDebugPrivilege	1472	i_mjhbzurmhb.exe
Token: SeDebugPrivilege	5020	i_mjebwuomge.exe
Token: SeDebugPrivilege	1672	i_eywqoigbyt.exe
Token: SeDebugPrivilege	2640	i_sqligaytnl.exe
Token: SeDebugPrivilege	2364	i_lfdxvqniga.exe
Token: SeDebugPrivilege	2684	i_fayspnifdx.exe
Token: SeDebugPrivilege	4792	i_zxspkicaus.exe
Token: SeDebugPrivilege	4512	i_usmkecxupm.exe
Token: SeDebugPrivilege	1328	i_mjhbzurmje.exe
Token: SeDebugPrivilege	2744	i_mjecwuomge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2492	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 4620 wrote to memory of 4212	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 4212 wrote to memory of 1760	4212	iexplore.exe	81
PID 2492 wrote to memory of 2472	2492	iexplore.exe	82
PID 2472 wrote to memory of 2452	2472	msedge.exe	83
PID 2472 wrote to memory of 4748	2472	msedge.exe	85
PID 2472 wrote to memory of 4196	2472	msedge.exe	84
PID 2472 wrote to memory of 4196	2472	msedge.exe	84
PID 2472 wrote to memory of 4196	2472	msedge.exe	84
PID 2472 wrote to memory of 2044	2472	msedge.exe	86
PID 2472 wrote to memory of 2044	2472	msedge.exe	86
PID 2472 wrote to memory of 1440	2472	msedge.exe	88
PID 2472 wrote to memory of 1440	2472	msedge.exe	88
PID 2472 wrote to memory of 1440	2472	msedge.exe	88
PID 2472 wrote to memory of 3432	2472	msedge.exe	89
PID 2472 wrote to memory of 3432	2472	msedge.exe	89
PID 2472 wrote to memory of 3432	2472	msedge.exe	89
PID 2472 wrote to memory of 4840	2472	msedge.exe	91
PID 2472 wrote to memory of 3924	2472	msedge.exe	92
PID 2472 wrote to memory of 1384	2472	msedge.exe	93
PID 2472 wrote to memory of 4840	2472	msedge.exe	91
PID 2472 wrote to memory of 4840	2472	msedge.exe	91
PID 2472 wrote to memory of 3924	2472	msedge.exe	92
PID 2472 wrote to memory of 3924	2472	msedge.exe	92
PID 2472 wrote to memory of 1384	2472	msedge.exe	93
PID 2472 wrote to memory of 1384	2472	msedge.exe	93
PID 2472 wrote to memory of 1380	2472	msedge.exe	94
PID 2472 wrote to memory of 2572	2472	msedge.exe	95
PID 2472 wrote to memory of 1380	2472	msedge.exe	94
PID 2472 wrote to memory of 1380	2472	msedge.exe	94
PID 2472 wrote to memory of 2572	2472	msedge.exe	95
PID 2472 wrote to memory of 2572	2472	msedge.exe	95
PID 2472 wrote to memory of 3712	2472	msedge.exe	96
PID 2472 wrote to memory of 3712	2472	msedge.exe	96
PID 2472 wrote to memory of 4232	2472	msedge.exe	115
PID 2472 wrote to memory of 4232	2472	msedge.exe	115
PID 2472 wrote to memory of 3740	2472	msedge.exe	99
PID 2472 wrote to memory of 3740	2472	msedge.exe	99
PID 2472 wrote to memory of 3416	2472	msedge.exe	100
PID 2472 wrote to memory of 3416	2472	msedge.exe	100
PID 2472 wrote to memory of 1688	2472	msedge.exe	102
PID 2472 wrote to memory of 4856	2472	msedge.exe	103
PID 4856 wrote to memory of 688	4856	msedge.exe	104
PID 4620 wrote to memory of 4804	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2472 wrote to memory of 3892	2472	msedge.exe	107
PID 2472 wrote to memory of 3892	2472	msedge.exe	107
PID 4336 wrote to memory of 484	4336	pnhfzxsmez.exe	109
PID 2472 wrote to memory of 4408	2472	msedge.exe	112
PID 2472 wrote to memory of 4408	2472	msedge.exe	112
PID 2472 wrote to memory of 4624	2472	msedge.exe	113
PID 2472 wrote to memory of 4624	2472	msedge.exe	113
PID 2472 wrote to memory of 2484	2472	msedge.exe	114
PID 2472 wrote to memory of 2484	2472	msedge.exe	114
PID 2472 wrote to memory of 4232	2472	msedge.exe	115
PID 2472 wrote to memory of 4232	2472	msedge.exe	115
PID 4620 wrote to memory of 1676	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4620 wrote to memory of 4800	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2624 wrote to memory of 1376	2624	zxusmkecwu.exe	122
PID 4620 wrote to memory of 2688	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4620 wrote to memory of 3412	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 3796 wrote to memory of 3872	3796	wrojhbztrl.exe	131
PID 4620 wrote to memory of 856	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 4620 wrote to memory of 3372	4620	2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 3272 wrote to memory of 3184	3272	omgebwuomh.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_11974fbc3bcc8f9db41e7fc6545c4669_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff8eadbc188,0x7ff8eadbc194,0x7ff8eadbc1a0
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,13830537423043086657,10748781551658206714,262144 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,6459650188884804120,2730053932940583133,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:11
      4⤵
      System Time Discovery
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,4592006149541013722,10444517340389076186,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,8242212065650656715,7426334205142428345,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,14691505049599545470,9348364455016331036,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12458909973769627862,14043193790918852140,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,16675109987172535362,13458947418333279487,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,8371380570797868995,4951200427480720828,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:1384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4348,i,4963844903147589420,238335420552281450,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4292,i,17848307212928662707,8662347883940485549,2097152 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5658881691849165076,7368342360761207,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,15321170762950258358,9255349422822098627,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,17206393954873800050,5724439763465536582,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:14
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,7725522589686793419,14774635003996787471,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,4651930036000349476,10046566953138383899,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,4651930036000349476,10046566953138383899,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,6348620595731647062,14399937724713623793,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,9244265818003249763,11263564130025914602,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,16139611889137759604,9363619849774238515,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,17665061073956114250,6067338110035715011,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,9819109430593894703,4603714215060260526,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,14626765516581424986,15159724449517433701,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,12201603518969485362,13487126875125973266,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,13985834979022484338,9994923627296026542,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,10171503034992271084,4510586613487390614,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:4296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7954602042516840005,8094760680365383752,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,2522890087725140998,2595761659401917367,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=864,i,5360686267313193766,3240109307259472929,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,7803221833836885646,11416108876231562462,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=864 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3508,i,15095356294266700333,9288084882636368038,262144 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:10
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,26544591857758858,15541720304540421429,524288 --field-trial-handle=2152,i,16350814919063731442,9009121195769710645,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:4460
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxsmez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4804
- - C:\Temp\pnhfzxsmez.exe
    C:\Temp\pnhfzxsmez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxsmez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1676
- - C:\Temp\i_pnhfzxsmez.exe
    C:\Temp\i_pnhfzxsmez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxusmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\zxusmkecwu.exe
    C:\Temp\zxusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxusmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Temp\i_zxusmkecwu.exe
    C:\Temp\i_zxusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3412
- - C:\Temp\wrojhbztrl.exe
    C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:856
- - C:\Temp\i_wrojhbztrl.exe
    C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgebwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\omgebwuomh.exe
    C:\Temp\omgebwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgebwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\i_omgebwuomh.exe
    C:\Temp\i_omgebwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlgeyvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3248
- - C:\Temp\bvtnlgeyvt.exe
    C:\Temp\bvtnlgeyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlgeyvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\i_bvtnlgeyvt.exe
    C:\Temp\i_bvtnlgeyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4816
- - C:\Temp\sqlidbvtnl.exe
    C:\Temp\sqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2480
- - C:\Temp\i_sqlidbvtnl.exe
    C:\Temp\i_sqlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaysqkidx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\ifaysqkidx.exe
    C:\Temp\ifaysqkidx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaysqkidx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4244
- - C:\Temp\i_ifaysqkidx.exe
    C:\Temp\i_ifaysqkidx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\pnhfzxupnh.exe
    C:\Temp\pnhfzxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Temp\i_pnhfzxupnh.exe
    C:\Temp\i_pnhfzxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\hfzxrpkhcz.exe
    C:\Temp\hfzxrpkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4456
- - C:\Temp\i_hfzxrpkhcz.exe
    C:\Temp\i_hfzxrpkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Temp\mjhbzurmhb.exe
    C:\Temp\mjhbzurmhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\i_mjhbzurmhb.exe
    C:\Temp\i_mjhbzurmhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  PID:4604
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  PID:4504
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigbyt.exe ups_run
  2⤵
  PID:3064
- - C:\Temp\eywqoigbyt.exe
    C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigbyt.exe ups_ins
  2⤵
  PID:4796
- - C:\Temp\i_eywqoigbyt.exe
    C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqligaytnl.exe ups_run
  2⤵
  PID:3476
- - C:\Temp\sqligaytnl.exe
    C:\Temp\sqligaytnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqligaytnl.exe ups_ins
  2⤵
  PID:5092
- - C:\Temp\i_sqligaytnl.exe
    C:\Temp\i_sqligaytnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  PID:2460
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  PID:1404
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fayspnifdx.exe ups_run
  2⤵
  PID:2008
- - C:\Temp\fayspnifdx.exe
    C:\Temp\fayspnifdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5100
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fayspnifdx.exe ups_ins
  2⤵
  PID:3680
- - C:\Temp\i_fayspnifdx.exe
    C:\Temp\i_fayspnifdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkicaus.exe ups_run
  2⤵
  PID:3356
- - C:\Temp\zxspkicaus.exe
    C:\Temp\zxspkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkicaus.exe ups_ins
  2⤵
  PID:1544
- - C:\Temp\i_zxspkicaus.exe
    C:\Temp\i_zxspkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupm.exe ups_run
  2⤵
  PID:2648
- - C:\Temp\usmkecxupm.exe
    C:\Temp\usmkecxupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupm.exe ups_ins
  2⤵
  PID:2760
- - C:\Temp\i_usmkecxupm.exe
    C:\Temp\i_usmkecxupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmje.exe ups_run
  2⤵
  PID:536
- - C:\Temp\mjhbzurmje.exe
    C:\Temp\mjhbzurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmje.exe ups_ins
  2⤵
  PID:5016
- - C:\Temp\i_mjhbzurmje.exe
    C:\Temp\i_mjhbzurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjecwuomge.exe ups_run
  2⤵
  PID:992
- - C:\Temp\mjecwuomge.exe
    C:\Temp\mjecwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjecwuomge.exe ups_ins
  2⤵
  PID:1556
- - C:\Temp\i_mjecwuomge.exe
    C:\Temp\i_mjecwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3284

C:\Temp\ezxrpmhbzx.sys
C:\Temp\ezxrpmhbzx.sys
1⤵
- Executes dropped EXE
PID:2548

C:\Temp\mhezwrpjhb.sys
C:\Temp\mhezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\ywrojdbwto.sys
C:\Temp\ywrojdbwto.sys
1⤵
- Executes dropped EXE
PID:1100

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
- Executes dropped EXE
PID:1556

C:\Temp\dbvtnlgdyw.sys
C:\Temp\dbvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:3664

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\pnifaysqki.sys
C:\Temp\pnifaysqki.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\zxspkicaus.sys
C:\Temp\zxspkicaus.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
- Executes dropped EXE
PID:4580

C:\Temp\hcwuomhezu.sys
C:\Temp\hcwuomhezu.sys
1⤵
- Executes dropped EXE
PID:2312

C:\Temp\trmjecwurm.sys
C:\Temp\trmjecwurm.sys
1⤵
PID:2460

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
PID:1620

C:\Temp\dbvtnljdbv.sys
C:\Temp\dbvtnljdbv.sys
1⤵
PID:4192

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
PID:1556

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
PID:4728

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
PID:1588

C:\Temp\czusmkecwu.sys
C:\Temp\czusmkecwu.sys
1⤵
PID:804

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
PID:5104

C:\Temp\wurmkecwuo.sys
C:\Temp\wurmkecwuo.sys
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgeyvt.exe

Path C:\Temp\bvtnlgeyvt.exe
Size 230KB
SHA256 02def1f0d941007fea1f04910aeea000f2dd468162aa2ce499502172a6d858c7
MD5 76317fc5b5973728e3a5e57aab3e1b5e
SHA1 e0f1d6131df1aa6f0b49573903bf6b2f43c8cadf
SHA512 043ec0563cb3343ab854c541b22dbcbeca50d134b8619daeb29f7882685a4f079e77147cbc8acf6a70a3ffb1e146365963834363c2c9b6bd80ae2adb805c8a2c
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T17F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnlgdyw.sys

Path C:\Temp\dbvtnlgdyw.sys
Size 141KB
SHA256 c11de8509e982a6002eca1935be17bd6e1ef88f68744d6802e39452f40231e4a
MD5 2d6a0e6aa80bd8192ed6c60988d90eef
SHA1 6d45c2874f34a188b9d271348059dc825288015b
SHA512 5afbfd4f191631dacb85bffef9dbe85bd24b1f924c2731248ebc30de4707e1a65f38018db15810560b9a740b2db103d5555385539b796a8031ac52520e8a71a5
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T13CE38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezxrpmhbzx.sys

Path C:\Temp\ezxrpmhbzx.sys
Size 141KB
SHA256 add1f19e72740b0bee254f2beaac48ffb9180ff6732b44c81ff7156b75486391
MD5 f36bf99dd18bf933f76f174d965742bb
SHA1 eeabc5a62727ef809143fe41d9cf40b1129d87c6
SHA512 46fe5c9bf4b36e322eb97fb8c0336b3589b7e4799764c239b75b9246d147a30519657435742523488f02e2e9994f4198a56956c2f0e089b2c9203a6284017d4a
SSDEEP 3072:XsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:XsQmpcF8BzXfwV
TLSH
T197E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgeyvt.exe

Path C:\Temp\i_bvtnlgeyvt.exe
Size 230KB
SHA256 3555044177b885fa033c31fd012b4e883dc4f992c617ff06ae5100ea9e3b38a0
MD5 5d3635014430dc61a240d198e74578aa
SHA1 df4661819ff7c54cb1e256339136b39c33df93b4
SHA512 0df5f996ad9ce6db66bc1d970a1ba9680a3e7f255312e6a3d6ceb6bc98a5712f5b9823cce763aa9c8e39e4563fc62ab2aabdda9e9138ef90e04d32ee504ad9f7
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T141344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgebwuomh.exe

Path C:\Temp\i_omgebwuomh.exe
Size 230KB
SHA256 da7fc95141cf77bce00ec460f1d6247ccb077803a715b68f28cb385692779854
MD5 12f2c3c6997dfc4c17dc0e612e890329
SHA1 8dff8c508a7419d7a5a92c24b12a49ec8c1c8eda
SHA512 3f96eed5436636d51150da68bc4b443ddde081ab5c5dd3c2039f2bd13a3ec60da498f6bf0c16ead607cc781b0057eada0313685771c9f5ac7512f6dca224e8bf
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T17E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxsmez.exe

Path C:\Temp\i_pnhfzxsmez.exe
Size 230KB
SHA256 9809ae4859f9064bf0c9a4e45b0ecb832fae74d00372a2574c180ec366c177bb
MD5 9cbde3d1741241a87b9bc109f13aa171
SHA1 1cfb0f84d6557dd443ff70d04f0b598b780402b9
SHA512 d11663cf37f1af3663834dca06c8da0deeabeb442e2283764f2861e6548e75c3465ee25d4fe48dc69fe1841f287dc767ad745d9232fe4e31439d306055c5ba84
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrl.exe

Path C:\Temp\i_wrojhbztrl.exe
Size 230KB
SHA256 dce4792cfe1940c7a099475aece1c75a44d9c0bfa1ddc74dd98a0c4a9203abfd
MD5 db6f832fcc992f90bf5d62de37f37a8a
SHA1 fbb082d41f1855eb34ea257f6cc5dcddfb2204cf
SHA512 ede41faf75e9223a583677b823a5423cff40a3b996a7f544b8a4afda48924183a128e4c7d50065ddd3b9abe4584781f7c6a3b2920c563ba77ed6d49a1e45f0b0
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T157344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxusmkecwu.exe

Path C:\Temp\i_zxusmkecwu.exe
Size 230KB
SHA256 012bf20b6c476cb4f2475421884f8e30a15bb67db1bb3c97dd00e1a46bb586e3
MD5 38bf88d0fd48c25c99b742f806d2a8b0
SHA1 29b12a4800f5b35b063484bcefc13887663f3534
SHA512 ff60b3f06fc3bd6aa41a03e7b1633dddcff0bbc4b5991e0516199266e335310b94b9e8835e42f888c43d870b2e4fdd8b2e5d350159a2e5246c05e1a74e1684ec
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T140344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtolge.sys

Path C:\Temp\ljdbwtolge.sys
Size 141KB
SHA256 4c9df1955d28f00a8b1f296740cf07ec4e089aeac12c18838e60408ed130364f
MD5 271d3692eabfb7ebe7241ecf26a0c6ef
SHA1 d3a95ec1566373139a2a9bc6ccea7c4b7e958572
SHA512 d06a2e40c58cecacaf01afcd38ae19601ea0f46bcb1e867fdb8ea6eb9839db7c325baf5b07704fb0587ac07197e0f8babde1613036ac96ca794f10d5f505c8c0
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T142E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezwrpjhb.sys

Path C:\Temp\mhezwrpjhb.sys
Size 141KB
SHA256 dd78ee9c3abccb75d0620633647ebd114774a108d597bf1d219e7c25f895a535
MD5 2c589f36c83c119d2c03bb0748455f3b
SHA1 c9288d3706c05b64211306037a4acbdfdc57db13
SHA512 23f4dab9c9eb11ee6c38b226db3ea069964e560a04f5414d84995898156c0d7e1c0a8ee9b58ec706b63e5463120b5620087c3e369be079205121132131412ce3
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T132E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwuomh.exe

Path C:\Temp\omgebwuomh.exe
Size 230KB
SHA256 1a2e68157bf3295a99654e0371f2cb7a59c9a03aac7b32c5108ad138b7ef09f8
MD5 ca343050fba2ae80777002a3415df6fb
SHA1 94a8704ac78c715441d5d71aa095fa1f37abc180
SHA512 c7e39874fa2c7945e9e79b153d63ec6c67be6894cd57e337386b7be4281be297e02c639191492f1a1eb16c67e9372b48ef02b3957c5770f094160f015e54b493
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T16F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxsmez.exe

Path C:\Temp\pnhfzxsmez.exe
Size 230KB
SHA256 b61daeb9fa778088652a2a440b87761bc80477551796a0f9cd1e9449a3f4904c
MD5 bc0196e1cbe4a23a7878d3f9744b5722
SHA1 788b53f8b5d15813e80e8ee086b7315f4273e9b0
SHA512 4d8f79c41052bcc6bcd2775e7df67e63b24f95e3818237a7cc9083a3fb64be2d48b9dd2c061505b5e4231c89bd17ae1e626036d5239836f44ddd1544298a7dd5
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:OghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrl.exe

Path C:\Temp\wrojhbztrl.exe
Size 230KB
SHA256 47ac73ac60c5bce6432baea3b21672659c2fa84fe9852fce9fd8b809ca693a26
MD5 3c7be7710b47b415786103ddcc60417a
SHA1 175e899dfc586d1464b604b38b43ee93b787f777
SHA512 39c9ce6e7d121687fc3433bb72ab0afab29dd1fdf692693c88eb8822394abfba022512ce54fd86328611ec7d163332bd20969e4785d1b56f65c44f76f3f4dfe6
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojdbwto.sys

Path C:\Temp\ywrojdbwto.sys
Size 141KB
SHA256 6ca46aed1bc83eb071d1f3df939d44cd2d78e60eb15a075ca9bd0ed4943a8766
MD5 a7b2810f329a12053a22d0a92081d538
SHA1 cf43f2571adeb9d59b72cb07aa9bb17d8766a543
SHA512 bc7fd6bcd38c35228a58bc08a3e806f32e41b241d65ad5e0fc35e670d16fe874948233cba6b517d76eae85569d676550acf8d071cc1c776e23ea9555566fe136
SSDEEP 3072:asQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:asQmpcF8BzXfwV
TLSH
T1EDE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxusmkecwu.exe

Path C:\Temp\zxusmkecwu.exe
Size 230KB
SHA256 ebd8f973a910b91970c3d891c42abe461fec259e380fb1a39f6919ae2062bcf7
MD5 4e6331f43f4f3a1ad0aee3332d531caf
SHA1 9653ceedada011afcf13ace404f6667a04d8148a
SHA512 38897f0eef875d59211fbb4db8c06643a030f3f437a8cabf0571b38f675ea61b61b846017aca70fa52eecda56a10d1a0ec3f4ab719b028f79edb9d251109d170
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T179344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 44e9a43c63982734361d58f6dbb1502c3d740628b05ab5bec57406bde04add60
MD5 723a748e44caadd71195ffe4e217722d
SHA1 7c7f1c75f1efbe6ba044a556d11f863c98b2acda
SHA512 44b8b021f13d2c8587120e726b58a313a8c6936ade23d6930d74e692ecbb5ad90bf9aaefec94e7110419575515c29551e0ec9551d3e4937f1f999d88b062c3f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 20c4fb774f21ba41d76ee3d5ad0f0d9bf412b956792028d4cfdfa7803bfc6237
MD5 3b45ac0dbf44769117e3df1e476a13c4
SHA1 c46ce1b0fc3970f6737fe07484dda13824785dd0
SHA512 7780a312c799ccbc99ced034db3eca1c756d2ca3f3b714f269bca3bc3009b3fe2d5c7d6b0927ca0e839ca76674e3bc26471a6c37f935ba33cd5d0e4e666508c9
TLSH
T1DD71F6409DD2E7A9EBE044787A8F1040F9E0B659CD370E2B1DEF443D5A8BBA181BCD50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585937.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585937.TMP
Size 3KB
SHA256 0759877815146f02a61f48213e339b2fb7c4e5a17d4f0868c29d042e413e742b
MD5 27aa2d40109371a957e87187abc90c44
SHA1 51c66a564c02bb2c8863306c5ceb9e12599eb1ff
SHA512 e6b885d4acf606d2cd63c306054a6a095bc04037083f66e832a26e73f943a2f88d3c483aa50c095d767b8fc1a4b9297e13fa900697b38d72c8447760697c1f85
TLSH
T17771E6409DD2E6A9EBE044787A8F1044F9E0B658CD370E2B1DEF443D5A8BBA281BCD50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1cf982faf9be3b06ef4c1290e54d4dfe19535f91a3a9595274cf4b8ad7bad05f
MD5 3b9491eabd4e65e3cd152da0ee253fa7
SHA1 5a4578c8e5420de30e75177d52437ba1db91bf7b
SHA512 b92e127a387223d8d1b283a795ec5ada75f635c24b485a1b177c5e93b67658c7d0d077a40ded4eb7680d56b5577c090ab0e6478bc36131982c2e09915a4e9672
TLSH
T13651DEF3C3E585AD8A1156F0B6147E2BCE2D0A14432C3D5AC9E4EF1B93E2471E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 84468b7a63721b3606bc65f76003e2e454621dc0708a61fb18f915c644dd6ca7
MD5 e6653c4c1f22a11913f5b90a639b5dd3
SHA1 6af54d23ed5b547ac187f2353c82aeb7a2ba3fa2
SHA512 a5c8bdd771d6bc5029e4ce269e5a123c0dba5ceadf34901e58b4544b8a62d880b9a9fa19ad7d752653f5e73d97b6ea9437e4e8a084aa0d1372374578acc62ca3
SSDEEP 192:sxZLRSyM//K1Ml8Mcr/fDs11eNguIdp/i/W6+WNsitepfY0FY80/PIg4J:sxZL80r/fDs11tK/bRApf52Bc
TLSH
T13A520902AA34593BCDCBD209B915BF63D6F51572D2941E44EAFCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02c10c1d681f18dc76886dab45986a744a970dc2ebdc6702a5f83f1a0f1a5623
MD5 e7cb0c06cb9e28d3b39d5e546028012d
SHA1 c0ec25035f26da4c879eb20f70c72bff5f4e50ab
SHA512 58f47f20cf81991ba091ee55b9a71b8bc4c886909cdac9576bec0e8f6e73959652e783d5f07fe92885c9221e26b166d1ccbae2a7c9f391f44dc33dc462bdedea
SSDEEP 192:sxZLRSyM//K1Ml8UQNcr/fDsgweNguIdpZi/W6+WNsitepfY0FYNjlPIg5QJ:sxZL8qyr/fDsgwtA/bRApf527C
TLSH
T12E620902AA34593BCCDBD209F945BF63D6F51572D2941E44AAFCCA0C01E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 10f618a48fd25e8b0b4577b10177b9123b2cea50dec91e1c620f7eae117d6920
MD5 c7381a87523b0e246e8b630589f3d0e9
SHA1 8aa21462c6e14a7bfb5f9ff18f494a7ec49e89e1
SHA512 2338e1a5583e6daf8d1988710bf5648352c48a1011657cbb0e233c703ed0ab8b690834e63745e51f63075903e04e9ebebbdc4ce4e75788eed85403f9bef91cc9
SSDEEP 768:pEP7x8t12SY7pLuLno0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3G/izLlW:pEP7x8t12SEEno0WRmoMQ3Au1jaKG/i4
TLSH
T1EA030C3B780CCB7E4F804E9CDC26AE9A6DE8028B96988D5447FA484C03C67EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1413ca672e36e092febd0bfdbfa38c1c6ffaa3c93ef6bda7a8db04e8fbfcccc9
MD5 d04658e1ae5f71104444a22e212beb5a
SHA1 3fa57decf1e50385ae72838c3047772fecbdc89b
SHA512 b636a87db051bbdaf95d11eee16ed041b0e2201860d46f7f530fe24862ff4530123c28b544bea79680f6267cd828eded07d7596f0d79203ad4e79034ccea9380
SSDEEP 96:K84YKhq+iAAKdOym3mKwozZCKy4SS4AKNOLynOSw9:y7LjlV5Da
TLSH
T1D8E1E051B07A03912A7E25AA80D4B87E928135A73118F53B3B7801B60F6BF54DDFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8e8ab783-f9f3-4dcb-b3d5-85da1451c103.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e8ab783-f9f3-4dcb-b3d5-85da1451c103.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0564bf96b2db000a08ecd9f3f5142433833422f5d416d7fd007ab42c5914b5bf
MD5 94a6b219d31ce27bb92dc7661d34011a
SHA1 605068031212a89adf30326452c9acb5c2a926e2
SHA512 7e7d7047af80544ce99ea3175f8ca6b5c82cc80ea364264475ab05ba96c3a18d9de3eba31c9c976e243e00766014e8d9b180407ee909be00eb151ec50781f867
SSDEEP 384:njiFrcXqnv8Nn8TUNTUlIlyUneVnQQrZ42qDf0P/FpveHLDgmxcWnCU:OFzvSwg8Uef4KP/FBQDgmxB
TLSH
T19CD2B4F598E7893AD9EE4787633E6E425EBCC063B5885984FB881D0CCC821BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 20b77eb672bce71103800010e6215ff5c7056744295504abc0013f7c24b7aab3
MD5 170a780ff9e3a196e6c25921c57c8af0
SHA1 b80b001d91f806bb716ef5cdb921f75ecc748043
SHA512 f8fe571812be15bdfbc13ea751b224f2a1bc30b5000b7b6c8613358013388267a17322db75fc1ba6159befb6351fd670693665ed93424a3cccd0d2e60cc70e96
SSDEEP 384:nCcXqnA8NdyUneVnQQz242Y/FpveHvDgmxcWnCU:wA/Ue04b/FBeDgmxB
TLSH
T1AC826D35A8B85C3F99EB964AB14733535FB550BBCAD82F94DADC5B0C00C76DC270A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4329ddf23cd905966de31f20c70797fe4e517002836409eaf4ae6733c71a0206
MD5 94afadfe24a908f5532452368f7e36e9
SHA1 a1b287e23c90674a2111197b7dbb340f194109f9
SHA512 ffb0d1083885036306c398b77d16cb7aaca1a420e879bffb4a7dccd95d0ae45bee2f07a2d90c7510b5cb7eef7cfe43c7030f5f1e54dcaad13b1224392f0456a9
SSDEEP 384:nCcXqnK8NdyUneVnQQu242Y/FpveHvDgmxcWnCU:wK/UeZ4b/FBeDgmxB
TLSH
T12C826D35A8B85C3F99EB9649B14733535FB550BBCAD82F94DADC5B0C00C76DC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4e7348ab74ad975103869934b985fb5ee37bf9f371892d00cbdcc69a655e9122
MD5 a740aedf0afb3e43f021ae36a32ac6dd
SHA1 42f2fc5e1a2e28fb2cd16a3a4ae4239ceb2fd743
SHA512 f8aa5aaa85dbd36251106243fb01c99b9725a08daae8778037200efb04df0e32ad9389a4dd8591fdc7e7db4548bc92fd59c5452a959fbdabb54990d27c1ec774
SSDEEP 192:ZGN/6Pt3QmiUyvcXqB/Fl8YmbRcv7rUIis5U6:ZGN/6FZY0qB/FpvPDV5U6
TLSH
T10B020939A8786C7B9EE39E45B487B7135FA4106BDA946F94DAE81F0D00C765C2307426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 211c4b902703596b163c68095f953e2555b7de5850f99d066764f5444d138ee4
MD5 9c80dc807ccf1ff174b25bfc4d326378
SHA1 b9942bdb572b2ec9bffb5c5078e9468951f9780b
SHA512 69ed2ff0ebb0c0251196d8f5790a6840466ec0a107c2f2cac46bd5740d0cc859c4d55c9c78a1f89108e01b07c965699bc1bd7d1847a76ffd31663e2b88e53e7d
SSDEEP 384:ntcXqn98NdNUneVnQQ1242Y/FpveHvDgmxcWnCU:R9WUe+4b/FBeDgmxB
TLSH
T1B8825D35A8B85C3F99EB9649B14733535FB550B7CAD82F94DADC5B0C00C76DC270A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1ed402bbc1a508acda09358fece44fc0a89a1fa7dd57fdc437d8e302b294a852
MD5 85a66e76c52e4739a351d4c1a3cd3285
SHA1 4859f867c20e5dc8af7e9d79c1ef42088bd845d8
SHA512 857dafaf5581585b564d487332eded3150ef64b8a99d74942a574e3ae6233418077f6428fd63155807e9a5cdf5277dca667d57601896cec448267e1c14469ffd
SSDEEP 192:EGNg6PtBQmiUyenXFB/Fl8YmbRceH6YGKn4UI9qnhmU6:EGNg6FftXFB/FpveH6DgmU6
TLSH
T160120935A8BC9C3B5EE3E955B48777535EA0107BDEC5AF94E6E91B0C00C729C270B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 2b919bd3699904ee5f9376d981c88c0a03644e879088b38e9ef033408d5aa866
MD5 11810c668438b16da1ea53c8830d38d3
SHA1 5bfcb10055de8602aac183889407e40fb4f4e73a
SHA512 d05d8583fac61ac67d218c6aa8589b07a8002d0f4de04f021791a0e2777bcb352a59fc7d4d1cc2f00f477353ec4bba9ece17a02c3bd8e23404728f01c50837b3
SSDEEP 192:z9GNd1PtQ8AIQmiU1/8IZY/Fl8YmbRceH6YGKnFUI9qnhmU9:z9GNd1FQZoWiY/FpveHDDgmU9
TLSH
T1BD220835A8B89C3B9EE7E959F48737639EA41077DE856F94E6E91B0C00C728C270B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6d0540da2bf0db884af1127cc8df339b4aa4a6091d69eac4700d8e5f657cb89
MD5 5b97ca6c1d67640538e75c8a1fada489
SHA1 2e35aeef6880db203b925f78cdf33797972afebe
SHA512 43e4a0a2bfdac4d4dca3d965de53fd8abbf46f7732151bda978a2c853b71dbeb7bba0f5b5c54ba82707b5527aa75a1c6e4bf8364bea062f12f6c199a85f13de1
SSDEEP 384:ntcXqnF8NdNUneVnQQb242Y/FpveHvDgmxcWnCU:RFWUeE4b/FBeDgmxB
TLSH
T111826D35A8B85C3F99EB964AB14B33535FB550B7CAD82F94DADC570C00C72DC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

7f46f2fd-5c06-4bea-9f7d-fec3fc0137c8.tmp

Path C:\Users\Admin\AppData\Local\Temp\7f46f2fd-5c06-4bea-9f7d-fec3fc0137c8.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8d6de66-2bd2-434f-b0eb-75725690e0eb.tmp

Path C:\Users\Admin\AppData\Local\Temp\f8d6de66-2bd2-434f-b0eb-75725690e0eb.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

043f42de-abdf-406d-8abf-787f019246b6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_1699016479\043f42de-abdf-406d-8abf-787f019246b6.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2472_1915191140\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_100407295\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1333158525\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_1821329733\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2472_189779061\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-79-0x0000029C7E540000-0x0000029C7E571000-memory.dmp

Download

memory/688-80-0x0000029C7FB90000-0x0000029C7FB99000-memory.dmp

Download

memory/804-839-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1100-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-774-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-589-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1588-827-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-741-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-770-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-537-0x000002B3E6C10000-0x000002B3E6C41000-memory.dmp

Download

memory/1752-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2312-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-626-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-726-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2548-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3104-877-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3664-613-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4176-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4192-761-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4580-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-804-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5104-865-0x0000000000010000-0x0000000000083000-memory.dmp

Download